49 votes
Accepted

Why was AES CBC removed in TLS 1.3?

Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked. AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
user4982's user avatar
  • 5,309
22 votes
Accepted

Bit Flipping Attack on CBC Mode

The Bit Flipping attack Decryption process in CBC mode is performed as \begin{align} P_1 =& Dec_k(C_1) \oplus IV\\ P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb, \end{align} where $nb$...
kelalaka's user avatar
  • 48.3k
17 votes

Why was AES CBC removed in TLS 1.3?

TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility. Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
Maarten Bodewes's user avatar
  • 92.4k
12 votes
Accepted

Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
Maarten Bodewes's user avatar
  • 92.4k
12 votes
Accepted

CBC-Mode Infinite Garble Extension

The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ...
Maarten Bodewes's user avatar
  • 92.4k
11 votes
Accepted

Using a non-secure random generator for IV or salt generation

Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
Squeamish Ossifrage's user avatar
10 votes

mode of operation in cryptography

I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
mikeazo's user avatar
  • 38.5k
10 votes

mode of operation in cryptography

You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
Maarten Bodewes's user avatar
  • 92.4k
10 votes
Accepted

Should I use “modes of operation” for a single block of data?

Even though you are only encrypting one block at a time, think about what would happen if your input data happens to be the same as a previous encryption. Even though you are encrypting the blocks ...
Eugene Styer's user avatar
  • 1,676
10 votes

Why was AES CBC removed in TLS 1.3?

from what I know CBC is the most secure Mode of operation for the AES block cipher I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in the ...
poncho's user avatar
  • 146k
10 votes
Accepted

Why is ECB+CTR not a thing?

However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem. This is trivially insecure. Counter-Example: Consider the nonce $0^n$ and ...
SEJPM's user avatar
  • 45.9k
9 votes
Accepted

Pros and Cons of Block Cipher's Mode of Operations?

This is a very broad question and a complete answer would probably fill an entire chapter in a book. You're asking for comparison of $6$ modes of operation in $7$ different areas - and each one of ...
tylo's user avatar
  • 12.6k
9 votes

Why is SIV a thing if MAC-and-encrypt is not the most secure way to go?

Skimming these three papers should give you an idea (which I list roughly in the order I recommend you look at them): Rogaway, Philip. 2004. "Nonce-based symmetric encryption." Namprempre, ...
Luis Casillas's user avatar
8 votes

Should I use XTS or GCM to encrypt my hard drives?

XTS is designed so that the plaintext and ciphertext sizes are the same. This is "needed" for disk encryption in order to preserve the sector size. However, when you are encrypting your disk at the ...
Yehuda Lindell's user avatar
8 votes
Accepted

AES in Counter mode for 64 bit input

The idea of a counter stream mode of AES is to generate an random stream of bits by chunk of 128 bits but you are not forced to use all the 128 bits of it. To encrypt the process is the following, ...
Biv's user avatar
  • 9,979
8 votes
Accepted

How can I encrypt more than 128 bits of data with AES?

No, the state of the AES is the internal state of the block cipher. It is not used to store the plaintext message. After a block encrypt the state of the block cipher isn't required anymore. Generally ...
Maarten Bodewes's user avatar
  • 92.4k
7 votes
Accepted

How secure would hand ciphers be using a Block Cipher Mode?

what if you were to incorporate a Block Cipher Mode into a hand cipher That line is a bit misleading and hints at a potential misunderstanding. A "mode of operation" is more something you wrap around ...
e-sushi's user avatar
  • 17.9k
7 votes
Accepted

What are the constraints on using GCM with a tag size of 96 and 128 bits?

I don't understand where the formula $q^2 \ell^2 2^{-142} + q^2 \ell^3 2^{-147}$ came from. The power of $\ell$ seems too high; the fractions $2^{-142}$ and $2^{-147}$ seem awfully small; the ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

Are there any issues to doing 2 rounds of AES-128? How is the security compared to AES-256?

Double encryption with 128-bit AES and two different keys does not give 256-bit security. In particular, a classic Meet-in-the-Middle attack applies, with expected cost $2^{128}$ encryptions and $2^{...
fgrieu's user avatar
  • 140k
7 votes

Why use CCM instead CBC-then-MAC?

CTR mode was previously considered a relatively brittle scheme, and in a sense it is. Repeating the nonce will repeat the counter, and repeating the counter will repeat the key stream. This means that ...
Maarten Bodewes's user avatar
  • 92.4k
7 votes

Is error propagation desired in modes of operation

It is neither desirable nor undesirable on its own. Error propagation is not relevant to any modern cryptography. The concept is a relic of an archaic school of crypto engineering that has been left ...
Squeamish Ossifrage's user avatar
7 votes

Which block cipher mode to use?

ECB sucks big time. CBC sucks slightly less, but still a lot. Generally speaking, when you begin to use an encryption system, it is to achieve a number of security-related properties, e.g. ...
Thomas Pornin's user avatar
7 votes

Why weak modes of operations are not banned?

All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an ...
Maarten Bodewes's user avatar
  • 92.4k
7 votes
Accepted

Why is the second XOR operation in OCB mode necessary?

I am wondering, why the second XOR operation is necessary. If it is omitted, then an arbitrary permutation of the ciphertext blocks would not modify the tag, and hence any such modification would ...
poncho's user avatar
  • 146k
7 votes
Accepted

Can ChaCha20 provide integrity?

ChaCha20 has Ind-CPA security and beyond this ( Ind-CCAx.. [1]), you need integrity and authentication. And note that Authenticated Encryption > Ind-CCA. ChaCha20 is already teamed with Poly1305 ...
kelalaka's user avatar
  • 48.3k
7 votes
Accepted

Why are block ciphers mostly used as stream ciphers?

Why are block ciphers mostly used as stream ciphers? CTR mode doesn't need padding like the CBC mode that caused many attacks over the years knowns as the padding oracle attack [1] [2]. Finally, CBC ...
kelalaka's user avatar
  • 48.3k
7 votes
Accepted

What would be the maximum acceptable block size for disk enryption?

AES-XTS is a mode of operation of AES that encrypts blocks, but is not a blockcipher. It has the security drawback that when information in a large block changes locally (e.g. a single byte), it's ...
fgrieu's user avatar
  • 140k
6 votes

Block cipher mode of operation with beyond-birthday-bound security

It is not a standard mode of operation and I do not know if anyone uses it in practice, but one option is double encryption using counter mode and a non-repeating counter. That is, doing $E_{k_1}(i) \...
otus's user avatar
  • 32.1k
6 votes

Can CBC ciphertext be decrypted if the key is known, but the IV not?

Yes, you can, but you might not be able to decrypt the first block if you don't know the IV. CBC encryption encrypts block-by-block, using the previous ciphertext XOR'ed with the current plaintext ...
Maarten Bodewes's user avatar
  • 92.4k
6 votes
Accepted

Should I use XTS or GCM to encrypt my hard drives?

Use XTS for whole-disk encryption. It is designed for that purpose. Definition of XTS mode in wiki is under the Disk Encryption Theory which says enough i think :) ...
Makif's user avatar
  • 820

Only top scored, non community-wiki answers of a minimum length are eligible