What are the disadvantages of using AES-256 with 240-byte key (which scrypt/bcrypt/argon2/pbkdf2 can easily output) instead of an expanded 256-bit key?  The only disadvantage I can think of is "no more hardware acceleration". This is not important for a fair comparison, are there other disadvantages?  EDIT: This is about replacing round keys.
122241
So for each round in AES a different key is used, and as I saw the keys are created form a master key.  My question is how these round keys are generated.   Are they created via a Key Derivation Function as the session keys, or its something else ?
9098
Speed/Security? Why should we choose to use 64 bit instead of 32 bit?
104858
Let's say I start with a particular 256 bit value. Call this $v$. I then hash that value, and get another 256 bit value. Call this $\text{SHA256}(v)$. I take this value and get another 256 bit value. Call this $\text{SHA256}^2(v)$. More generally, let's call the result of hashing $v$ repeatedly $n$ times $\text{SHA256}^n(v)$.  Now my question is, how big will $n$ be, such that $\text{SHA256}^n(v) = v$?  It would seem to me, that if it's a giant sort of permutation, $n$ would have to be $2^{256}$, is that correct? Is that provable, or is there any information on this? (Just curiosity, really.)  Another question I had was, do all 256 bit strings have unique SHA256 values, and is there a way to show that? (Or, stated differently, can it be shown that there are no SHA-256 collisions in the language of all "256 bit strings"?)
111228
Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size?  I have read that you can only encrypt a message of around 117 to 200 bytes in size (depending on your key size: 1024 or 2048 bits). Is this correct?  If so, I think I have read people suggesting on using it for larger files. I guess they are just repeating the process many times over and over in blocks of 117 bytes?
9707
According to , "SHA-256d" was proposed in one of the Ferguson/Schneier books like so:  SHA-256d(x) = SHA-256(SHA-256(x))   Apparently, the motivation for this construction is to avoid length extension attacks.  Incidentally, SHA-256d is the hash function forming the core of Bitcoin.  According to the comment on the answer linked above, "some minor weaknesses" are known in SHA-256d. What are they?
10754
points out that certain key and block lengths were a requirement for the AES submissions:     The candidate algorithm shall be capable of supporting key-block combinations with sizes of 128-128, 192-128, and 256-128 bits.   My question is this; how can having a key length that is greater than the block size enhance security?  If we look at ECB mode for simplicity, when the key length is equal to the block length we have a permutation relationship between the set of all plaintexts and the set of all ciphertexts.  Once you increase the key length beyond that, you start to introduce collisions. In fact, you only introduce collisions from then on don't you? Collisions in the sense that a key will create the same ciphertext-plantext relationship as another key.  This would lead me to believe that only part of the key-space is unique, and only that part of key-space needs to be brute-forced?  I know that I am clearly incorrect, I just don't understand why.
23599
Wikipedia lists the following pseudocode for HMAC:  function hmac (key, message)     if (length(key) &gt; blocksize) then         key = hash(key) // keys longer than blocksize are shortened     end if     if (length(key) &lt; blocksize) then         // keys shorter than blocksize are zero-padded ('∥' is concatenation)          key = key ∥ [0x00 * (blocksize - length(key))]      end if      // Where blocksize is that of the underlying hash function        o_key_pad = [0x5c * blocksize] ⊕ key      // Where ⊕ is exclusive or (XOR)     i_key_pad = [0x36 * blocksize] ⊕ key       // Where '∥' is concatenation        return hash(o_key_pad ∥ hash(i_key_pad ∥ message))  end function   Why are they there?  How were they chosen?  It seems to me that  $hash(key + hash(message))$ (where + is concatenation) would suffice.    Obviously I'm missing something.  What is it?
32272
The cipher AES-256 is used among other places in  across the Internet. It's considered among the top ciphers.  In theory it's not crackable since the combinations of keys are massive.  Although NSA has categorized this in , they have also recommended using higher than 128-bit keys for encryption.  So how secure is this cipher really? Should you assume the worlds top cracker-institutions are near or have cracked it already?
13844
In Java, there is no such thing as an unsigned byte.  Working with some low level code, occasionally you need to work with bytes that have unsigned values greater than 128, which causes Java to interpret them as a negative number due to the MSB being used for sign.  What's a good way to work around this? (Saying don't use Java is not an option)
102466
Can anyone recommend a small, free implementation of AES-128 Rijndael for microcontrollers. Ideally, for the PIC18, though a general implementation in C would be useful.  Compiling the  for PIC18 and encrypting/decrypting a block requires 6KB ROM and 750b of RAM.  Compiling  for PIC18 and encrypting/decrypting a block requires 28KB ROM and 0.5KB RAM.  Compiling  for PIC18 and encrypting/decrypting a block requires 19KB of ROM and 190 bytes of RAM.  Are there better optimised PIC specific variants available?  (updated RAM requirements for axTLS version)
34355
This is a follow up to   I am using a SHA-256 HMAC function on a single-word input: sha256hmac(privatekey,word) = output. The private key length is 128 bits, it does not change. The "word" is literally one short word.  Assuming an attacker knows "word" and "output" for multiple words (e.g., dog = "dsfwrw3r3r323211", cat = "3erwerwetwewer"):   Is it significantly easier for an attacker to identify the private key by brute force with the above word/output pairs, as compared to a situation where they do not have those pairs? Is this brute force vulnerability (with word/output pair knowledge) an actual security concern?
