15
votes
Implement AES-CTR on top of AES-ECB
Yes, you can do this. In fact, implementing other cipher modes is precisely what ECB mode is good for (and, indeed, just about all it is good for).
To implement AES-CTR, simply fill an array of 128-...
- 45.9k
15
votes
Accepted
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
Assume I have a list of plaintext text and its corresponding ciphertext which was created using a specific key with AES in ECB mode.
Can I recover that key?
No. This is what is referred to as a ...
- 488
13
votes
Accepted
Are there any benefits to using ECB over CBC?
ECB benefits:
It's a tiny bit easier to implement.
It allows for parallel encryption and decryption (CBC only decryption).
A single corrupted cipher block corrupts only one block of plain text(in ...
- 11.7k
12
votes
Accepted
Chosen Plaintext attack on AES in ECB mode
Suppose we have a block cipher that takes a 16 byte plaintext and produces a 16 byte ciphertext (that is to say $\mathcal{Enc}: \{0,1\}^{128} \rightarrow \{0, 1\}^{128}$). We use this block cipher to ...
- 4,012
11
votes
Are there any benefits to using ECB over CBC?
From a theoretical point as a mode of operation ECB mode has only one advantage over all of the other modes: it doesn't require an IV. That means that the ciphertext doesn't expand if the message is a ...
- 91.8k
10
votes
Is it possible to find the key for AES ECB if I have a list of plaintext and corresponding ciphertext?
What is the simplest attack is the Brute Force Attack. However, it is infeasible to brute-force even AES-128 bit, AES also supports 192, and 256-bit keys sizes. To break the AES-128 with brute force, ...
- 47.6k
9
votes
Accepted
ECB vs. CBC, I've seen the pictures, but what's the actual strength difference?
There is no good way to calculate a strength difference between ECB and CBC. ECB is broken as a generic cipher - it is not indistinguishable under chosen plaintext attack - as repeating blocks will ...
- 91.8k
9
votes
Accepted
I read ECB is bad because the same plaintext outputs the same ciphertext. Isn't that a requirement of a cipher?
Indeed, ECB is such that encrypting twice the same plaintext leads to the same ciphertext. Even worse, encrypting a plaintext containing twice the same plaintext block leads to a ciphertext containing ...
- 138k
9
votes
Accepted
Implement AES-CTR on top of AES-ECB
Of course you can implement CTR mode if all you have is ECB. All you have to do is use ECB to encrypt the successive counter values and use the resulting ECB-ciphertext as the CTR keystream to xor ...
- 4,405
9
votes
Encrypting AES in ECB mode
Here are some things to keep in mind
AES encrypts bytes, not characters. So you have to transform your plaintext into bytes. How are you going to do that?
In AES, a block is 128 bits. That is 16 ...
- 38.5k
8
votes
Accepted
Implementing 5 modes of operation with a hash function
The modes you are referencing are specifically modes of operations for block ciphers, and therefore are not directly applicable to hash functions. Block cipher operations take 2 inputs, the key and a ...
- 13k
8
votes
Accepted
Does hashing an ECB encryption with a strong hash function produce a secure MAC?
No, the proposed construction is not secure, unless the block size $b$ of the block cipher is unusually large, or much wider than the MAC. Assuming $p$ known distinct message/MAC pairs $(m_i,h_i)$ ...
- 138k
7
votes
Accepted
Encrypting Keys in a Firmware-Update
Your approach seems to have a lot of unneeded complexity and limitations. For example, you must decide the mapping between features and keys in advance. Here are some simpler approaches with more ...
- 314
7
votes
Which block cipher mode to use?
ECB sucks big time. CBC sucks slightly less, but still a lot.
Generally speaking, when you begin to use an encryption system, it is to achieve a number of security-related properties, e.g. ...
- 86.6k
7
votes
Accepted
In which cases AES doesn't need IV?
A quick list from Wikipedia;
ECB : doesn't use IV and don't use ECB which is insecure, see the penguin from Wikipedia.
