Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

# Tag Info

0

Presumably they mean that in both cases, the output has the form $$f(\mathit{iv}) \mathbin\| f(f(\mathit{iv})) \mathbin\| f(f(f(\mathit{iv}))) \mathbin\| \dotsb,$$ where $f$ is a secret function—the LFSR update function or a block cipher $E_k$ with secret key $k$.

3

What it means is that neither CTR nor OFB detects errors in a message, and that an adversary can flip arbitrary bits of their choice in the plaintext very easily—by flipping the corresponding bits of ciphertext. This is because both CTR and OFB essentially work by using the block cipher as a stream cipher to pseudorandomly generate a one-time pad to xor ...

1

Both OFB and LFSR use the output of one iteration of the function as input for a new iteration. Furthermore, both OFB and LFSR generate a pseudo random stream of bits / bytes. This stream can be used as key stream to encrypt/decrypt data, turning the algorithm into a stream cipher. There is a difference if the output of the last iteration is used to to ...

10

However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem. This is trivially insecure. Counter-Example: Consider the nonce $0^n$ and the plaintext $0^{2n-1}\|1$. This mode will encrypt the first block to be $E(0^n)$ and the second block to be $E((0^{n-1}\|1)\oplus(0^{n-1}\|1))=E(0^n)$ and so ...

5

However if you added a counter to ECB mode and XORed each block of plaintext with the counter, you could avoid that problem. Not really; it hides precisely duplicated plaintext blocks, but it would still reveal related plaintext blocks. Consider a two-block plaintext that consists of $(7, 6)$. Suppose we encrypt it with a counter $nonce = 4$; what this ...

0

First of all, in CTR mode, using the same IV under the same key is catastrophic. Once an attacker notices this, he can use crib-dragging like in OTP. Mitigation from using the same IV is easy; using a counter-based IV generation Or LFSR based, both as recommended by NIST, and the first is more common. In your mode, one needs the plaintext ready for the ...

7

All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an unpredictable IV in the case of CBC. Only authenticated modes can achieve message integrity / authenticity. Others are all vulnerable because changes to the ciphertext ...

Top 50 recent answers are included