29
No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES.
Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. Applied to Unix crypt (section 5.4.4), it memorizes passwords/hash pairs (by a training requiring "from several days to several years") and then ...
16
In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known attack against misuse of particular block cipher modes; for instance, plaintext recovery with a chosen-ciphertext attack against ECB, or blind manipulation of the ...
16
No, this isn't an oversight. AES is a block cipher, which is a keyed permutation. Now if you have a permutation of, say, three elements there are e few permutations possible:
a -> a
b -> b
c -> c
but also:
a -> b
b -> c
c -> a
and
a -> c
b -> a
c -> b
and
a -> c
b -> b
c -> a
(there should be $6$ for $3!$, the ...
15
I'm not aware of any official NIST policy on the matter, so I can only make educated guesses.
I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For hash functions, neither SHA-2 nor SHA-3 are depending on AES in any way. The sponge function in Keccak (SHA-3) can also be used as a symmetric cipher (Ketje, ...
14
Short answer
Changing the order of the operations does not weaken the security of $\mathop{AES}$ (nor does it increases it).
Long answer
Remark: While ShiftRows and SubBytes are commutative ($f\ g : A \rightarrow A,\ f \circ g = g \circ f$). They are not commutative MixColumns. Therefore changing the order of operations will not produce the same result. ...
13
The fastest block cipher is identity, which leaves input blocks completely unchanged. This is infinitely fast on all platforms; however, it is not secure. So maybe you want the fastest block cipher that still offers some given non-trivial level of security?
Then it depends a lot on what you want to implement the block cipher on. With recent PC, you would ...
13
AES diffusion is taking cared of by 3 main functions:
SubBytes
Shift Rows
Mix Columns
SubBytes works as a 8-bit S-box. Thus if one bit change, the 8 bits of the byte are likely to change. With this step, each bit of a byte depend of each other.
This modification on the byte is then translated through the state via Shift Rows (still 1 byte affected) and ...
12
Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it.
Write the code for the attack. Verify that it works on randomly generated data of the kind it requires.
If it can break some challenge (e.g. these), do it. Post the results to the challenger or show the results publicly.
...
10
There is no reason to use a AES-192 if you have access to AES-256 (or AES-128).
This question is completely in line with the following thread:
[Cfrg] A little room for AES-192 in TLS? which resulted in this somewhat conclusion:
Dear all,
the related-key attacks against AES were interesting from an academic point of view as they broke the security claim we ...
10
Is it necessary to choose a primitive polynomial for an S-Box?
Actually, it is not necessary (and, as the polynomial they actually use in AES, $x^8 + x^4+ x^3 + x + 1$, is not primitive, and so it's a good thing that it's not necessary).
The polynomial must be irreducible (if it isn't, the multiplication operation isn't invertible in general, and hence you ...
10
The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this?
Is there some cryptographic attack which is unique to Rijndael which would warrant this?
During the second AES conference, the Rijndael team was asked about this design decision.
They turned it around, and pointed out that smaller keys ...
9
First, it's not said that AES is unbreakable, merely that none of the currently known attacks reduce the computational cost to a point where it's feasible. The current best attack on AES-128 takes 2^126.1 operations, if we had a computer (or cluster) several million times more efficient than any current computer and could operate at the thermodynamic ...
9
The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In particular, a man-in-the-middle can capture the client's public key, can forward its own public key to the server, and can then decrypt all traffic sent by each ...
8
It has to do with the alignment between the size of cipher the key and the size of a round key. Since a 256-bit key is twice the size of a round key, the nonlinearity of the key schedule would be aligned to every other block, and that is bad.
Here is an example of the round keys generated by the key schedule for a key (hex bytes) of value ...
8
The key schedule uses constants that differ between the key sizes. For arbitrary sized keys you would have to define an algorithm for deriving them. Each key size also uses a different number of rounds, for which you would have to do the same.
Also, what's the point? 256-bit keys are enough for all eternity. Using a longer keylength variant would likely ...
8
The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe.
It's a bad idea! How much scrutiny has it received? Almost none. How much will it receive? Almost none. Bad idea.
8
There is no NIST oversight here. The key size and the block size are two completely different parameters and issues. The only reason that you need a large block size is because bad things start to happen when you encrypt too many blocks. Specifically, for an $n$-bit block size, the birthday paradox kicks in at $\sqrt{2^n}$. So, for a 128-bit block, you need ...
