Hot answers tagged

10

From a cryptographic standpoint, it doesn't matter how you transmit the IV. You can send it as a header, in the message body, as the path in the request method, or even the URG pointers in a few TCP packets. From the perspective of the encryption process itself, it doesn't care how it got the IV, no matter how silly the transmission method used, as long as ...


8

The modes you are referencing are specifically modes of operations for block ciphers, and therefore are not directly applicable to hash functions. Block cipher operations take 2 inputs, the key and a block-sized input value, and output a block-sized keyed permutation of the input. Hash functions take a variable length input, and output a fixed length value. ...


7

The capacity of AES in terms of file encryption is practically unlimited for the time being, especially in OFB or CTR mode. An 8 GB file comprises short of $2^{29}$ 128-bit AES blocks. If one uses CBC or OFB CFB mode, odds of a collision (that is, the same block appearing in ciphertext, which reveals 128 bit worth of potentially usable information about the ...


7

If you mean how much data can safely be encrypted by AES with a single key (and IV), AES is designed to encrypt up to $2^{64}$ blocks of data before becoming susceptible to certain statistical attacks (in particular distinguishing the encrypted file from truly random data), because of its 128-bit block size. 8GB (= $2^{36}$ bits = $2^{29}$ blocks) is quite ...


6

The question has morphed over time. I am answering the following. So to be sure, with DES, only when you encrypt something twice with a weak key. You get the back the original plaintext? That is correct as that is the definition of a DES weak key, a key for which encryption and decryption have the same effect. So when using DES in OFB mode with a ...


6

Just use the build in crypto PRNG of your operating system or framework. C# / .net: RNGCryptoServiceProvider Class Java: SecureRandom Class Linux: /dev/urandom Win32 API: CryptGenRandom function date/time might be enough for modes which only require uniqueness, but if you generate two IVs in quick succession(within 16ms or so) or if the clock is changed. ...


5

What you are asking is a straight application of Format Preserving Encryption, which builds ciphers which input and output are in a constrained format (generically: common to input and output, hence preserved). The FPE field has many articles with proven techniques; and proposed standards, including BPS and SP800-38G Draft. Note: the method tentatively ...


5

The only reason I can imagine why one would prefer CFB over OFB or CTR is error propagation. Another reason may be technical issues with the relieability of the transmission line. This comes from the fact that if you flip a single bit in an OFB ciphertext then you only get the same bit flipped in the underlying plaintext. But if you flip a single bit in CFB ...


5

First, approximately nothing in modern cryptography cares about the notion of error propagation in block cipher modes of operation—it is an archaic relic of the dark ages of crypto engineering that left us with hopelessly confusing concepts like ‘block cipher modes of operation’ thrust into the faces of hapless application engineers. If you want to detect ...


5

OFB with an IV re-use is a different kind of completely broken than ECB. In ECB mode, the problem is the fact that you can recognize blocks. That is if the same block appears twice you will notice that and know the underlying message-blocks were the same. In OFB mode, the problem is the re-use of the key-stream. That is for any two ciphertexts under the ...


5

I have a problem with OFB mode, because I have heard that it is stronger than CFB. On the contrary I would say that CFB is stronger. OFB means encrypting the IV again and again to produce the keystream. If you end up in a cycle, the keystream will start repeating itself. (This should not be a practical weakness, but why chance it?) CFB is more like CBC, ...


5

The choice or PRNG doesn't really matter much, as long as it's a decent one. I wouldn't use BBS because it's slow, and the security proof isn't too useful. The interesting question is rather, how to seed the PRNG with sufficient entropy. You need a sufficient amount of data that an attacker can't predict. I strongly recommend not doing this yourself, but to ...


5

CFB does require padding unless you use a segment size of 1 bit (or 8 bits if your message is byte oriented). Check Section 5.2 in NIST 800-38A: For the CFB mode, the total number of bits in the plaintext must be a multiple of a parameter, denoted s, that does not exceed the block size OFB indeed does not require any padding. There are no other ...


4

Yes, it is correct. Just follow the bits in the decryption pictures on the Wikipedia page about modes of operation. Modes of operation don't have to have a meaning compared to other modes of operation. I don't see CFB or OFB used too much anymore. OFB with partial feedback has been shown to be less secure, so that shouldn't be used anymore. Currently the ...


4

There is no real advantage, other than the fact that it allows you to convert a block cipher into a stream cipher securely. Since there has been a large amount of research put into block ciphers and ciphers such as AES are commonly implemented in hardware (such as AES-NI), it allows for reuse of the primitives. Side note: the nonce generally does not need ...


