Questions tagged [modes-of-operation]

ways of applying a block cipher to multi-block messages and enabling repeated use without changing the key.

Filter by
Sorted by
Tagged with
3 votes
2 answers
142 views

Quantum attack on CTR

I'm reading the article named "Characterizing the qIND-qCPA (in)security of the CBC, CFB, OFB and CTR modes of operation". An attack on CTR mode is presented in the article. The proof of thm ...
Georgy Firsov's user avatar
1 vote
1 answer
80 views

Can ECB block cipher mode be used to implement CTR?

looking at the linux kernel provided cipher and block cipher modes cat /proc/crypto my prefered mode CTR (counter/integer) is ...
humanityANDpeace's user avatar
4 votes
1 answer
339 views

Why is s=6n in AES Key Wrap?

In AES Key Wrap, we apply 6n AES encryptions for an input of n 64-bit blocks. Informally speaking, we wrap the key 6 times. What is the motivation behind 6? Why not 4 or 10? Is there something like a ...
guestQWERTY's user avatar
0 votes
0 answers
63 views

Differential cryptanalysis of modes of operation

It is not quite difficult to understand the idea of differential cryptanalysis applied to a standalone block cipher. The method investigates, how differences of plaintext evolve while going through ...
Georgy Firsov's user avatar
1 vote
1 answer
124 views

Is there a strong cryptographic reason for GCM's 2^39 - 256 bit limit, why Not 2^39 [duplicate]

While examining the initial GCM specification by McGrew and Viega in 2005, it appears that the formation of the 128-bit Initialization Vector by combining a 96-bit nonce and a 32-bit unsigned wrapping ...
xyz's user avatar
  • 21
1 vote
1 answer
109 views

How secure is half-key Even-Mansour?

Single-key Even-Mansour is secure up to $2^{0.5 \times n}$. Where $n$ is permutation and key size. Would using $n/2$-key retain same security as $n$-key? Could the other half be used as a tweak?
LightBit's user avatar
  • 1,649
2 votes
2 answers
118 views

Recommended way to generate a key and IV for CFB mode?

I need to generate a key and IV that will be used to encrypt multiple things over a period of time with AES in CFB mode. The decision to use AES in CFB mode is not mine to change and the key will only ...
Jonathan Wilson's user avatar
1 vote
1 answer
73 views

Is it a bad idea to swap modes/encryption primitives?

I was wondering if changing modes or primitives could affect security. For example, let's say you have encrypted data with AES-128 with CBC mode and you want to change it to AES-128 GCM, or to ASCON. ...
WINTERSDORFF Raphael's user avatar
1 vote
1 answer
70 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
Melab's user avatar
  • 3,645
1 vote
1 answer
198 views

Are modes like CBC, OFB, CFB subject to chosen plaintext attacks?

I haven't found much info on the internet about the weakness of modes to chosen plaintext attacks, but from what I understand of them, there seem to be some trivial attacks, so I'm a bit confused. For ...
WINTERSDORFF Raphael's user avatar
0 votes
0 answers
34 views

Is there a Block cipher (mode) with a not symmetric variable which if it is altered always produced a different cipher?

The BC should look like this $$BC(m,k,n) = (c,n')$$ $$BC^{-1}(c,k,n') = (m,n)$$ with the additional variable $n$ not symmetric, so in almost all cases: $$n \not= n'$$ $m$... plaintext $c$... ...
J. Doe's user avatar
  • 573
1 vote
0 answers
72 views

What mode in EVP for AES-128 should I use for cryptanalysis of AES?

I've been trying to use AES from OpenSSL and got to know that I need to use the EVP-based implementations rather than the AES_*. I need to use AES-128 ...
Luce's user avatar
  • 11
2 votes
1 answer
449 views

Vulnerability due to same IV, same key, same plaintext at same position in OFB

I am currently studying OFB mode, and one of the vulnerability mentioned for it is that if two different messages have a block at the same position in the ciphertext, and have same plaintext, the ...
Mango's user avatar
  • 23
1 vote
0 answers
58 views

Authenticated Encryption with Length Expansion for Storage Devices

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general. I know that ...
NB_1907's user avatar
  • 610
4 votes
1 answer
104 views

Which ciphers have been defined that use the Keccak sponge?

There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized ...
Maarten Bodewes's user avatar
  • 92.4k
4 votes
1 answer
151 views

What would be the maximum acceptable block size for disk enryption?

AES-256 in XTS mode has 32x16 (512) bytes of blocksize but there are some other wide-block modes of operation such as WCFB which accepts any block size. My question is: What is the maximum acceptable ...
phantomcraft's user avatar
1 vote
1 answer
61 views

Can the encryption with CTR mode be replaced by a publicly known unkeyed permutation when doing multiple encryption and keeping the IV secret?

