Skip to main content
The 2024 Developer Survey results are live! See the results
49 votes
Accepted

Why was AES CBC removed in TLS 1.3?

Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked. AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
user4982's user avatar
  • 5,339
49 votes
Accepted

7zip : Why does encrypting the same file with AES-256 not give the same output?

This is expected behavior since 7zip uses Cipher Block Chaining (CBC) mode for encryption. For which you need the Initialization Vector (IV) to be unique and unpredictable. It was using 64-bit IV but ...
kelalaka's user avatar
  • 49.1k
24 votes
Accepted

Bit Flipping Attack on CBC Mode

The Bit Flipping attack Decryption process in CBC mode is performed as \begin{align} P_1 =& Dec_k(C_1) \oplus IV\\ P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb, \end{align} where $nb$...
kelalaka's user avatar
  • 49.1k
20 votes
Accepted

Why is padding used in CBC mode?

So, I'll answer the theoretical part of your question, since we need a key to address the practical part. Why is padding used in CBC? Blockcipher such as AES are encrypting blocks of a fixed given ...
Lery's user avatar
  • 7,749
20 votes

7zip : Why does encrypting the same file with AES-256 not give the same output?

Encrypting the same input multiple times, normally, is supposed to produce different outputs each time. This is so that an eavesdropper not only cannot tell that the input was ...
Luis Casillas's user avatar
18 votes

Why not authenticate full-disk encryption?

Authentication and probabilistic encryption are two desirable features which each take up a small amount of extra space. And you are absolutely right that the percentage of space consumed is of no ...
kasperd's user avatar
  • 1,387
17 votes

Why was AES CBC removed in TLS 1.3?

TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility. Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
Maarten Bodewes's user avatar
  • 93.5k
14 votes

Why not authenticate full-disk encryption?

So, are there reasons for not using authentication that I'm missing? I believe that the real reason is not actually space, but time. As you said, storing the tags would not require that much space. ...
poncho's user avatar
  • 149k
13 votes
Accepted

Why not authenticate full-disk encryption?

With 4096-byte sectors, space is a complete non-issue, less than 1 % Problem 1: 10GB per TB is not a "complete non-issue" for many people. Problem 2: If the checksums are inside of their data ...
deviantfan's user avatar
  • 1,187
13 votes

Why is CBC with predictable IV considered insecure against chosen-plaintext attack?

The answer by mwhs is very wrong about CBC-MAC and its use of IV!! It is perfectly fine and secure to use the same IV for CBC-MAC! In fact, Jonathan Katz and Yehuda Lindell recommend using zero vector ...
bhass1's user avatar
  • 248
13 votes
Accepted

Are there any benefits to using ECB over CBC?

ECB benefits: It's a tiny bit easier to implement. It allows for parallel encryption and decryption (CBC only decryption). A single corrupted cipher block corrupts only one block of plain text(in ...
Meir Maor's user avatar
  • 11.9k
13 votes

Is DES secure under CBC?

No, it will be insecure. There are two reasons; Due to the smaller key size 56-bit; DES was tested for brute-force attack since published. DES_CHALL, 96 days to find the CES challenge key in 1997. ...
kelalaka's user avatar
  • 49.1k
13 votes

What is DES-EDE3-CBC?

At least in the context of PKCS#5 (which is commonly seen through the encryption of PEM files), DES-EDE3-CBC is Triple DES with three keys, used in CBC mode, with unspecified padding. Yes, “EDE” means ...
Gilles 'SO- stop being evil''s user avatar
12 votes

Predictable, but private IV in CBC

If a nonce $N_i$ is even, then the binary numeral for it its increment $N_{i+1} = N_i + 1$ differs from $N_i$ only in its least significant bit; and if $N_i$ is odd, its increment is even. This means ...
Luis Casillas's user avatar
12 votes
Accepted

CBC-Mode Infinite Garble Extension

The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ...
Maarten Bodewes's user avatar
  • 93.5k
12 votes
Accepted

What is the correct way to implement PBKDF2 + AES CBC + HMAC?

You'll find there's a lot of splitting hairs regarding this topic, especially key derivation. But yes, your pseudocode is fine, although you may want to revise (0, 128) => (0, 127) and (129, 256) => (...
hunter's user avatar
  • 3,975
12 votes

Random data CBC padding scheme?