4

The properties that an IV must meet are strongly dependent on the mode that the IV is be used in. Some modes require unpredictability; other modes don't care about unpredictability but require uniqueness. As for OFB mode, it's in the 'don't care about unpredictability, but require uniqueness' camp. In particular, as long as you never reuse an IV, and you ...


4

No, it is not a good idea to use the Blum Blum Shub Generator to generate an Initialization Vector for a block cipher operated in OFB mode. In this usage, one needs that the IV has negligible chance to match an earlier IV used with the same key. The exact requirement is that the IV has negligible chance to match an input to the block cipher used in ...


4

Forget OFB mode. You should use CTR (counter) mode. It has the best bounds, and is parallelizable. This means that when you are using the AES-NI instruction set, encrypt with CTR is about 7 times faster than CBC, OFB etc. If you encrypt in OpenSSL you will get this performance. For a good thorough analysis and comparison of modes of operation, see http://...


3

For each message position or role, such as a different time in a conversation or a different field in a database, you must use a distinct nonce, sometimes also called IV. It doesn't matter what the content of the message is: in your database, you might store the same record content in two different places, in which case if you use the same nonce an ...


3

Well, if the block cipher is modeled as a random $N$ bit permutation (that is, each permutation from the set of $2^N$ bit patterns to itself is equally probable), then the answer is really quite easy (and this answer is exact): the probability that we will repeat a block within $M$ outputs is precisely $(M-1) 2^{-N}$ (for $0 < M \le 2^N+1$). The ...


3

Wikipedia has an excellent visual demonstration of the insecurity of ECB mode when applied to (potentially) repetitive data: Here, the first picture on the left shows a simple cartoon image (Tux the Penguin). The second image is the same, but with the (raw, uncompressed RGB) image data encrypted using ECB mode. While details of the image are scrambled, ...


2

ECB mode is a deterministic encryption, instead in OFB if the initial vector is random choosed (and of course published with the cryptogram) is a random encryption. What's the matter with det.enc.? The problem is that if you encoded two time the same message you are going to get two time the same chipertext, so the adversary can understand that you said the ...


2

An important point for both the one-time pad as well as other (synchronous) stream ciphers is: don't reuse your key stream. For the one-time pad, the key stream is the key itself, so this means: don't use a key twice. The two-times-pad is broken. For OFB and other stream ciphers with an initialization vector (IV), the key stream is decided by both key and ...


2

OFB is a method of converting a block cipher, like AES or DES, into a stream cipher. Because One Time Pad is theoretically secure (though impractical) people often try to make stream ciphers that try to approximate one time pad. OFB is a way of taking a block cipher to try to emulate the security you get from one time pad. A key distinction is that OTP is ...


2

As @CodesInChaos said, OFB is a stream cipher. The one-time pad is a stream cipher, too. One difference is that the one-time pad is information-theoretically secure, while OFB is computationally secure.


2

A quick follow up, there is a problem with using DES in OFB mode when you are not using the full feedback register. The generated keystream will become cyclic with on average a period of the order $2^{32}$ instead of $2^{64}$. See (R.R. Jueneman, “Analysis of certain aspects of Output Feedback Mode,” Advances in Cryptology, Proceedings Crypto’82, D. ...


2

Actually, I think I found the answer to my question while writing it, but I'll post it anyway, since it might be interesting to others: Yes, OFB mode is secure even with 8-bit feedback, at least as long as IVs are chosen randomly. Specifically, in the paper "New proof for old modes" (IACR Cryptology ePrint Archive, 2008), which I've cited earlier here, ...


2

Blowfish inputs two blocks of the same length and outputs two blocks of the same length. That is where you are running into an issue. Blowfish inputs a single 64-bit block and outputs a single 64-bit block, just like the picture shows. All the standard 64-bit compatible block cipher modes are compatible with Blowfish.


2

For DES we generally assume that an attacker can find out all information as the attacker can simply brute force the key. For a more secure protocol you could use another 64 bit block cipher such as triple DES (in three key mode, i.e. with keys of 168/192 bits) or another cipher such as Blowfish. However, if you want to use a streaming cipher you could also ...


2

Both OFB and LFSR use the output of one iteration of the function as input for a new iteration. Furthermore, both OFB and LFSR generate a pseudo random stream of bits / bytes. This stream can be used as key stream to encrypt/decrypt data, turning the algorithm into a stream cipher. There is a difference if the output of the last iteration is used to to ...


Only top voted, non community-wiki answers of a minimum length are eligible