As I know all arithmetic operations in AES are done over $GF(2^8)$ so I want to know which field generator AES uses? is it 0x11B? and choosing another field generator would it give a different results?
122193
So we've already had a question on . My question is - can we use a different finite field other than the one given by $x^8 + x^4 + x^3 + x + 1$ in $GF(2^8)$. In other words, would any irreducible polynomial over this field do the trick or are the special considerations and properties of that particular reducing polynomial?  If a more general discussion on appropriate fields for cryptographic operations, such as those used in ECC, is necessary, then I'd be happy to hear it. What I'm trying to get to is an understanding of whether there are any important properties in terms of the "randomness" of the operation - for example, are there weak fields to operate over? For example, $x^8 + x^3 + x + 1$ ought to also be irreducible - so would it be suitable? I ask partly because of the  which lead me to think not all fields might hold equal strength. Right? Wrong? Inconsequential?
79318
I am wondering what the complexities are of adding/subtracting and muliplying/dividing numbers in a finite field $\mathbb{F}_q$. I need it to understand an article I am reading.
65405
I tried aes-encryption by using following statement:  SELECT encrypt('test', 'key', 'aes');   which worked, but I am not able to decrypt the value. I inserted it in a field of datatype bytea but I'm not sure if that was the right way.   SELECT decrypt(pw, 'key', 'aes') FROM table WHERE ID = 1;   gives me the error     ERROR:  function decrypt(bytea, unknown, unknown) does not exist   LINE 1: SELECT decrypt(pw, 'key', 'aes') FROM tabelle WHERE ID = 7;                  ^   HINT:  No function matches the given name and argument types. You might need to add explicit type casts.   Does that really mean that encrypt() is an existing function, but not decrypt()? How else could I retreive aes-encrypted values?
47130
I came upon an interesting way to relatively quickly compute modular exponentiation with large numbers. However, I do not fully understand it and was hoping for a better explanation.  The method basically states if you have $x^y \bmod N$, it can be computed by repeatedly multiplying by $x$ modulo $N$:  $$x \bmod N \rightarrow x^2 \bmod N \rightarrow x^4 \bmod N \rightarrow x^8 \bmod N \rightarrow \ldots \rightarrow x^{2[\log y]} \bmod N$$  This is supposed to calculate in $\mathcal{O}(\log_2 N)$ time.  An example is given:  $$x^{25} = x^{11001_2} = x^{10000_2} * x^{1000_2} * x^{1_2} = x^{16} * x^8 * x^1$$  I don't really understand how this is faster. Aren't you just doing the same thing? You're just breaking down the exponents into representations of base $2$. Also where does $x^{2[\log y]}$ come from? If you're breaking it down into exponents of two where does a logarithm come from? (Aren't logs representations of numbers in exponents of $10$?)  I'm sorry if this appears to be a really stupid question - I have minimal knowledge in math.  Also, I wasn't sure if this belongs here or on stack exchange, so give me the word and I'll move it.
18447
I am trying to implement  using additive ElGamal.  I am trying to run the full protocol mentioned in Section 3.4 on the following inputs:   $p = 17$ (prime) $g = 6$ (generator) $x = 5$ (private key) $k = g^x \pmod p = 6^5 \pmod{17} = 7$ (public key)   Suppose the clients inputs are 1, 2. Then $P(x) = (x-1)(x-2) = x^2-3x+2$, and therefore the coeffiecients to encrypt are $(1, -3, 2)$. I chose $y = 10$ and so the encrypted values are:   $1$ becomes $(15,12)$ $-3$ becomes $(15, 1)$ $2$  becomes $(15, 4)$.   The Server Side Input Set $S=\{1\}$ and the random value $r0$ corresponding to $\{1\}$ is $r_0=2$.    With the above problem in context, I have some questions:   What does P 0,j refer to in Step 7. Can you please give an example? In Step 8, suddenly variable i is introduced along with j. What does i, j, refer to? In Step 8, ENC() function has a ; in between. How do we interpret ENC(a;b)?
67242
It's well known that AES cryptography algorithm uses Galois Field $GF(2^8)$ multiplication to process the step MixColumn, and each column of the 4x4 matrix on encrypting should multiply the polynomial $3X^3 + X^2 + X + 2$ which is usually notated as an array $\{\tt 0x03, 0x01, 0x01, 0x02\}$, while on decrypting, the matrix should multiply the inverse of the polynominal mentioned above, namely $\texttt{0x0B}X^3 + \texttt{0x0D}X^2 + \texttt{0x09}X + \texttt{0x0E}$ which can also notated as an array $\{\tt 0x0B, 0x0D, 0x09, 0x0E\}$.  Now I wonder If only one polynomial is known, e.g. $\{\tt 0x03, 0x01, 0x01, 0x02\}$, how can I compute its inverse mod $(X^4 + 1)$, namely $\{\tt 0x0B, 0x0D, 0x09, 0x0E\}$, and vice versa.