Padding is dangerous. CBC mode with padding is secure against chosen-plaintext attacks, where the adversary can convince the legitimate party to encrypt messages and obtain the ciphertexts. But it is ...
Gilles 'SO- stop being evil''s user avatar
12 votes
Accepted

Always set the IV to 0 randomized CBC

This will be dangerous if there is a high probability of repeated initial blocks across plaintext. Cryptographers like to make as few assumptions as possible about the structure of plaintext and so ...
Daniel S's user avatar
  • 24.2k
11 votes
Accepted

Why is Fernet only AES-128-CBC?

This seems to me to be less secure... Do you have a plausible adversary that can break AES-128? AES-128 is believed (to the best of knowledge) to require $O(2^{...
poncho's user avatar
  • 149k
11 votes

Are there any benefits to using ECB over CBC?

From a theoretical point as a mode of operation ECB mode has only one advantage over all of the other modes: it doesn't require an IV. That means that the ciphertext doesn't expand if the message is a ...
Maarten Bodewes's user avatar
  • 93.5k
10 votes

Why was AES CBC removed in TLS 1.3?

from what I know CBC is the most secure Mode of operation for the AES block cipher I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in the ...
poncho's user avatar
  • 149k
10 votes
Accepted

When do I need to use CBC and HMAC?

Also, there is CBC-MAC for providing integrity and confidentiality. Which one is better CBC-MAC or CBC with HMAC? Which one is "better" is opinionated, but we can argue which objective ...
Maarten Bodewes's user avatar
  • 93.5k
10 votes
Accepted

Why does error propagation in CBC mode encryption affect two blocks?

Encryption process in CBC mode is performed as \begin{align} C_1 &= Enc_k(P_1 \oplus IV)\\ C_i &= Enc_k(P_i \oplus C_{i-1}),\;\; 1 < i \leq nb, \end{align} where $nb$ is the number of ...
kelalaka's user avatar
  • 49.1k
9 votes
Accepted

ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?

There is no good way to calculate a strength difference between ECB and CBC. ECB is broken as a generic cipher - it is not indistinguishable under chosen plaintext attack - as repeating blocks will ...
Maarten Bodewes's user avatar
  • 93.5k
9 votes
Accepted

Can we calculate AES-CBC-PKCS7 ciphertext length based on the length of the plaintext?

PKCS7 uses mandatory padding. Even if the length of your data is a multiple of your block size, it will pad. ...
krishna T's user avatar
  • 234
9 votes
Accepted

How is it possible that these two encryption functions yield the same result?

This is a problem created by the library. Either the HMAC algorithm is skipped entirely, or - more likely - the HMAC authentication tag is generated and then forgotten. The reason is likely the spotty ...
Maarten Bodewes's user avatar
  • 93.5k
9 votes
Accepted

AES-CBC decrypts to wrong output?

They trick you with the IV. The IV must be the same for encryption and decryption so that the encryption has the functionality that is; $$ m = D_k(IV,E_k(IV,m))$$ To surprise you, they modify the IV ...
kelalaka's user avatar
  • 49.1k
9 votes
Accepted

Is there a security risk to use AES-CBC as stream cipher?

"AES-CBC mode to encrypt `0's to generate blocks of the one-time pad and then use that one-time pad stream to encrypt plain text through XOR" is effectively AES-OFB. It's fine for ...
fgrieu's user avatar
  • 143k
8 votes

Why not authenticate full-disk encryption?

The threat it protects against is uncommon Encryption protects against an attacker who gains hold of the data. The typical threat is the theft of a laptop or a backup tape, the compromise of a remote ...
Gilles 'SO- stop being evil''s user avatar
8 votes
Accepted

AES in CBC Mode Is totally unsecure if no defense is provided for padding oracle attack, right?

The cryptographic community moves very slowly. Take MD5 security for example. A design flaw was first published in 1996 and a collision (with more design flaws) found in 2004. Yet in 2012, authors of ...
mikeazo's user avatar
  • 38.7k

Only top scored, non community-wiki answers of a minimum length are eligible