48
votes
Accepted
Why was AES CBC removed in TLS 1.3?
Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked.
AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
- 5,239
23
votes
Accepted
Is (AES-)GCM parallelizable?
Contrary to what Stephen says, you absolutely can compute the tag in parallel.
Here's how it works; the tag computation is essentially "assemble the AAD, data, the length field and $Encr(Nonce)$ into ...
- 132k
21
votes
Accepted
Is there any area where AES-CBC cannot be used ? If so, why?
CBC does not perform authentication
This property makes it less suitable for places where authentication is required, basically any transport protocol. TLS uses CBC, but by default performs ...
17
votes
Why was AES CBC removed in TLS 1.3?
TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility.
Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
- 85.1k
16
votes
Accepted
Bit Flipping Attack on CBC Mode
The Bit Flipping attack
Decryption process in CBC mode is performed as
\begin{align}
P_1 =& Dec_k(C_1) \oplus IV\\
P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb,
\end{align}
where $nb$...
- 43.4k
15
votes
Accepted
What is wrong with AES-CTR-HMAC-SHA256 - or why is it not in TLS?
Short answer:
There would be nothing (that isn't already wrong with TLS) necessarily wrong with a CTR + HMAC cipher suite, but the technical merits are only one factor in a technical feature getting ...
- 1,928
13
votes
Difference between a nonce and IV
With CBC mode the initialization vector is referred to as IV, because it is not nonce. There are ways to construct nonce so that it does not meet the needs of CBC mode. Random IV is one generation ...
- 5,239
12
votes
Accepted
How do we compute IV+1 in CTR mode?
The reference for this is NIST SP800-38A, especially its appendix B.
Basically we consider the IV a binary value of the width of the block cipher (64-bit for DES, 128-bit for AES), and add 1 to that, ...
- 124k
12
votes
Accepted
Error propagation in CBC mode
In CBC mode the decryption equation is $P_i = D_k(C_i) \oplus C_{i-1}$. If you received a corrupted $C_i$, $P_i$ and $P_{i+1}$ will be decrypted wrong, but $P_{i+2}$ no longer depends on $C_i$ and ...
- 31.3k
12
votes
Accepted
Why can't we use the first block of AES-CBC as MAC
The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
- 85.1k
11
votes
Accepted
Modes of operation that allow padding oracle attacks
In the padding oracle attack you have an oracle that only tells you whether a particular chosen ciphertext decrypts to a correctly padded plaintext. That oracle is used to build a last word oracle, ...
- 31.3k
11
votes
Accepted
CBC-Mode Infinite Garble Extension
The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ...
- 85.1k
10
votes
How to encrypt a file for random access
You basically want a full disk encryption mode for a block cipher; XTS mode seems to be the current standard. In your case each "disk block" is actually a file offset.
Note that using a stream cipher ...
- 2,217
10
votes
Accepted
AES-ECB as an authentication mechanism
It is not secure, because an attacker can "mix and match" the output blocks from different authentication tags on different input messages, or repeat output blocks for repeated input blocks.
For ...
- 5,609
10
votes
Accepted
Why is authenticated CFB mode insecure?
One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message.
This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the ...
- 132k
10
votes
mode of operation in cryptography
I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
- 37.7k
10
votes
mode of operation in cryptography
You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
- 85.1k
10
votes
Why was AES CBC removed in TLS 1.3?
from what I know CBC is the most secure Mode of operation for the AES block cipher
I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in the ...
- 132k
10
votes
Accepted
Using a non-secure random generator for IV or salt generation
Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
- 45.8k
10
votes
Accepted
Why is ECB+CTR not a thing?
However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem.
This is trivially insecure. Counter-Example: Consider the nonce $0^n$ and ...
- 44.6k
9
votes
Should I use ECB or CBC encryption mode for my block cipher?
Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations.
Although ECB and CBC are modes of operation of a block cipher, you could ...
- 85.1k
9
votes
AES-ECB as an authentication mechanism
The other answer is correct in general. However, if your messages are all exactly one block long (or all one block after padding), ECB is a secure MAC.
A PRP looks like a PRF up to half its bit ...
- 31.3k
9
votes
Why isn't CTR mode (counter mode) used more often?
There are probably quite a few good reasons for this, although I don't expect that a scientific answer can be composed (as you would need to use a survey, and I've never heard of such a thing for ...
- 85.1k
9
votes
Accepted
Precisely how does CBC mode use the initialization vector?
The schemas from the relevant Wikipedia page really explain it all:
As you see in the decryption schema, the IV is used for a single XOR that yields the first plaintext block; it is obvious that the ...
- 881
9
votes
Accepted
Should I use “modes of operation” for a single block of data?
Even though you are only encrypting one block at a time, think about what would happen if your input data happens to be the same as a previous encryption. Even though you are encrypting the blocks ...
- 1,370
9
votes
Accepted
Pros and Cons of Block Cipher's Mode of Operations?
This is a very broad question and a complete answer would probably fill an entire chapter in a book. You're asking for comparison of $6$ modes of operation in $7$ different areas - and each one of ...
- 12.3k
8
votes
Why do some block cipher modes of operation only use encryption while others use both encryption and decryption?
That is the general idea of it yes.
Some modes of operation (eg CTR) work in such a way that only known values are ever encrypted, forming a stream of pseudo-random data that is then combined with ...
- 4,147
8
votes
Accepted
How to encrypt a file for random access
The catch how ever is that if a small part of the file is given along with the location of that bytes from the beginning of the file we should be able to decrypt just that piece.
Normal CTR mode ...
- 31.3k
8
votes
Is there any area where AES-CBC cannot be used ? If so, why?
There are several scenarios where you wouldn’t want to use AES in CBC mode.
In CBC mode, each block is dependent on a previous one. As @fgrieu nicely hinted at in his comment, using CBC means that if ...
- 17.4k
8
votes
Accepted
Does AES CTR mode store header information in encrypted files?
I would like to ask if that is true for every AES CTR mode implementation?,
Doesn't have to be. You can store the nonce anywhere. You could even send it to the recipient via a different channel (e.g....
- 37.7k
Only top scored, non community-wiki answers of a minimum length are eligible