33145
For $PT\in \mathbb{M}$ and $CT\in \mathbb{C}$, let $\mathbb{F}=\{f|f:\mathbb{M}\rightarrow\mathbb{C}\}$ be the collection of all functions from $\mathbb{M}$ to $\mathbb{C}$. Then AES encryption under key $k$ is one of these functions, say $f_k$, such that $f_k(PT)=CT$. Then,   Is there any key $k'$ such that $k\neq k'$, but $f_k(PT)=f_{k'}(PT)$? If so then is there any fixed cardinality of such sets of keys?
98927
I have a custom objects which will have user information fields and password fields.  Also i have custom LWC (salesforce site) with Username and password. Password has to store in encrypt  value.   For Password Encryption I'm using Crypto.generateAesKey.  //Data to encrypt Blob data = Blob.valueOf(pwd); //Generate an AES key for the encryption.  Blob cryptoValue = Crypto.generateAesKey(256); //Encrypt the data Blob encryptedData = Crypto.encryptWithManagedIV('AES256', cryptoValue, data); system.debug('encryptedData' + encryptedData ); String encryptedDataText = EncodingUtil.base64Encode(encryptedData);   But the problem is, Each time for the same string I'm getting new encrypted data.  For Ex: String ='123'  First Time encrypted data ==> WFxOkecVPKd/5AKVgHIdQVSVeyTOjbKQ/VrTo/M43+Hg+kSFqB4yycGyfXJptfnP  For the same string I'm getting different encrypted data uZpw7mGyJmBT7d/p0yHsJGYg46SdqrLMJg8BDApNukROz+U/p5QmdwIJQbl9hOm7  Can you please help, what is the Right way to generate and store the encrypted password.
106169
I got the following task:  Let $F = GF(2^6 )$ be K[x] modulo the primitive polynomial $h(x) = 1 +x ^2 +x ^3 +x ^5 +x ^6$ , and let $\alpha$ be the class of x. I have a table with the binary representation of the elements of $GF(2^6 ) = \{0; 1; \alpha^1; \alpha^2 ; ...; \alpha^{62}\}$.  Is there a quicker way to check $\alpha^{52}$ than performing a long division of $x^{52}$ by $h(x)$ ?  It has $2^6$ elements so after $\alpha^{62}$ it will be back to 1 again, but maybe there is some trick to find it faster rather than performing such a long division?  I have also $\alpha^{13}$ so it's $\alpha^{13^4}$, but no idea how to use it
73639
I'm new to field extensions and I can neither see why or how to prove this statement.  If I'm not mistaken, to construct a splitting field, you construct rupture fields one after the other, using that the $8$ element field is the splitting field of $X^8-X$ over $\mathbb F_2$, since $2$ is the only prime divisor of 8.  Over $\mathbb F_2$ $X^8-X$ has two roots : $0$ and $1$. Therefore $X^8-X=X(X-1)(1+X+...+X^6)$. The last factor, call it $P$, has no roots. So let $\alpha$ be a root in some extension $\mathbb F_2(\alpha)$ of $\mathbb F_2$.  We now have $P=(X-\alpha)(X^5+\alpha X^4+...+\alpha^4X+\alpha^5)$.  I suspect $\alpha$ might not be the way to go and if so, my second plan would be to reduce $P$. I don't know how to do this but assuming it to be done, hence having $P=P_1...P_n$, I could start using $P_1$'s rupture field, and then my best guess is that if $\mathbb F_2[X]/(P_1)$ is not sufficient, I re-reduce $P$ over this new field and consider the rupture field of one of the factors, and so on.  Now assuming I wasn't given the statement itself, is it elementary to construct the $8$ element field using $\mathbb F_2$ ?
93383
Both DES and AES use key expansion to generate the round keys (for Feistel network or for the AddRoundKey operation). Each round uses a different key. Why do we need that? Why we cannot use the same key in each round?
44698
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse of $d \bmod \varphi(n)$).  Given a plaintext message $m$, we obtain the ciphertext $c = m^e \bmod n$; we subsequently decrypt the ciphertext by calculating $c^d \bmod n$.  Suppose I'm trying to implement RSA on a device with low computational power, and these exponentiations take too long.  I decide to make my implementation run faster by choosing small values for $e$ and $d$ (e.g. in the tens or hundreds).    Are there efficient attacks against such an implementation?
83379
I would like to construct a field with 729 elements. I know that $729 = 3^6$, and that I have to find an irreducible monic polynomial of degree 6 over $GF(3)$. I chose the polynomial $x^6 + 2x^2 + 1$, which I have verified (computationally) that it is irreducible over this field. However, I do not know how to proceed with the construction. Any hints?   Suppose I hadn't found this polynomial computationally. Is there an algebraic method of finding such polynomials when the degree is quite large? Or, at least testing for irreducibility in such cases?