A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}...
phantomcraft's user avatar
0 votes
1 answer
114 views

Can attacker create encryption of message m XOR 1^n given the ciphertext c, in nonce-based counter mode?

The following question is from Stanford cryptography course final exam paper. Suppose an attacker intercepts a ciphertext $c$ which is the encryption of a message $m\in\{0,1\}^n$ under nonce-based ...
Knightoforous's user avatar
1 vote
0 answers
44 views

Modification of CFB Mode of Operation?

To encrypt plaintext $(P_1, P_2, P_3, ... P_n)$ Ciphertext Feedback Mode (CFB) works as follows :- $$ C_0 = IV \\ C_i = E_K (C_{i-1}) \oplus P_i $$ Lets define a modified version of CFB mode as ...
crypt's user avatar
  • 2,397
1 vote
1 answer
474 views

Why is ECB mode unsafe if the key is kept secret?

this is my first post so I apologise if the formatting of my post isn't perfect. I should start off by saying that this post is not for any malicious intent, rather for curiosity and understanding AES ...
Shafin Kamal's user avatar
2 votes
1 answer
156 views

Why do we need nonce in the CTR mode given that Deterministic counter mode is semantically secure?

In the CTR mode, a nonce, a counter value and the key are needed to form the input of the PRF. However, the Deterministic counter mentioned in Dan Boneh's slides (https://crypto.stanford.edu/~dabo/...
U6aMy0wojraho's user avatar
4 votes
0 answers
115 views

What is "entropic security"?

I've come across a form of cryptographic security that I've never heard of: entropic security. I've read the Russel et al abstract and that doesn't seem to bear much relation to the wiki article. ...
Paul Uszak's user avatar
  • 15.3k
2 votes
1 answer
112 views

Pros and cons about padding a cryptogram produced with an "additive" operation mode

These days I found myself thinking about the implications of padding or not padding block cipher modes that act like additive stream ciphers (I meant OFB, CTR, GCM etc). Let's call additive modes. You ...
r s's user avatar
  • 23
2 votes
1 answer
360 views

ECB... lacks diffusion(?)

I noticed that the wikipedia page for 'block cipher modes of encryption' states, "The disadvantage of this method is a lack of diffusion.", referring to ECB mode for block cipher encryption. ...
WrinkleMonopoly's user avatar
1 vote
0 answers
44 views

What is aes in "operational mode"

I'm currently reading this report on the security of the IOT protocol "LoRaWAN". On page 3, it says the following: ...
NotQuiteSo1337's user avatar
2 votes
1 answer
292 views

"Fixing" PCBC mode?

In PCBC mode, one encrypts and decrypts via $$ C_i = E(P_i \oplus P_{i-1} \oplus C_{i-1}) \Longleftrightarrow P_i = D(C_i) \oplus P_{i-1} \oplus C_{i-1} $$ (where $P_0 \oplus C_0 = IV$), which has ...
ManRow's user avatar
  • 343
1 vote
0 answers
74 views

CTR mode calculate messages before new key is required

I am studying a cryptography video on Coursera here titled: Modes of Operation: Many Time Key (CTR). I have just two simple questions: At around 4:30 in the video they show 2^48 without saying where ...
questioner's user avatar
2 votes
1 answer
345 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
LightBit's user avatar
  • 1,649
4 votes
1 answer
875 views

Why are block ciphers mostly used as stream ciphers?

Using a block cipher with using either CTR or GCM mode gives us a stream cipher, the only difference being that CTR does not include a MAC tag or AAD but GCM does. I think these are the most commonly ...
Gamer2015's user avatar
  • 236
1 vote
2 answers
806 views

How to minimize AES output size?

I work on a project about CAN bus and I want to encrypt the data among nodes but I have have a problem because CAN bus nodes receive and send 8 bytes among each others and I know the size of AES ...
Peter Kamel GN's user avatar
1 vote
2 answers
904 views

AES plaintext is smaller than 128 bits [duplicate]

I'm currently developing a AES implementation in a graduation project at university. As far as I know, AES uses a 128 bit block length as input . if the entered string to encrypt is not 128 bits such ...
Peter Kamel GN's user avatar
1 vote
1 answer
784 views

Can ChaCha20 provide integrity?

I have read that in general stream ciphers do not provide data integrity. Can ChaCha20 be implemented in such a way (perhaps like counter mode with message authentication in AES) to provide this?
WireInTheGhost's user avatar
0 votes
0 answers
51 views

Synchronous Sponges

The paper The sponge construction as a source of secure cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
user's user avatar
  • 163
3 votes
0 answers
142 views

What is the Indexed Code Book Mode?

