2022 Developer Survey is open! Take survey.
29 votes
Accepted

Can neural cryptanalysis be applied to AES?

No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES. Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. ...
user avatar
  • 122k
17 votes

Found a way to crack AES-128, what now?

In complete honesty: if you have to ask this question, it's overwhelmingly unlikely that you have actually succeeded in breaking the security of AES. At best, you may have discovered a well-known ...
user avatar
16 votes
Accepted

AES - What is the advantage of a 256-bit key with a 128-bit block cipher?

No, this isn't an oversight. AES is a block cipher, which is a keyed permutation. Now if you have a permutation of, say, three elements there are e few permutations possible: ...
user avatar
  • 84.7k
16 votes

Is there a contingency plan in the event of a catastrophic attack on AES?

I'm not aware of any official NIST policy on the matter, so I can only make educated guesses. I guess new algorithms have sprung up and are already in place. ChaCha20 is used in TLS 1.2 and 1.3. For ...
user avatar
  • 84.7k
14 votes
Accepted

Does changing the order of the steps within a round affect the security of AES?

Short answer Changing the order of the operations does not weaken the security of $\mathop{AES}$ (nor does it increases it). Long answer Remark: While ShiftRows ...
user avatar
  • 9,789
13 votes
Accepted

What is the fastest block cipher in the (Intel) world?

The fastest block cipher is identity, which leaves input blocks completely unchanged. This is infinitely fast on all platforms; however, it is not secure. So maybe you want the fastest block cipher ...
user avatar
13 votes
Accepted

How 2 rounds in AES achieve full diffusion?

AES diffusion is taking cared of by 3 main functions: SubBytes Shift Rows Mix Columns SubBytes works as a 8-bit S-box. Thus if one bit change, the 8 bits of the byte are likely to change. With this ...
user avatar
  • 9,789
12 votes

Found a way to crack AES-128, what now?

Assuming you really had broken AES or another frequently used algorithm that is thought to be secure, the first step would be to prove it. Write the code for the attack. Verify that it works on ...
user avatar
  • 31.2k
10 votes
Accepted

Is there any compelling or logical reason to use AES-192 over AES-128 but not use AES-256?

There is no reason to use a AES-192 if you have access to AES-256 (or AES-128). This question is completely in line with the following thread: [Cfrg] A little room for AES-192 in TLS? which resulted ...
user avatar
  • 9,789
10 votes
Accepted

Is it necessary for the Rijndael polynomial to be primitive?

Is it necessary to choose a primitive polynomial for an S-Box? Actually, it is not necessary (and, as the polynomial they actually use in AES, $x^8 + x^4+ x^3 + x + 1$, is not primitive, and so it's ...
user avatar
  • 131k
10 votes
Accepted

Why was Rijndael the only cipher to have a variable number of rounds?

The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? Is there some cryptographic attack which is unique to Rijndael which would ...
user avatar
  • 131k
9 votes
Accepted

Why is AES unbreakable?

First, it's not said that AES is unbreakable, merely that none of the currently known attacks reduce the computational cost to a point where it's feasible. The current best attack on AES-128 takes 2^...
user avatar
9 votes
Accepted

Is it safe to reuse a symmetric key when using asymmetric encryption?

The use of the AES key many times is not a problem. However, there is a fundamental flaw with your solution. The server has no way of validating that it received the client's authentic public key. In ...
user avatar
9 votes
Accepted

Advantage of $\operatorname{GF}(2^8)$ over $\mathbb Z/2^8\mathbb Z$ in AES/Rijndael

One important property of the mixColumns step is that it is Maximum Distance Separable (MDS). That is, if $M$ is our multiplication matrix, if you take any two distinct input vectors $V$ and $V'$, ...
user avatar
  • 131k
9 votes
Accepted

Confusion and Diffusion in the AES functions

I should start by saying that the notions confusion and diffusion can not provide an in-depth understanding of the design of the AES, simply because they are not specific enough. Instead, the key to ...
user avatar
  • 1,776
9 votes
Accepted

Need help understanding math behind Rijndael S-Box

The code is using the fact that the Rijndael's* Galois field has the following generators†: 3 5 6 9 11 14 17 18 19 20 23 24 25 26 28 30 31 33 34 35 39 40 42 44 48 49 60 62 63 65 69 70 71 72 73 75 76 ...
user avatar
  • 43.1k
8 votes

AES - What is the advantage of a 256-bit key with a 128-bit block cipher?

