My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
122690
I understand that initialization vectors (IV) should not be used twice when using AES/GCM. I am using a counter as an initialization vector. Every time I send out a new packet (I am developing an UDP based protocol that needs packet encryption) I increment the counter and use it as IV.   However, since I will generally need that protocol to transfer files and to send  for very very extended periods of time, in principle for very large files it is conceivable to send more than $2^{32}$ packets, or over the years it is conceivable to send out $2^{32}$ keepalives. To keep the IVs always unique, I would probably need to use a 64 bits integer, but that is 4 bytes more of overhead per packet, that can sum up to quite large quantities which I would like to avoid if not strictly necessary.  So I wonder: how bad it is to reuse the IVs with AES/GCM? Can I have an idea of how dangerous that can be? I mean: if as soon as I repeat an IV once I get immediately so easily exposed to an attack that I could just give out my key publicly, then I have to take countermeasures. However, if that becomes dangerous only when I use the same IV a lot of times, that is completely another thing.
121639
I heard multiple times not to reuse the same IV and IV should be random but doesn't need to be secret. I also heard if the IV is something like sequential numbers or something predictable I should hash(salt+pepper) it. Why on earth should i be doing that if they don't need to be a secret?  In this specific case i am encrypting rows with one secret AES key and i am using a fixed IV but xor-ing it with the row id. Its predictable and not secret but by doing this it isn't reused which i thought was the important part.  Are IVs suppose to be secret? Are predictable IVs ok? Should i be hashing predictable IV?
110846
While developing some code that uses the .NET AesManaged algorithm, I made some mistakes but was surprised at the results.  My encryption was correct.  I was generating a random IV block and writing it to the file (without encrypting the IV).  Then I was encrypting the plaintext and writing it.  The decryption was wrong though... instead of reading the first block from the file an using it as an IV, it was just using a random IV and decrypting everything.  The first block came out gibberish but the 2nd (and subsequent) ones were decrypted properly!  Why would this be?  And even weirder... when I tried to fix it by encrypting the IV in the encryption code (instead of writing the IV unchanged) the decryption result was the same!  (gibberish then correctly decrypted blocks).  Although I eventually fixed my code, how do these results make sense?
119167
One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved:   Fast generation of independent and identically distributed random variables Perfect key distribution system Key only used once. Key destroyed after use, without side channels that would allow any non-trusted third party to attain any key bits.   However, for modern information exchange, it is not sufficient to encrypt information (this is against Eve). In addition to encryption, it is necessary to also protect   integrity (this is against broken phone or cable) and message authenticity (this is against Mallory).   Some recommendations in cryptography recommend to use security level similar for encryption keys and message authenticity keys (i.e. use 128-bit encryption key and 128-bit MAC key). For MAC tag, it is common convention for HMAC or to use at most half of the MAC key length as the output length. Some other algorithms use full block length of the function.  For information theoretic authentication tag security, I would expect that in order to transfer message with length $N$ bits, I would need at least another $N$ bits to transfer "authentication tag" matching with the message.  Choices for Integrity or Authentication  Here are some of example schemes:   Double the bits. I.e. when instead of 0110, process plaintext 00111100 with OTP. This'll eat twice as much key material than OTP, but will protect against any single bit errors, and many of other errors, because it is easy to check at the recipient. (If only worrying about integrity.)  Process concatenation of $P$ (plaintext) and $T$ (mac tag) via OTP. There is problem how to calculate $T$. My first idea would be to use some operation on binary Galois Fields $GF(2^n)$, such as multiplication $C * C$ and use OTP to send that "checksum". (Only for integrity, but detects integrity problems with larger probability than option 1.)   Any suggestions how to efficiently calculate $T$? Are there any schemes which would provide usual security without key length $K=2N$? Are some of preconditions incorrect?  For authenticity it would appear that these are valid options:  3. encrypt-then-mac with an information-theoretically secure mac.  4. mac-then-encrypt with an information-theoretically secure mac.  What would be suitable information-theoretically secure mac for implementing alternative 3? Alternative 4 uses more key material than alternative 3. Are there any situations where alternative 4 would be profitable over alternative 3?  Previous Questions About The Field  You could think of this question as sort of add-on question to: ""
114381
Some systems, that operate over flaky bearers, need to send signed, encrypted messages that are entirely self contained - i.e. send a single 300 byte UDP rather than have a 10Kb, two-way, certificate conversation over TCP.  Assume the destination has a private key and already knows the source's public key, and the source has a private key and already knows the destination's public key.  Given this assumption, is there a standard for encrypting/signing a small, but arbitrary length, message?  (I'm well aware of the dangers of rolling my own encryption scheme.)  Would there be a minimum ciphertext size that is related to the public key size?  (I'm thinking plain PKI encryption for plaintexts shorter than the key, and a PKI encrypted AES key for longer plaintexts.)
46470
I quote Bobby's question here since I encountered the same one...    Consider the following protocol for two parties to flip a fair coin.   Trusted party $T$ publishes her public key $K_{pub}$ $A$ chooses a random bit $b_A$, encrypts it under $K_{pub}$, and announces the ciphertext $c_A$ to $B$ and $T$ $B$ does the same and announces a ciphertext $c_B$ (where $c_B \neq c_A$) $T$ decrypts $c_A$ and $c_B$, and announces the results. Both parties $XOR$ the results to obtain the random value $b_A\oplus b_B$.   It was shown that  was not appropriate for the encryption scheme.  seems to fail to work also. Since $c_A=m^e \mod N$. Then if $m=1$, $c=1$. If $B$ receives $A$'s cipher he will know the exact value of $m$.   So what should the appropriate encryption scheme be?