While reading specsheets for NXP processors (example mention in this PDF) the other day I saw the mention of the Indexed Code Book mode (ICB) for their AES acceleration hardware - the only mode they ...
SEJPM's user avatar
  • 45.9k
0 votes
0 answers
313 views

Is ECB mode more suitable than CBC mode while encrypting a long bit string?

I know that ECB is less secure than CBC, but will it be suitable for encrypting a long bit string?
Sophie Elku's user avatar
5 votes
2 answers
304 views

does CFB support random read access?

According to Wikipedia block cipher modes of operation, simplified CFB supports random read access. but what about the real CFB where we have a shift register? below are pictures extracted from the ...
Masoud jt's user avatar
  • 165
1 vote
1 answer
184 views

CBC mode works well for input greater than "b" bits. What is that "b" bits?

This post on geeksforgeeks.org about block cipher modes of operation, says that one of the advantages of the CBC is that it works well for input greater than b bits. I also saw that in the book "...
Masoud jt's user avatar
  • 165
0 votes
1 answer
148 views

Bulk encryption with Triple Blowfish

Blowfish has a large key setup penalty, except is fast once it gets rolling. I believe that before AES optimizations became commonplace, it was faster than AES after the initial key setup. It's top ...
GuyOnInternet's user avatar
1 vote
1 answer
2k views

Zerologon question - AES-CFB8

I was reading the zerologon whitepaper by secura named: Unauthenticated domain controller compromise by subverting Netlogon cryptography. I'm trying to understand the zerologon attack. The issue is ...
albfrk99's user avatar
1 vote
1 answer
236 views

Correctness of Propagating Cipher Block Chaining mode of operation (PCBC)

I was looking at the Wikipedia article about Block cipher mode of operation and I was wondering how can you from the encryption $C_i = E_K(P_i \oplus P_{i-1}\oplus C_{i-1})$ get the decryption $P_i = ...
Jan's user avatar
  • 53
1 vote
0 answers
64 views

Can XEX or XTS modes be used with only one tweak? (part 2)

This question is similar to Can XEX or XTS modes be used with only one tweak? except I am interested to know if one can instead use $X = E_{k}(0) \otimes \alpha^j \\ C = E_{k}(P \oplus X) \oplus X$ in ...
Post as a guest's user avatar
2 votes
1 answer
606 views

Quadruple DES vs AES-128 security

I came across this question regarding the security of Quadruple DES (hypothetically DES done four times) in CBC encryption mode vs security of AES-128 in CBC encryption mode. What parameters help to ...
shijuza's user avatar
  • 153
0 votes
2 answers
115 views

Multiple IV CBC

CBC's encryption is not paralelizable but I could divide a 64 block message in 4 16 block parts and encrypt those 4 parts separatly in parallel using a diferent IV for each one. Is this unsecure ? Is ...
moutonlapin28's user avatar
-1 votes
1 answer
85 views

Which encryption mode is best for transport of random values?

I was wondering which block encryption mode or modes will be most appropriate for transport of random values of one-block length. Block length could be of size 256 bytes and transport is from person ...
Haseeb Saeed's user avatar
0 votes
0 answers
66 views

The smallest secure block size [duplicate]

I have designed an encryption algorithm. The algorithm will probably use CFB mode. The algorithm can encrypt any block size and this does not change the size of the key. There are always about $20$ ...
Tom's user avatar
  • 1,211
0 votes
0 answers
160 views

Is XEX/XTS good for deterministic file encryption?

My understanding about XEX/XTS mode is limited. But from what I see, it has two good properties: It is length-preserving so that encryption doesn't cost additional space. It is deterministic, which ...
Cyker's user avatar
  • 729
5 votes
1 answer
1k views

CBC encryption + CBC MAC reusing key in MAC-then-Encrypt

I'm reading the Handbook of Applied Cryptography by ‎Alfred J. Menezes et al. Especially, I'm stuck with the case that reusing key for CBC encryption and CBC-MAC in MAC-then-encrypt structure. My ...
pioneer's user avatar
  • 325
2 votes
1 answer
382 views

Why is XEX not used instead of CTR?

As far as I know the only disadvantage that XEX has when compared to CTR is that you need a block cipher/permutation while CTR is fine with just a hash function. Meanwhile XEX offers the advantage ...
user79087's user avatar
2 votes
2 answers
3k views

Repeating nonce in CTR mode

Can anybody explain in detail why repeating nonce is dangerous in CTR mode? Two cases to explain When plain text is repeated for each nonce. When plain text is unique for each nonce .
m.nasim's user avatar
  • 105
0 votes
1 answer
183 views

How to apply a block cipher to (large) packetized communication when packets can get lost/erased?

In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for ...
Marcus Müller's user avatar

1
2 3 4 5
7