29
votes
Accepted
Can neural cryptanalysis be applied to AES?
No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES.
Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. ...
- 122k
17
votes
Found a way to crack AES-128, what now?
In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known ...
- 10.7k
16
votes
Accepted
AES - What is the advantage of a 256-bit key with a 128-bit block cipher?
No, this isn't an oversight. AES is a block cipher, which is a keyed permutation. Now if you have a permutation of, say, three elements there are e few permutations possible:
...
- 84.7k
16
votes
Is there a contingency plan in the event of a catastrophic attack on AES?
I'm not aware of any official NIST policy on the matter, so I can only make educated guesses.
I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
- 84.7k
14
votes
Accepted
Does changing the order of the steps within a round affect the security of AES?
Short answer
Changing the order of the operations does not weaken the security of $\mathop{AES}$ (nor does it increases it).
Long answer
Remark: While ShiftRows ...
- 9,789
13
votes
Accepted
What is the fastest block cipher in the (Intel) world?
The fastest block cipher is identity, which leaves input blocks completely unchanged. This is infinitely fast on all platforms; however, it is not secure. So maybe you want the fastest block cipher ...
- 84.6k
13
votes
Accepted
How 2 rounds in AES achieve full diffusion?
AES diffusion is taking cared of by 3 main functions:
SubBytes
Shift Rows
Mix Columns
SubBytes works as a 8-bit S-box. Thus if one bit change, the 8 bits of the byte are likely to change. With this ...
- 9,789
12
votes
Found a way to crack AES-128, what now?
Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it.
Write the code for the attack. Verify that it works on ...
- 31.2k
10
votes
Accepted
Is there any compelling or logical reason to use AES-192 over AES-128 but not use AES-256?
There is no reason to use a AES-192 if you have access to AES-256 (or AES-128).
This question is completely in line with the following thread:
[Cfrg] A little room for AES-192 in TLS? which resulted ...
- 9,789
10
votes
Accepted
Is it necessary for the Rijndael polynomial to be primitive?
Is it necessary to choose a primitive polynomial for an S-Box?
Actually, it is not necessary (and, as the polynomial they actually use in AES, $x^8 + x^4+ x^3 + x + 1$, is not primitive, and so it's ...
- 131k
10
votes
Accepted
Why was Rijndael the only cipher to have a variable number of rounds?
The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this?
Is there some cryptographic attack which is unique to Rijndael which would ...
- 131k
9
votes
Accepted
Why is AES unbreakable?
First, it's not said that AES is unbreakable, merely that none of the currently known attacks reduce the computational cost to a point where it's feasible. The current best attack on AES-128 takes 2^...
- 4,959
9
votes
Accepted
Is it safe to reuse a symmetric key when using asymmetric encryption?
The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In ...
- 26.9k
9
votes
Accepted
Advantage of $\operatorname{GF}(2^8)$ over $\mathbb Z/2^8\mathbb Z$ in AES/Rijndael
One important property of the mixColumns step is that it is Maximum Distance Separable (MDS). That is, if $M$ is our multiplication matrix, if you take any two distinct input vectors $V$ and $V'$, ...
- 131k
9
votes
Accepted
Confusion and Diffusion in the AES functions
I should start by saying that the notions confusion and diffusion can not provide an in-depth understanding of the design of the AES, simply because they are not specific enough. Instead, the key to ...
- 1,776
9
votes
Accepted
Need help understanding math behind Rijndael S-Box
The code is using the fact that the Rijndael's* Galois field has the following generators†:
3 5 6 9 11 14 17 18 19 20 23 24 25 26 28 30 31 33 34 35 39 40 42 44 48 49 60 62 63 65 69 70 71 72 73 75 76 ...
- 43.1k
8
votes
AES - What is the advantage of a 256-bit key with a 128-bit block cipher?
There is no NIST oversight here. The key size and the block size are two completely different parameters and issues. The only reason that you need a large block size is because bad things start to ...
- 26.9k
8
votes
Why is Rijndael key length restricted?
The key schedule uses constants that differ between the key sizes. For arbitrary sized keys you would have to define an algorithm for deriving them. Each key size also uses a different number of ...
- 31.2k
8
votes
Is standardizing a modified AES a good idea?
The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe.
It's a bad idea! How much scrutiny has it received? Almost none. How much will it ...
- 26.9k
8
votes
Accepted
Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?
Finally I've went to the source and I've mailed the Rijndael's authors. They have answered very fast and very nice.
I've understood the other way around. The affine transformation is over the vector ...
- 717
8
votes
What is the fastest block cipher in the (Intel) world?
Is Rijndael the fastest block cipher in the world?
No. On an Intel 64 Sandy Bridge without AES-NI, AES (a subset of Rijndael) is outperfomed by ChaCha20 (and also likely by Threefish 512 which has ...
- 44.6k
8
votes
Accepted
How to find the AES branch number?
The AES MixColumns operator ensures that the 8 bytes (4 in the input column 4 in the output column) form the codewords of an MDS code over $GF(2^8)$, which means the minimum weight of the code, which ...
- 16.1k
8
votes
32bit AES equals to 8bit AES?
So my guess is that the 32bit implementation returns different output than the 8bit implementation (the original).
Can you correct me ? or at least explain why it is still equal ?
Of course, it's ...
- 131k
7
votes
How can complexity be increased or decreased in AES?
This begs the question, why would you in any real-world circumstance wish to reduce the difficulty for an attacker to break your cryptosystem?
To answer your question practically, the only reasonable ...
- 10.7k
7
votes
Is standardizing a modified AES a good idea?
I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the ...
7
votes
Advantage of $\operatorname{GF}(2^8)$ over $\mathbb Z/2^8\mathbb Z$ in AES/Rijndael
An obvious distinction is that $GF(2^8)$ is a field, whereas $\Bbb Z/2^8\Bbb Z$ is not. That means, for any non-zero element $x\in GF(2^8)$, there exists some element $y\in GF(2^8)$ such that $xy=1$. ...
- 3,389
7
votes
Accepted
Construction of S-box in AES
In the field $GF(2^8)$, $x^{254} = x^{-1}$ (except for $x=0$, as $0^{-1}$ doesn't exist; for AES, that's treated as 0), and so it's two ways of describing the same thing.
When we talk about AES, we ...
- 131k
7
votes
Accepted
Who said "32 round Rijndael" in the third AES Conference
This answer is based on Morris Dworkin's report of the conference, so it ultimately relies on its accuracy (it is probably more reliable than memory, though).
Regarding the question "Except for your ...
- 1,776
6
votes
Accepted
How do Käsper and Schwabe's Bitsliced AES Mixcolumns work?
Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers.
According to the slide, what they're doing is processing eight ...
- 44.3k
6
votes
Accepted
AES Mix Column Transformation
The columns of the state are considered as polynomials over $\operatorname{GF}(2^8)$
Bytes are values in $\operatorname{GF}(2^8)$. Thus a column composed as the 4 bytes $a_0,a_1,a_2,a_3$ represent ...
- 9,789
Only top scored, non community-wiki answers of a minimum length are eligible