93628
Read a post on  () about increasing the number of rounds for AES from to "AES-128 at 16 rounds, AES-192 at 20 rounds, and AES-256 at 28 rounds" to raise the security. However, I did wonder where these figures came from. According to Schneier "hey're off the top of my head, and certainly not the last word on the topic", and a previous topic on  "more rounds means more security against cryptanalysis, simply, since there is more confusion and diffusion".  My question is:   Could any high number of rounds do for SPN and Feistel ciphers like AES, Serpent or Twofish? Or would/could the ciphers end up being weaker after a certain X number of rounds? Or maybe even repeat some patterns? How much more secure can AES, Serpent or Twofish become if the     rounds increases? Would AES, for example, be strong as whatnot if     the number of rounds were to be ridiculously increased?
77308
in Rijndael SubBytes() step all bytes of input block are substituted based on a lookup table S-Box. S-Box is initialized by taking all elements of $GF(2^8)$, calculating their multiplicative inverse and then calculating their affine transform. Here is C code which does that as found on wikipedia page. #include &lt;stdint.h&gt;  #define ROTL8(x,shift) ((uint8_t) ((x) &lt;&lt; (shift)) | ((x) &gt;&gt; (8 - (shift))))  void initialize_aes_sbox(uint8_t sbox[256]) {     uint8_t p = 1, q = 1;          /* loop invariant: p * q == 1 in the Galois field */     do {         /* multiply p by 3 */         p = p ^ (p &lt;&lt; 1) ^ (p &amp; 0x80 ? 0x1B : 0);          /* divide q by 3 (equals multiplication by 0xf6) */         q ^= q &lt;&lt; 1;         q ^= q &lt;&lt; 2;         q ^= q &lt;&lt; 4;         q ^= q &amp; 0x80 ? 0x09 : 0;          /* compute the affine transformation */         uint8_t xformed = q ^ ROTL8(q, 1) ^ ROTL8(q, 2) ^ ROTL8(q, 3) ^ ROTL8(q, 4);          sbox[p] = xformed ^ 0x63;     } while (p != 1);      /* 0 is a special case since it has no inverse */     sbox[0] = 0x63; }  I cant wrap my head around how multiplicative inverse is being calculated here. I assume p here acts as input while q is its inverse. Hence $p*q = 1$. I want to understand how exactly this works because I am trying to implement a function that initializes Rijndael inverse S-Box, where first the inverse affine transform is calculated and then the multiplicative inverse.
12430
Let $\mathbb{F}_{27}$ denote the finite field of size 27. For each $\alpha\in\mathbb{F}_{27}$ , define $ A_{\alpha}$ $=$ { $ 1, 1+\alpha , 1+\alpha+{\alpha}^2 , 1+\alpha+{\alpha}^2+{\alpha}^3 , .... $} . Then  prove that  the number of  $\alpha\in\mathbb{F}_{27}$ such that $|A_\alpha|$=26 equals 12.  $ 0\in A_\alpha $ if and only if $\alpha\neq 0$ For the first proof , the multiplicative group of the field $\mathbb{F}_{27}$ is cyclic and its order is 26  , so there are 12 generators in that group.   Now  I need  to  show  that  $ 1+\alpha+{\alpha}^2+.. {\alpha}^{25} $ =0  , where order of $\alpha$=26 . Since   $\alpha ^{26}$ =1 ($\alpha$-1)(1+$\alpha$+${\alpha}^2$+...+${\alpha}^{25}$)=0 , since $\alpha\neq 1$  , So $ 1+\alpha+...+{\alpha}^{25} $ =0 My question is , can I write these last two  lines?  I mean are those two lines alright to write? If those two lines are invalid then I need some help to show  $ 1+\alpha+{\alpha}^2+..+{\alpha}^{25} $=0  .Thanks
62395
From a paper via Schneier on Security's  (emphasis mine):  In the case of AES-128, there is no known attack which is faster than the 2128 complexity of exhaustive search. However, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2176 and 2119 time, respectively. While these complexities are much faster than exhaustive search, they are completely non-practical, and do not seem to pose any real threat to the security of AES-based systems. In this paper we describe several attacks which can break with practical complexity variants of AES-256 whose number of rounds are comparable to that of AES-128.  Is the implication here that AES-192 is stronger than AES-256? If so, in simple terms, how is that possible?  The attack exploits the fact that the key schedule for 256-bit version is pretty lousy -- something we pointed out in our 2000 paper -- but doesn't extend to AES with a 128-bit key.  Again, in simple terms, what does that mean? In practice, does this mean I should drop AES-256 in favor of its 128-bit counterpart, like Schneier recommends in the comments?  That being said, the key schedule for AES-256 is very poor. I would recommend that people use AES-128 and not AES-256.