85023
The  uses round constants derived from $\pi$ to improve diffusion, even if the additions modulo $2^{32}$ are replaced with bitwise XOR when processing a null message and null initial state:     The higher weight in the original model is due to the addition carries induced by the constants $c_0,\dots,c_{15}$. A technique to avoid carries at the first round and get a low-weight output difference is to choose a message such that $m_0 = c_0,\dots,m_{15} = c_{15}$. At the subsequent rounds, however, nonzero words are introduced because of the different permutations.   However, the  describes changes it made to BLAKE that remove these constants:     Constants in G initially aimed to guarantee early propagation of carries, but it turned out that the benefits (if any) are not worth the performance penalty.  This change saves two xors and two loads per G, that is, 16% of the total arithmetic (addition and xor) instructions.   This statement was made as part of an argument that reducing the number of constants in BLAKE2 does not weaken it, while simultaneously decreasing RAM and ROM footprint. Unfortunately, unlike many of the other trade-offs it discusses, no further explanation is given. What are the benefits of guaranteeing early propagation of carries that lead to BLAKE's constants, and why are these benefits in doubt?
13697
We all know that AES uses Key, IV and salt. But what if we add special ASCII characters like Alternate 255 (&quot; &quot;) or Alternatively 163 (&quot;£&quot;) or Alternate 224 (&quot;α&quot;) in the Key or IV or salt. Does it add extra security?
101847
I have been reading about . I was wondering if this attack is feasible while signing with RSA and, if yes, how?    Also, how this kind of attack is applied with DH?   Talking about timing attacks in general, in which way AES is affected and how to solve it? (I mean, with RSA the "problem" is at multiplication level, while for AES where is the problem that makes the cipher implementation key or data dependent?)
12716
Generate a 256-bit random nonce. XOR it with a 256-bit reusable symmetric key. This is x.  We represent numbers in simple binary instead of a counting function. 0 in dec = [256 zeros] in binary, 1 = [255 zeros]1, 23092348 = [241 zeros]1011000000101110001111100, etc.  For each nth block needed for the length of the plaintext, XOR x with n and hash it with SHA-256 to form b[n].  Let p[n] be the nth 256-bit block in the plaintext and c[n] be the nth block in the ciphertext. Then c[n] := b[n] XOR p[n].  Send the unencrypted nonce along with the ciphertext.  To decrypt c[n], XOR it with b[n] to retrieve p[n].  Is this secure? If so, then why do we need AES-256?  If this is not secure, then is there any mode of operation for which SHA-256 is secure as a block cipher? Specifically, it would need to be used in cipher feedback, output feedback, or any other mode that only uses the cipher in the encryption direction.
73738
Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA.  (Note: I do realize that in practice this is done through an intermediate symmetric key, but this question assumes we only use asymmetric encryption.)  Say I try to do this: I slice up my data into 2n-byte blocks (padding with zeros [edit: padding appropriately] if necessary), append the block index to the block (to prevent the same plaintext from turning into the same ciphertext), then use my friend's public key to encrypt each block separately.  Is this a secure scheme, or does the fact that I'm re-using the key make it susceptible to some kind of attack? If so, is it used in practice in any existing algorithms? If not, is there any way to make it safe, aside from using a symmetric key?
86642
The usual implementation of AES first computes all the Round Keys sequentially starting from the key, and stores them in RAM for later uses. However, when enciphering a single block with a key that will be used for that purpose only, or when RAM is very sparse, or perhaps in hardware, it is advantageous to use the Round Keys a they are being generated, rather than store them. Quoting the :     The key schedule can be implemented without explicit use of the array W[Nb*(Nr+1)]. For implementations where RAM is scarce, the Round Keys can be computed on-the-fly using a buffer of Nk words with almost no computational overhead.   It is said this also works for deciphering:     The key expansion operation that generates W is defined in such a way that we can also start with the last Nk words of Round Key information and roll back to the original Cipher Key. So, calculation ’on-the-fly' of the Round Keys, starting from an “Inverse Cipher Key”, is still possible.   However, the how-to is left as an exercise to the reader. In particular: Can the last Round Key (the first used when deciphering) be computed directly, rather than sequentially?