48 votes
Accepted

Why was AES CBC removed in TLS 1.3?

Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked. AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
user avatar
  • 5,239
23 votes
Accepted

Is (AES-)GCM parallelizable?

Contrary to what Stephen says, you absolutely can compute the tag in parallel. Here's how it works; the tag computation is essentially "assemble the AAD, data, the length field and $Encr(Nonce)$ into ...
user avatar
  • 132k
21 votes
Accepted

Is there any area where AES-CBC cannot be used ? If so, why?

CBC does not perform authentication This property makes it less suitable for places where authentication is required, basically any transport protocol. TLS uses CBC, but by default performs ...
17 votes

Why was AES CBC removed in TLS 1.3?

TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility. Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
user avatar
  • 85.1k
16 votes
Accepted

Bit Flipping Attack on CBC Mode

The Bit Flipping attack Decryption process in CBC mode is performed as \begin{align} P_1 =& Dec_k(C_1) \oplus IV\\ P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb, \end{align} where $nb$...
user avatar
  • 43.4k
15 votes
Accepted

What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

Short answer: There would be nothing (that isn't already wrong with TLS) necessarily wrong with a CTR + HMAC cipher suite, but the technical merits are only one factor in a technical feature getting ...
user avatar
  • 1,928
13 votes

Difference between a nonce and IV

With CBC mode the initialization vector is referred to as IV, because it is not nonce. There are ways to construct nonce so that it does not meet the needs of CBC mode. Random IV is one generation ...
user avatar
  • 5,239
12 votes
Accepted

How do we compute IV+1 in CTR mode?

The reference for this is NIST SP800-38A, especially its appendix B. Basically we consider the IV a binary value of the width of the block cipher (64-bit for DES, 128-bit for AES), and add 1 to that, ...
user avatar
  • 124k
12 votes
Accepted

Error propagation in CBC mode

In CBC mode the decryption equation is $P_i = D_k(C_i) \oplus C_{i-1}$. If you received a corrupted $C_i$, $P_i$ and $P_{i+1}$ will be decrypted wrong, but $P_{i+2}$ no longer depends on $C_i$ and ...
user avatar
  • 31.3k
12 votes
Accepted

Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
user avatar
  • 85.1k
11 votes
Accepted

Modes of operation that allow padding oracle attacks

In the padding oracle attack you have an oracle that only tells you whether a particular chosen ciphertext decrypts to a correctly padded plaintext. That oracle is used to build a last word oracle, ...
user avatar
  • 31.3k
11 votes
Accepted

CBC-Mode Infinite Garble Extension

The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ...
user avatar
  • 85.1k
10 votes

How to encrypt a file for random access

You basically want a full disk encryption mode for a block cipher; XTS mode seems to be the current standard. In your case each "disk block" is actually a file offset. Note that using a stream cipher ...
user avatar
  • 2,217
10 votes
Accepted

AES-ECB as an authentication mechanism

It is not secure, because an attacker can "mix and match" the output blocks from different authentication tags on different input messages, or repeat output blocks for repeated input blocks. For ...
user avatar
10 votes
Accepted

Why is authenticated CFB mode insecure?

One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message. This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the ...
user avatar
  • 132k
10 votes

mode of operation in cryptography

I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
user avatar
  • 37.7k
10 votes

mode of operation in cryptography

You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
user avatar
  • 85.1k
10 votes

Why was AES CBC removed in TLS 1.3?

from what I know CBC is the most secure Mode of operation for the AES block cipher I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in the ...
user avatar
  • 132k
10 votes
Accepted

Using a non-secure random generator for IV or salt generation

Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
user avatar
10 votes
Accepted

Why is ECB+CTR not a thing?

However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem. This is trivially insecure. Counter-Example: Consider the nonce $0^n$ and ...
user avatar
  • 44.6k
9 votes

Should I use ECB or CBC encryption mode for my block cipher?

Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations. Although ECB and CBC are modes of operation of a block cipher, you could ...
user avatar
  • 85.1k
9 votes

AES-ECB as an authentication mechanism

The other answer is correct in general. However, if your messages are all exactly one block long (or all one block after padding), ECB is a secure MAC. A PRP looks like a PRF up to half its bit ...
user avatar
  • 31.3k
9 votes

Why isn't CTR mode (counter mode) used more often?

There are probably quite a few good reasons for this, although I don't expect that a scientific answer can be composed (as you would need to use a survey, and I've never heard of such a thing for ...
user avatar
  • 85.1k
9 votes
Accepted

Precisely how does CBC mode use the initialization vector?

The schemas from the relevant Wikipedia page really explain it all: As you see in the decryption schema, the IV is used for a single XOR that yields the first plaintext block; it is obvious that the ...
user avatar
  • 881
9 votes
Accepted

Should I use “modes of operation” for a single block of data?

Even though you are only encrypting one block at a time, think about what would happen if your input data happens to be the same as a previous encryption. Even though you are encrypting the blocks ...
user avatar
  • 1,370
9 votes
Accepted

Pros and Cons of Block Cipher's Mode of Operations?

This is a very broad question and a complete answer would probably fill an entire chapter in a book. You're asking for comparison of $6$ modes of operation in $7$ different areas - and each one of ...
user avatar
  • 12.3k
8 votes

Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?

That is the general idea of it yes. Some modes of operation (eg CTR) work in such a way that only known values are ever encrypted, forming a stream of pseudo-random data that is then combined with ...
user avatar
8 votes
Accepted

How to encrypt a file for random access

The catch how ever is that if a small part of the file is given along with the location of that bytes from the beginning of the file we should be able to decrypt just that piece. Normal CTR mode ...
user avatar
  • 31.3k
8 votes

Is there any area where AES-CBC cannot be used ? If so, why?

There are several scenarios where you wouldn’t want to use AES in CBC mode. In CBC mode, each block is dependent on a previous one. As @fgrieu nicely hinted at in his comment, using CBC means that if ...
user avatar
  • 17.4k
8 votes
Accepted

Does AES CTR mode store header information in encrypted files?

I would like to ask if that is true for every AES CTR mode implementation?, Doesn't have to be. You can store the nonce anywhere. You could even send it to the recipient via a different channel (e.g....
user avatar
  • 37.7k

Only top scored, non community-wiki answers of a minimum length are eligible