48
votes
Accepted
Why was AES CBC removed in TLS 1.3?
Short: CBC mode in context of TLS protocol has had security issues, and would have had to be reworked.
AES-CBC mode combined with decent HMAC can be as secure as AES-GCM. However, combining the ...
- 5,279
25
votes
Accepted
Is (AES-)GCM parallelizable?
Contrary to what Stephen says, you absolutely can compute the tag in parallel.
Here's how it works; the tag computation is essentially "assemble the AAD, data, the length field and $Encr(Nonce)$ into ...
- 139k
20
votes
Accepted
Bit Flipping Attack on CBC Mode
The Bit Flipping attack
Decryption process in CBC mode is performed as
\begin{align}
P_1 =& Dec_k(C_1) \oplus IV\\
P_i =& Dec_k(C_i) \oplus C_{i-1},\;\; 1 < i \leq nb,
\end{align}
where $nb$...
- 45.7k
17
votes
Why was AES CBC removed in TLS 1.3?
TLS 1.3 is a reboot of the TLS protocol which focused on up to date cryptography rather than backwards compatibility.
Now CBC is not as secure as you make it to be, and the way that it was used in TLS ...
- 89.2k
12
votes
Accepted
Why can't we use the first block of AES-CBC as MAC
The MAC value should be calculated over all of the input, not just the first block. The chaining of CBC makes sure that the bits in the last block of ciphertext depends on all the previous blocks.
- 89.2k
12
votes
Accepted
CBC-Mode Infinite Garble Extension
The infinite garble extension makes sure that if a ciphertext block is changed that this block and each block after it doesn't decrypt correctly. The way that additional plaintext is affected when the ...
- 89.2k
10
votes
mode of operation in cryptography
I would pick e) none of the above. None of those modes offers integrity protection, so unless integrity is handled elsewhere, your application is wildly insecure. An attacker could modify bits in ...
- 38.2k
10
votes
mode of operation in cryptography
You would not just need a mode of operation for what you're asking. What you need is a secure transport protocol. Probably the best well known one for TCP connections is TLS of course. For UDP ...
- 89.2k
10
votes
Why was AES CBC removed in TLS 1.3?
from what I know CBC is the most secure Mode of operation for the AES block cipher
I'm not exactly sure why you say this; however, there has been a couple of practical problems with CBC mode in the ...
- 139k
10
votes
Accepted
Using a non-secure random generator for IV or salt generation
Let's take AES-CBC for example—a typical cryptosystem that requires a randomized IV. Suppose I can predict the IV in advance. Then I can start by asking for the encryption of $\mathit{iv}_0$, which ...
10
votes
Accepted
Why is ECB+CTR not a thing?
However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem.
This is trivially insecure. Counter-Example: Consider the nonce $0^n$ and ...
- 45.3k
9
votes
Why isn't CTR mode (counter mode) used more often?
There are probably quite a few good reasons for this, although I don't expect that a scientific answer can be composed (as you would need to use a survey, and I've never heard of such a thing for ...
- 89.2k
9
votes
Should I use ECB or CBC encryption mode for my block cipher?
Better is a subjective term. However for the choice between ECB and CBC, the choice should be CBC for almost all situations.
Although ECB and CBC are modes of operation of a block cipher, you could ...
- 89.2k
9
votes
Accepted
Precisely how does CBC mode use the initialization vector?
The schemas from the relevant Wikipedia page really explain it all:
As you see in the decryption schema, the IV is used for a single XOR that yields the first plaintext block; it is obvious that the ...
- 911
9
votes
Accepted
Should I use “modes of operation” for a single block of data?
Even though you are only encrypting one block at a time, think about what would happen if your input data happens to be the same as a previous encryption. Even though you are encrypting the blocks ...
- 1,601
9
votes
Accepted
Pros and Cons of Block Cipher's Mode of Operations?
This is a very broad question and a complete answer would probably fill an entire chapter in a book. You're asking for comparison of $6$ modes of operation in $7$ different areas - and each one of ...
- 12.5k
9
votes
Why is SIV a thing if MAC-and-encrypt is not the most secure way to go?
Skimming these three papers should give you an idea (which I list roughly in the order I recommend you look at them):
Rogaway, Philip. 2004. "Nonce-based symmetric encryption."
Namprempre, ...
- 14.3k
8
votes
Accepted
Which block cipher mode does the experts use?
The modern trend for encryption-only modes is clearly CTR, which has a number of advantages over other modes:
no padding is needed (contrary to CBC);
the computationally-intensive part can be ...
- 132k
8
votes
Accepted
AES in Counter mode for 64 bit input
The idea of a counter stream mode of AES is to generate an random stream of bits by chunk of 128 bits but you are not forced to use all the 128 bits of it.
To encrypt the process is the following, ...
- 9,889
8
votes
Accepted
How can I encrypt more than 128 bits of data with AES?
No, the state of the AES is the internal state of the block cipher. It is not used to store the plaintext message. After a block encrypt the state of the block cipher isn't required anymore. Generally ...
- 89.2k
7
votes
Accepted
What are the constraints on using GCM with a tag size of 96 and 128 bits?
I don't understand where the formula $q^2 \ell^2 2^{-142} + q^2 \ell^3 2^{-147}$ came from. The power of $\ell$ seems too high; the fractions $2^{-142}$ and $2^{-147}$ seem awfully small; the ...
7
votes
Accepted
Secure method for encrypting 32 byte private keys
SIV is a mode specially designed for this purpose. SIV-AES would be a good choice, but it has the same issues as AES-wrap; not many implementations. If you use a GCM you should make sure that the IV ...
- 89.2k
7
votes
Accepted
How secure would hand ciphers be using a Block Cipher Mode?
what if you were to incorporate a Block Cipher Mode into a hand cipher
That line is a bit misleading and hints at a potential misunderstanding. A "mode of operation" is more something you wrap around ...
- 17.6k
7
votes
Should I use XTS or GCM to encrypt my hard drives?
XTS is designed so that the plaintext and ciphertext sizes are the same. This is "needed" for disk encryption in order to preserve the sector size. However, when you are encrypting your disk at the ...
- 27.3k
7
votes
Accepted
Are there any issues to doing 2 rounds of AES-128? How is the security compared to AES-256?
Double encryption with 128-bit AES and two different keys does not give 256-bit security. In particular, a classic Meet-in-the-Middle attack applies, with expected cost $2^{128}$ encryptions and $2^{...
- 132k
7
votes
Why use CCM instead CBC-then-MAC?
CTR mode was previously considered a relatively brittle scheme, and in a sense it is. Repeating the nonce will repeat the counter, and repeating the counter will repeat the key stream. This means that ...
- 89.2k
7
votes
Is error propagation desired in modes of operation
It is neither desirable nor undesirable on its own. Error propagation is not relevant to any modern cryptography. The concept is a relic of an archaic school of crypto engineering that has been left ...
7
votes
Which block cipher mode to use?
ECB sucks big time. CBC sucks slightly less, but still a lot.
Generally speaking, when you begin to use an encryption system, it is to achieve a number of security-related properties, e.g. ...
- 85.9k
7
votes
Why weak modes of operations are not banned?
All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an ...
- 89.2k
7
votes
Accepted
Can ChaCha20 provide integrity?
ChaCha20 has Ind-CPA security and beyond this ( Ind-CCAx.. [1]), you need integrity and authentication. And note that Authenticated Encryption > Ind-CCA.
ChaCha20 is already teamed with Poly1305 ...
- 45.7k
Only top scored, non community-wiki answers of a minimum length are eligible