# Tag Info

Accepted

### Why was AES CBC removed in TLS 1.3?

Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked. AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
• 5,239
Accepted

### Is (AES-)GCM parallelizable?

Contrary to what Stephen says, you absolutely can compute the tag in parallel. Here's how it works; the tag computation is essentially "assemble the AAD, data, the length field and $Encr(Nonce)$ into ...
• 132k
Accepted

### Is there any area where AES-CBC cannot be used ? If so, why?

CBC does not perform authentication This property makes it less suitable for places where authentication is required, basically any transport protocol. TLS uses CBC, but by default performs ...

### Why was AES CBC removed in TLS 1.3?

TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility. Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
• 85.1k
Accepted

### Bit Flipping Attack on CBC Mode

The Bit Flipping attack Decryption process in CBC mode is performed as \begin{align} P_1 =& Dec_k(C_1) \oplus IV\\ P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb, \end{align} where $nb$...
• 43.4k
Accepted

### What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?

Short answer: There would be nothing (that isn't already wrong with TLS) necessarily wrong with a CTR + HMAC cipher suite, but the technical merits are only one factor in a technical feature getting ...
• 1,928

### Difference between a nonce and IV

With CBC mode the initialization vector is referred to as IV, because it is not nonce. There are ways to construct nonce so that it does not meet the needs of CBC mode. Random IV is one generation ...
• 5,239
Accepted

### How do we compute IV+1 in CTR mode?

The reference for this is NIST SP800-38A, especially its appendix B. Basically we consider the IV a binary value of the width of the block cipher (64-bit for DES, 128-bit for AES), and add 1 to that, ...
• 124k
Accepted

### Error propagation in CBC mode

In CBC mode the decryption equation is $P_i = D_k(C_i) \oplus C_{i-1}$. If you received a corrupted $C_i$, $P_i$ and $P_{i+1}$ will be decrypted wrong, but $P_{i+2}$ no longer depends on $C_i$ and ...
• 31.3k
Accepted

### Why can't we use the first block of AES-CBC as MAC

The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
• 85.1k
Accepted

### Modes of operation that allow padding oracle attacks

In the padding oracle attack you have an oracle that only tells you whether a particular chosen ciphertext decrypts to a correctly padded plaintext. That oracle is used to build a last word oracle, ...
• 31.3k
Accepted

### CBC-Mode Infinite Garble Extension

The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ...
• 85.1k

### How to encrypt a file for random access

You basically want a full disk encryption mode for a block cipher; XTS mode seems to be the current standard. In your case each "disk block" is actually a file offset. Note that using a stream cipher ...
• 2,217
Accepted

### AES-ECB as an authentication mechanism

It is not secure, because an attacker can "mix and match" the output blocks from different authentication tags on different input messages, or repeat output blocks for repeated input blocks. For ...
• 5,609
Accepted

### Why is authenticated CFB mode insecure?

One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message. This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the ...
• 132k

### mode of operation in cryptography

I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
• 37.7k

### mode of operation in cryptography

You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
• 85.1k

### Why was AES CBC removed in TLS 1.3?

from what I know CBC is the most secure Mode of operation for the AES block cipher I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in the ...
• 132k
Accepted

### Using a non-secure random generator for IV or salt generation

Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
• 45.8k
Accepted

### Why is ECB+CTR not a thing?

However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem. This is trivially insecure. Counter-Example: Consider the nonce $0^n$ and ...
• 44.6k

### Should I use ECB or CBC encryption mode for my block cipher?

Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations. Although ECB and CBC are modes of operation of a block cipher, you could ...
• 85.1k

### AES-ECB as an authentication mechanism

The other answer is correct in general. However, if your messages are all exactly one block long (or all one block after padding), ECB is a secure MAC. A PRP looks like a PRF up to half its bit ...
• 31.3k

### Why isn't CTR mode (counter mode) used more often?

There are probably quite a few good reasons for this, although I don't expect that a scientific answer can be composed (as you would need to use a survey, and I've never heard of such a thing for ...
• 85.1k
Accepted

### Precisely how does CBC mode use the initialization vector?

The schemas from the relevant Wikipedia page really explain it all: As you see in the decryption schema, the IV is used for a single XOR that yields the first plaintext block; it is obvious that the ...
• 881
Accepted

### Should I use “modes of operation” for a single block of data?

Even though you are only encrypting one block at a time, think about what would happen if your input data happens to be the same as a previous encryption. Even though you are encrypting the blocks ...
• 1,370
Accepted

### Pros and Cons of Block Cipher's Mode of Operations?

This is a very broad question and a complete answer would probably fill an entire chapter in a book. You're asking for comparison of $6$ modes of operation in $7$ different areas - and each one of ...
• 12.3k

### Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?

That is the general idea of it yes. Some modes of operation (eg CTR) work in such a way that only known values are ever encrypted, forming a stream of pseudo-random data that is then combined with ...
• 4,147
Accepted

### How to encrypt a file for random access

The catch how ever is that if a small part of the file is given along with the location of that bytes from the beginning of the file we should be able to decrypt just that piece. Normal CTR mode ...
• 31.3k

### Is there any area where AES-CBC cannot be used ? If so, why?

There are several scenarios where you wouldn’t want to use AES in CBC mode. In CBC mode, each block is dependent on a previous one. As @fgrieu nicely hinted at in his comment, using CBC means that if ...
• 17.4k