2022 Developer Survey is open! Take survey.

# Tag Info

Accepted

### Can neural cryptanalysis be applied to AES?

No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES. Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. ...
• 122k

### Found a way to crack AES-128, what now?

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known ...
• 10.7k
Accepted

### AES - What is the advantage of a 256-bit key with a 128-bit block cipher?

No, this isn't an oversight. AES is a block cipher, which is a keyed permutation. Now if you have a permutation of, say, three elements there are e few permutations possible: ...
• 84.7k

### Is there a contingency plan in the event of a catastrophic attack on AES?

I'm not aware of any official NIST policy on the matter, so I can only make educated guesses. I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
• 84.7k
Accepted

### Does changing the order of the steps within a round affect the security of AES?

Short answer Changing the order of the operations does not weaken the security of $\mathop{AES}$ (nor does it increases it). Long answer Remark: While ShiftRows ...
• 9,789
Accepted

### What is the fastest block cipher in the (Intel) world?

The fastest block cipher is identity, which leaves input blocks completely unchanged. This is infinitely fast on all platforms; however, it is not secure. So maybe you want the fastest block cipher ...
• 84.6k
Accepted

### How 2 rounds in AES achieve full diffusion?

AES diffusion is taking cared of by 3 main functions: SubBytes Shift Rows Mix Columns SubBytes works as a 8-bit S-box. Thus if one bit change, the 8 bits of the byte are likely to change. With this ...
• 9,789

### Found a way to crack AES-128, what now?

Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it. Write the code for the attack. Verify that it works on ...
• 31.2k
Accepted

### Is there any compelling or logical reason to use AES-192 over AES-128 but not use AES-256?

There is no reason to use a AES-192 if you have access to AES-256 (or AES-128). This question is completely in line with the following thread: [Cfrg] A little room for AES-192 in TLS? which resulted ...
• 9,789
Accepted

### Is it necessary for the Rijndael polynomial to be primitive?

Is it necessary to choose a primitive polynomial for an S-Box? Actually, it is not necessary (and, as the polynomial they actually use in AES, $x^8 + x^4+ x^3 + x + 1$, is not primitive, and so it's ...
• 131k
Accepted

### Why was Rijndael the only cipher to have a variable number of rounds?

The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? Is there some cryptographic attack which is unique to Rijndael which would ...
• 131k
Accepted

### Why is AES unbreakable?

First, it's not said that AES is unbreakable, merely that none of the currently known attacks reduce the computational cost to a point where it's feasible. The current best attack on AES-128 takes 2^...
• 4,959
Accepted

### Is it safe to reuse a symmetric key when using asymmetric encryption?

The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In ...
• 26.9k
Accepted

### Advantage of $\operatorname{GF}(2^8)$ over $\mathbb Z/2^8\mathbb Z$ in AES/Rijndael

One important property of the mixColumns step is that it is Maximum Distance Separable (MDS). That is, if $M$ is our multiplication matrix, if you take any two distinct input vectors $V$ and $V'$, ...
• 131k
Accepted

### Confusion and Diffusion in the AES functions

I should start by saying that the notions confusion and diffusion can not provide an in-depth understanding of the design of the AES, simply because they are not specific enough. Instead, the key to ...
• 1,776
Accepted

### Need help understanding math behind Rijndael S-Box

The code is using the fact that the Rijndael's* Galois field has the following generators†: 3 5 6 9 11 14 17 18 19 20 23 24 25 26 28 30 31 33 34 35 39 40 42 44 48 49 60 62 63 65 69 70 71 72 73 75 76 ...
• 43.1k

### AES - What is the advantage of a 256-bit key with a 128-bit block cipher?

There is no NIST oversight here. The key size and the block size are two completely different parameters and issues. The only reason that you need a large block size is because bad things start to ...
• 26.9k

### Why is Rijndael key length restricted?

The key schedule uses constants that differ between the key sizes. For arbitrary sized keys you would have to define an algorithm for deriving them. Each key size also uses a different number of ...
• 31.2k

### Is standardizing a modified AES a good idea?

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe. It's a bad idea! How much scrutiny has it received? Almost none. How much will it ...
• 26.9k
Accepted

### Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

Finally I've went to the source and I've mailed the Rijndael's authors. They have answered very fast and very nice. I've understood the other way around. The affine transformation is over the vector ...
• 717

### What is the fastest block cipher in the (Intel) world?

Is Rijndael the fastest block cipher in the world? No. On an Intel 64 Sandy Bridge without AES-NI, AES (a subset of Rijndael) is outperfomed by ChaCha20 (and also likely by Threefish 512 which has ...
• 44.6k
Accepted

### How to find the AES branch number?

The AES MixColumns operator ensures that the 8 bytes (4 in the input column 4 in the output column) form the codewords of an MDS code over $GF(2^8)$, which means the minimum weight of the code, which ...
• 16.1k

### 32bit AES equals to 8bit AES?

So my guess is that the 32bit implementation returns different output than the 8bit implementation (the original). Can you correct me ? or at least explain why it is still equal ? Of course, it's ...
• 131k

### How can complexity be increased or decreased in AES?

This begs the question, why would you in any real-world circumstance wish to reduce the difficulty for an attacker to break your cryptosystem? To answer your question practically, the only reasonable ...
• 10.7k

### Is standardizing a modified AES a good idea?

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the ...

### Advantage of $\operatorname{GF}(2^8)$ over $\mathbb Z/2^8\mathbb Z$ in AES/Rijndael

An obvious distinction is that $GF(2^8)$ is a field, whereas $\Bbb Z/2^8\Bbb Z$ is not. That means, for any non-zero element $x\in GF(2^8)$, there exists some element $y\in GF(2^8)$ such that $xy=1$. ...
• 3,389
Accepted

### Construction of S-box in AES

In the field $GF(2^8)$, $x^{254} = x^{-1}$ (except for $x=0$, as $0^{-1}$ doesn't exist; for AES, that's treated as 0), and so it's two ways of describing the same thing. When we talk about AES, we ...
• 131k
Accepted

### Who said "32 round Rijndael" in the third AES Conference

This answer is based on Morris Dworkin's report of the conference, so it ultimately relies on its accuracy (it is probably more reliable than memory, though). Regarding the question "Except for your ...
• 1,776
Accepted

### How do Käsper and Schwabe's Bitsliced AES Mixcolumns work?

Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers. According to the slide, what they're doing is processing eight ...
• 44.3k
The columns of the state are considered as polynomials over $\operatorname{GF}(2^8)$ Bytes are values in $\operatorname{GF}(2^8)$. Thus a column composed as the 4 bytes $a_0,a_1,a_2,a_3$ represent ...