Questions tagged [initialization-vector]
Unique data used by block cipher modes of operation to randomize the output in order to achieve semantic security. Also for other similar constructs in other iterative algorithms.
403 questions
3
votes
3
answers
372
views
Best way to transfer partially known data using AES-CBC
Using the AES algorithm in CBC mode, my goal is to transfer some encrypted JSON data with known keys (that means that roughly 40% to 60% of the plaintext data might be known by the attacker including ...
- 33
3
votes
0
answers
118
views
Circumventing birthday bounds in AES-GCM?
I'm looking at using AES-256-GCM to encrypt data at rest (in a database) with logged-in user id's (among possibly other things) as the authenticated data.
I'd like the application to (eventually) ...
- 373
0
votes
1
answer
148
views
Using AES GCM with IV [prefix + counter], can I just change the prefix instead of changing the whole AES key if the counter overflows?
I'm making an online Client-Server game where upon a client's connection a sessionKey is generated by the server and exchanged securely under TLS during authentication, so that the client can also ...
5
votes
2
answers
627
views
Is it insecure to use a good hash function on the data to derive the nonce for AES-CTR
This answer to a similar question on AES-GCM says that using a the hash of the combination of message and key as a nonce (left half bits of counter, as I understand it, for AES-CTR) would be OK, but ...
- 165
0
votes
1
answer
114
views
GCM AES over (wireless) internet - why reset counter with every packet?
I'm learning about block cipher operation modes and have a small question. I am listening to a lecture recording that casually mentions that when using Galois Counter Mode with AES over the internet (...
- 133
3
votes
2
answers
232
views
When using AES-CTR with random IV, shouldn't we transmit IV encrypted?
I have been reading about AES-CTR mode, and the risk of overlapping IVs. For example, one message uses random IV a, and another message uses a different random IV ...
- 133
2
votes
1
answer
161
views
HMAC: IV=key instead of concatenation?
$$\text{HMAC}(K, m) = \text{H}((K' \oplus \mathbb{opad}) || \text{H}((K' \oplus \mathbb{ipad}) || m))\\K' =
\begin{cases}
\text{H}(K) & \text{if } K \text{ is larger than block size} \\
K & \...
2
votes
3
answers
836
views
Why is there no AES-512 for CTR & variants to have good large nonces?
AES-CTR and authenticated variants tend to have a 'problem' with lacking bit real-estate for nonce & counter.
Why hasn't an AES-512 variant been standardized at some point? It would allow moving ...
- 21
0
votes
1
answer
456
views
Tools to crack AES-GCM when IV is reused
I have read multiple times that data encrypted with the AES-GCM scheme fails catastrophically if you reuse the IV in different instances, leaking the XOR table (to my understanding this means no key ...
- 103
0
votes
0
answers
76
views
Padding cannot understood
I have AES CBC 128 bit code in hex (each 2 character is one byte in hexadecimal representation).
...
- 1
0
votes
1
answer
209
views
AES 128 CFB : first decryption from initial IV OK, issues from second
I'm making documentation for an ethernet gateway that using Lantronix xPortEDGE module. It can encrypt/decrypt in AES 128, 192 and 256 bits.
I'm struggling to get more information from the ...
- 3
1
vote
1
answer
277
views
Reverse engineering black box cryptography
I have a black box system that is doing some encryption that I need to reverse engineer so I can replicate it in new software. I know the input, the output, and the key. An example:
Plain text: ...
- 141
0
votes
0
answers
91
views
What block cipher should I use for encrypting GCM initialization vector counter-based nonce?
I'm implementing a mobile VPN product based on AES-GCM that should be resistant against fingerprinting the movements of mobile nodes. A difficulty is that the mobile nodes may not have the best ...
- 1,643
2
votes
1
answer
131
views
Is AES-GCM safe if same key is used for both uplink and downlink, assuming last IV bit tells the direction
I have designed a cryptographical protocol which uses AES-GCM with a single key.
I have gone to great lengths to ensure the same initialization vector is never reused. The first bits of the ...
- 1,643
2
votes
1
answer
196
views
Is AES-CTR mode with predictable IV vulnerable to CPA attacks?
I'm just confused about this topic problem.
I know that the CBC mode will be vulnerable to CPA attacks if the IV is predictable, but what about the CTR mode?