CBC : uses IV
PCB : uses IV
CFB : uses IV
CTR : uses IV
OFB : uses IV
GCM : uses ...
- 47.6k
7
votes
Accepted
What's the reason for Monte Carlo tests for block ciphers?
As usual, government departments simply repeat their existing rules. So they incorporated the Monte Carlo tests from earlier test documents, this time from 1980. If you follow the dusty trail from ...
- 15.2k
6
votes
Accepted
Why are ECB CBC and CFB parallelizable?
By parallelizable, what we mean is that the encryption/decryption process can be broken down into multiple tasks that can be run at the same time. For block cipher modes, this means that if we have ...
- 145k
6
votes
Why is Byte-at-a-time ECB decryption a vulnerability?
The vulnerability happens when:
You send an INPUT to the server.
The server appends secret to INPUT -> INPUT||secret
The server encrypts it with a secret ...
- 161
6
votes
Accepted
How can frequency analysis be applied to modern ciphers?
Classical ciphers operate on letters. If we consider the frequency attack on classical ciphers it considers the frequency of the letters. Modern ciphers, if we consider only block ciphers, operates on ...
- 47.6k
6
votes
OpenSSL not producing messages of expected size
You have 16 bytes to encrypt in your file. You did not set -nopad option, therefore, the OpenSSL will use the default padding, PKCS#7. This padding adds characters ...
- 47.6k
5
votes
Key recovery when AES ECB is used for short but repeated messages
If the attacker can make the end device send plenty join-request messages and if the server always responds with a corresponding join-accept message, can the attacker gain knowledge of the AppKey ...
- 32k
5
votes
What about using AES-ECB with random IV?
No, this is not a secure way of encrypting. Specifically, it does not meet the requirements for indistinguishability under chosen plaintext attack (IND-CPA), a basic security definition for ...
- 2,814
5
votes
Accepted
Is it possible to break AES-128 ECB if you are given a ciphertext and a small portion of the key?
You can't use it to "break the encryption", but you can guess at the remaining 8 bytes of the key. The remaining 8 bytes should be feasible to find, especially if you can run the search in parallel.
- 19.5k
5
votes
Chosen Plaintext attack on AES in ECB mode
One way to carry out the chosen-prefix ECB mode attack you describe is as follows:
Step 1: Obtain the ciphertexts corresponding to the following 16 plaintexts, where each ...
- 45.9k
5
votes
encode plaintext with ecb
Well, in ECB mode you'll simply encrypt each block independently of the others with the same key and they build the correspond ciphertext blocks, which means for an encryption algorithm $E$ of block ...
- 7,629
5
votes
Accepted
Is AES in OFB mode with same IV more robust than ECB mode?
OFB with an IV re-use is a different kind of completely broken than ECB.
In ECB mode, the problem is the fact that you can recognize blocks. That is if the same block appears twice you will notice ...
- 45.7k
5
votes
Accepted
How to cipher bocks with RSA in ECB mode?
Securely enciphering text with RSA is typically done in one of three ways:
The most usual one is with the help of a symmetric cipher: RSA is used to establish a symmetric key, and the text itself is ...
- 138k
5
votes
Accepted
With DES, is ECB encryption mode equivalent to CBC with null IV for short data blocks?
The CBC mode processed as $c_i = E_k(p_i \oplus c_{i-1})$ with $c_0 = IV$
The ECB mode processed as $c_i = E_k(p_i)$
If you set ...
- 47.6k
5
votes
Accepted
Performing a dictionary attack on RSA/ECB with no padding
If the public modulus was generated properly, option 2 (brute force dictionary search of candidate plaintext) will be faster. Option 1 (factoring a ≈512-bit RSA integer) is feasible, but can be quite ...
- 138k
5
votes
AES Padding (Nullbytes vs PKCS7)
Padding
You cannot fill the remaining blocks with the null bytes unless
The message has a fixed size that doesn't require sending file sizes.
The file size is sent over the channel.
The message doesn'...
- 47.6k
Only top scored, non community-wiki answers of a minimum length are eligible