There is no NIST oversight here. The key size and the block size are two completely different parameters and issues. The only reason that you need a large block size is because bad things start to ...
user avatar
8 votes

Why is Rijndael key length restricted?

The key schedule uses constants that differ between the key sizes. For arbitrary sized keys you would have to define an algorithm for deriving them. Each key size also uses a different number of ...
user avatar
  • 31.2k
8 votes

Is standardizing a modified AES a good idea?

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe. It's a bad idea! How much scrutiny has it received? Almost none. How much will it ...
user avatar
8 votes
Accepted

Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

Finally I've went to the source and I've mailed the Rijndael's authors. They have answered very fast and very nice. I've understood the other way around. The affine transformation is over the vector ...
user avatar
  • 717
8 votes

What is the fastest block cipher in the (Intel) world?

Is Rijndael the fastest block cipher in the world? No. On an Intel 64 Sandy Bridge without AES-NI, AES (a subset of Rijndael) is outperfomed by ChaCha20 (and also likely by Threefish 512 which has ...
user avatar
  • 44.6k
8 votes
Accepted

How to find the AES branch number?

The AES MixColumns operator ensures that the 8 bytes (4 in the input column 4 in the output column) form the codewords of an MDS code over $GF(2^8)$, which means the minimum weight of the code, which ...
user avatar
  • 16.1k
8 votes

32bit AES equals to 8bit AES?

So my guess is that the 32bit implementation returns different output than the 8bit implementation (the original). Can you correct me ? or at least explain why it is still equal ? Of course, it's ...
user avatar
  • 131k
7 votes

How can complexity be increased or decreased in AES?

This begs the question, why would you in any real-world circumstance wish to reduce the difficulty for an attacker to break your cryptosystem? To answer your question practically, the only reasonable ...
user avatar
7 votes

Is standardizing a modified AES a good idea?

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the ...
7 votes

Advantage of $\operatorname{GF}(2^8)$ over $\mathbb Z/2^8\mathbb Z$ in AES/Rijndael

An obvious distinction is that $GF(2^8)$ is a field, whereas $\Bbb Z/2^8\Bbb Z$ is not. That means, for any non-zero element $x\in GF(2^8)$, there exists some element $y\in GF(2^8)$ such that $xy=1$. ...
user avatar
7 votes
Accepted

Construction of S-box in AES

In the field $GF(2^8)$, $x^{254} = x^{-1}$ (except for $x=0$, as $0^{-1}$ doesn't exist; for AES, that's treated as 0), and so it's two ways of describing the same thing. When we talk about AES, we ...
user avatar
  • 131k
7 votes
Accepted

Who said "32 round Rijndael" in the third AES Conference

This answer is based on Morris Dworkin's report of the conference, so it ultimately relies on its accuracy (it is probably more reliable than memory, though). Regarding the question "Except for your ...
user avatar
  • 1,776
6 votes
Accepted

How do Käsper and Schwabe's Bitsliced AES Mixcolumns work?

Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers. According to the slide, what they're doing is processing eight ...
user avatar
6 votes
Accepted

AES Mix Column Transformation

The columns of the state are considered as polynomials over $\operatorname{GF}(2^8)$ Bytes are values in $\operatorname{GF}(2^8)$. Thus a column composed as the 4 bytes $a_0,a_1,a_2,a_3$ represent ...
user avatar
  • 9,789

Only top scored, non community-wiki answers of a minimum length are eligible