25659
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message.  How can I do this?
98725
Let's say I have an API that accepts Plaintext and IV as input parameter and returns the ciphertext. I know that API is using AES 128 encryption but now I need to identify which encryption mode (ECB, CBC, OFB, CFB, or CTR) it is using. How can I identify the encryption mode? Any suggestion, hint or guidance would be much appreciated. Example: curl &quot;http://dev/api/v1.0/test?iv=00112233445566778899&amp;text=01234567&quot; Response: 7fcb5212d14de7ddcc334ec31acec6ae
41822
I need to generate a 256 bit encryption key described by the adjectives in the title. Currently I intend to create the key using this .  Is this a secure manner of creating the key, given that it has the following properties:   Private key for symmetric encryption Used many times (of course with unique IV's)   And given the following facts:   I will literally just get the RNG to produce 32 random bytes not doing anything with (1) SALT (2) Iterations (3) Anything else   Please note that I am only asking if the key, directly after being generated, is secure. Thanks
50778
I have two very close questions.  Question 1  y = AES-128(x, key). Is it possible that AES-128 will return the same y (encrypted text) for different keys?    I know that each key selects one permutation from the set of (2^128)! possible permutations. We have (2^128) possible keys and it is less than number of possible permutations. But it doesn't mean that there are no two different keys for some pair of text and encrypted text.   Question 2  If we have fixed x,y (both of them have the size of 128 bit) does there exist a key( key size is 128 bit) so that  y = AES-128(x, key) ?  Example. We have 2 bit message and 2 bit key. There are 4 possible messages: msg1 = {0,0}, msg2={0,1}, msg3 = {1,0}, msg4 = {1,1} and there are 4 possible keys. We have 4! = 24 possible permutations of messages. I can select the next permutations  | From\key | key1 | key2 | key3 -------------------------------- | msg1     | msg2 | msg3 | msg4 -------------------------------- | msg2     | msg1 | msg4 | msg3 -------------------------------- | msg3     | msg4 | msg1 | msg2 -------------------------------- | msg4     | msg3 | msg2 | msg1 --------------------------------   Here I have a mapping from a message to every message. e.g. I can get msg4 from msg1 using key3. Has the AES-128 the same property for the mentioned x,y?
106888
A block cipher is a bijective map from the set of possible plaintexts to the set of ciphertexts, which are the same size and might as well be considered the same thing: $\theta: S\to S$. In this there must exist a fixed point m $\in S$ such that $\theta(m) = m$ (alternatively you could consider encryption to be a binary operator acting on the set $S$ then you could write encryption under key $k$ as $m \odot k = m$, with $m,k \in S$. Unfortunately this cannot form a group since there is no unit $e$ that makes $e \odot k = e$ for all $k \in S$).  It is clear that when the block size is equal to the key size a single fixed point will exist when you hold the plaintext message constant and permute the key. The key allows you to select one of all the possible possible unique mappings, of which one must surely be a fixed point (am I right about my use of the word unique here?).  What I don't understand is how a key that is longer than a block size provides any extra security. From what I understand this would suggest the existence of many fixed points, or equivalently many different keys that will decrypt a ciphertext.  Note: I would also be interested to see articles that apply algebra to the study of block ciphers. Specifically constructing groups to aid analysis that also consider the fact that a block cipher is a composition of several round functions.
61728
Is there a length-preserving encryption scheme, that preserves the lengths of input sizes such that the length of the input plain text is same as length of the output cipher text ?
63877
I can't seem to find a nice clean example of using AES 128 bit encryption.  Does anyone have some sample code?
64796
In reading through the original GCM specification (), the composition of the 128 bit Initialization Vector as a concatenation of a 96b nonce and a 32b unsigned wrapping counter seems arbitrary and forces the scrambling pattern to repeat every 232 16-byte block.  Is the algorithm expected to be secure for significantly longer stream lengths if for example the IV were a 128b nonce XORed with a 64b or 128b counter, or are there known cryptanalysis issues that begin to arise?
70632
Gilbert, MacWilliams, and Sloane defined a solution to "perfect integrity" in , unconditionally secure message authentication, not vulnerable to any cryptanalysis on its own even by an adversary with unbounded computational power, provided you have a key chosen uniformly at random the same length as the message. It sounds counter-intuitive that a MAC could have perfect integrity, any hash function can be broken with enough computational power. How does their solution have "perfect integrity"?
23688
What are the main differences between a nonce, a key and an IV? Without any doubt the key should be kept secret. But what about the nonce and the IV? What's the main difference between them and their purposes? Is it only that, in literature and in practice, an IV is being used as "initiator" of a block cipher encryption mode which should be unique? And the same property should hold for a nonce as well, but since it doesn't instantiate something we call it a nonce? I.e: in AES-CTR mode the IV is a nonce+counter. And both are put in plaintext format in the beginning of the ciphertext.
89113
Out of curiosity why we can't implement AES 512 key size?    Please explain somehow i can understand! I'm not an expert.