8
Is Rijndael the fastest block cipher in the world?
No. On an Intel 64 Sandy Bridge without AES-NI, AES (a subset of Rijndael) is outperfomed by ChaCha20 (and also likely by Threefish 512 which has about 6-7cpb cost on an older Intel Core 2 Duo with 64-bit ASM (link: original Skein paper PDF)) as opposed to AES' 11 cpb. (7.59 cpb on an Intel Core 2)
What ...
8
The AES MixColumns operator ensures that the 8 bytes (4 in the input column 4 in the output column) form the codewords of an MDS code over $GF(2^8)$, which means the minimum weight of the code, which is 5, equals the number of nonzero bytes.
Any nonzer byte contributes 1 to the minimum weight, by definition of Hamming Weight over $GF(2^8)$. A nonzero symbol ...
8
One important property of the mixColumns step is that it is Maximum Distance Separable (MDS). That is, if $M$ is our multiplication matrix, if you take any two distinct input vectors $V$ and $V'$, and compute $M \cdot V$ and $M \cdot V'$, the total number of bytes distinct in $V$ and $V'$ plus the total number of bytes distinct in $M \cdot V$ and $M \cdot V'...
8
So my guess is that the 32bit implementation returns different output than the 8bit implementation (the original).
Can you correct me ? or at least explain why it is still equal ?
Of course, it's equal. The AES function (for a specific plaintext, key) is well defined; and if you generate any other result, you're not doing AES correctly.
Of course, while ...
8
The code is using the fact that the Rijndael's* Galois field has the following generators†:
3 5 6 9 11 14 17 18 19 20 23 24 25 26 28 30 31 33 34 35 39 40 42 44 48 49 60 62 63 65 69 70 71 72 73 75 76 78 79 82 84 86 87 88 89 90 91 95 100 101 104 105 109 110 112 113 118 119 121 122 123 126 129 132 134 135 136 138 142 143 144 147 149 150 152 153 155 157 160 164 ...
7
I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the responses follow:
First off, the authors are working on a design rationale in english for their new cipher. As soon as it's published, it will be linked here. ...
7
This begs the question, why would you in any real-world circumstance wish to reduce the difficulty for an attacker to break your cryptosystem?
To answer your question practically, the only reasonable way I can think of to accomplish this is to simply reduce the entropy in the key. At 100%, all 128 bits of the key are used. At 50%, 64 bits of the key are ...
7
Finally I've went to the source and I've mailed the Rijndael's authors. They have answered very fast and very nice.
I've understood the other way around. The affine transformation is over the vector space $((GF(2))^8$ and what they've say as simplicity was that, between all the possible affine transformations they select one that can also be described as ...
7
The S-Box was generated when Rijndael was designed, not in any step.
It's used in every round in the SubBytes step.
The S-box is constant. You could see it as a function taking a byte and returning a byte. It is used to reduce algebraic properties of Rijndael.
In fact, this is it:
| 0 1 2 3 4 5 6 7 8 9 a b c d e f
---|--|--|--|--|--|--|--|...
7
AES-128 takes a 128-bit key, produces 11 128-bit subkeys out of it with a cryptographically weak function, and uses them in 10 internal rounds. It can be said that the full key is reused 10 times.
AES-192 takes a 192-bit key, produces 13 128-bit subkeys out of it (or, equivalently, 9 192-bit subkeys), and uses them in 12 rounds. The full key is reused 8 ...
7
In the field $GF(2^8)$, $x^{254} = x^{-1}$ (except for $x=0$, as $0^{-1}$ doesn't exist; for AES, that's treated as 0), and so it's two ways of describing the same thing.
When we talk about AES, we typically use the $x^{-1}$ nomenclature; for whatever reason, your class decided to go with the $x^{254}$ one.
7
I should start by saying that the notions confusion and diffusion can not provide an in-depth understanding of the design of the AES, simply because they are not specific enough. Instead, the key to understanding the choice of the steps in the round transformation is the wide trail strategy.
That said, we can of course try to understand the effect of each ...
6
Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers.
According to the slide, what they're doing is processing eight 128-bit AES blocks in parallel, using eight 128-bit XMM registers to store them. They're not doing basic "naïve bitslicing", which would involve using 128 $n$-...
Only top voted, non community-wiki answers of a minimum length are eligible