Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COSC362 > Lecture 8: Block Cipher Modes of Operation (features, standards, confidentiality modes, ECB, CBC, CTR, CMAC, HMAC) > Flashcards

Lecture 8: Block Cipher Modes of Operation (features, standards, confidentiality modes, ECB, CBC, CTR, CMAC, HMAC) Flashcards

1
Q

What type of blocks of data do block ciphers encrypt?

A

Single

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Is breaking plaintext into blocks and encrypting each separately secure or insecure?

A

insecure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why do block ciphers have different modes of operation?

A

Different modes have different efficiency and communication properties → trade-off between security and efficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the general reason that different modes were designed?

A

Designed to provide confidentiality and/or authentication (and integrity)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What do all modes that provided confidentiality include?

A

randomisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the problem with having the same plaintext is encrypted to same ciphertext every time?

A

allowing patterns to be found in long ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can we prevent the following problem?

same plaintext is encrypted to same ciphertext every time

A

use randomise encryption schemes

OR

vary encryption by including variable state which is updated with each block → update state each time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is used in randomised encryption schemes?

A
  1. Using initialization vector V which propagates through entire ciphertext
  2. IV may be random or unique
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What impact efficiency for practical usage?

A

Parallel processing and error propagation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain parallel processing

A

multiple plaintext blocks encrypted in parallel, multiple ciphertext blocks are decrypted in parallel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Explain error propagation

A

bit error occurs in ciphertext results in multiple bit errors in plaintext after decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When is padding used?

A

When requiring plaintext to consist of complete blocks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is NIST’s suggestion for padding?

A

1) append ‘1’ bit to data string, 2) pad resulting string by as few ‘0’ bits to complete block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Explain what is meant by “padding bits remove ambiguity if known”

A

1) removing all trailing ‘0’ after last ‘1’ bit, 2) remove ‘1’ bit

Small probability of getting wrong → ½ chance per bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the notation for the plaintext message i.t.o modes?

A

Plaintext message P (n blocks in length)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the notation for the t-th plaintext block i.t.o modes?

A

Pt, for 1 <= t <= n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the notation for the ciphertext message i.t.o modes?

A

C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the notiation for the T-th ciphertext block i.t.o modes?

A

Ct, for 1 <= t <= n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the notation for the key i.t.o modes?

A

K

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the notation for the initialisation vector i.t.o modes?

A

V

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can any mode apply to any block cipher?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does ECB mode stand for?

A

Electronic code block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the formula for ECD mode’s encryption? What does it imply?

A

Ct = E(Pt ,K)

Implies that ECD mode is a basic mode for block ciphers as there is no chaining.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the decryption formula for ECB mode?

A

Pt = D(Ct,K)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Give the diagram for ECB encryption

A

see slides –> add to cheat sheet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Give the diagram for ECB decryption

A

see slides –> add to cheat sheet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Briefly explain ECB mode encryption

A

Plaintext block Pt encrypted with key K to produce ciphertext block Ct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Briefly explain ECB mode decryption

A

Ciphertext block Ct decrypted with key K to produce plaintext block Pt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Is ECD mode randomised?

A

no

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Is padding required for ECD mode?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Comment on the error propagation for ECD mode.

A

Errors propagate within blocks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Does ECB mode have an IV?

A

no

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Is parallel encryption or decryption possible for ECB mode? Why?

A

Both possible since no chaining for either encryption or decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Is ECB mode deterministic? What does this imply?

A

Yes

Not normally used for bulk encryption since deterministic encryption schemes always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Is ECB a confidentiality or authentication mode?

A

confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Is CBC a confidentiality or authentication mode?

A

confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Is CTR a confidentiality or authentication mode?

A

confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Is MAC a confidentiality or authentication mode?

A

authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Is CDC-MAC a confidentiality or authentication mode?

A

authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Is CMAC a confidentiality or authentication mode?

A

authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Are blocks chained together in CBC mode encryption?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the formula for determining Ct in CBC mode encryption?

A

Ct = E(Pt ⊕ Ct-1, K) s.t. C0 = IV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What role does IV play in CBC mode encryption?

A

IV chosen randomly and sent with ciphertext blocks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Briefly outline CBC mode encryption

A

Pt XORed with previous ciphertext block Ct-1 and encrypted with key K to produce Ct

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Give the diagram for CBC mode encryption

A

see slides –> add to cheat sheet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is the formula for determining Pt in CBC mode decryption

A

Pt = D(Ct,K) ⊕ Ct-1 s.t. C0 = IV

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Briefly outline CBC mode decryption

A

Ct decrypted with key K and XORed with previous ciphertext block Ct-1 to produce Pt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Give the diagram for CBC mode decryption

A

see slides –> add to cheat sheet

49
Q

Discuss error propagation in CBC mode decryption

A

Two blocks affected with 1 bit error → block itself and next plaintext block

50
Q

Give the diagram for CBC mode decryption’s error propagation

A

see slides –> add to cheat sheet

51
Q

Is CBC mode randomised?

A

no

52
Q

Is padding required for CBC mode?

A

yes

53
Q

Comment on the error propagation for CBC mode

A

Errors propagate within blocks and into specific bits of next block

54
Q

Comment on the IV for CBC mode

A

IV must be random

55
Q

Is parallel encryption possible for CBC mode? What does this mean?

A

no, have to wait for previous output

CBC used for bulk encryption

56
Q

Is parallel decryption possible for CBC mode?

A

yes, don’t have to wait for previous output

57
Q

What sort of mode is CTR?

A

a synchronous stream cipher mode

58
Q

What does CTR in CTR mode stand for?

A

counter

59
Q

What additional things does CTR mode need?

A

Counter and nounce used, initialized using randomly chosen value N

60
Q

What is Tt in CTR mode?

A

Tt = N || t → concatenation of nonce N and block t

61
Q

What is the formula for Ot?

A

Ot = E(Tt,K)

62
Q

Comment on the propagation of channel errors in CTR mode

A

one-bit change in ciphertext produces a one bit change in plaintext at same location

63
Q

What is the formula for encryption for CTR mode?

A

Ct = Ot ⊕ Pt

64
Q

Briefly outline CTR mode encryption

A

Plaintext block Pt XORed with Ot

65
Q

Give the diagram for CTR mode encryption

A

see slides –> add to cheat sheet

66
Q

Give the diagram for CTR mode decryption

A

see slides –> add to cheat sheet

67
Q

What is the formula for decryption for CTR mode?

A

Pt = Ot ⊕ Ct

68
Q

Briefly outline CTR mode decryption

A

Ciphertext block Ct XORed with Ot

69
Q

Is CTR mode randomised?

A

yes

70
Q

Does CTR mode require padding?

A

No, empty is fine at end since same length (fixed)

71
Q

Comment on error propagation in CTR mode

A

Errors occur in specific bits of current block

72
Q

Does CTR mode use an IV?

A

yes

73
Q

Does the nonce have to be unique for IV for CTR mode?

A

yes

74
Q

Can CTR mode do parallel encryption?

A

Yes since no chaining

75
Q

Can CTR mode do parallel decryption?

A

Yes since no chaining

76
Q

What is CTR mode good for?

A

access to specific plaintext blocks without decrypting whole stream

77
Q

What is message integrity?

A

Ensuring messages are not altered in transmission

78
Q

Should we treat message integrity and message authentication differently or as the same?

A

the same

79
Q

What does message integrity prevent?

A

adversary from reordering, replacing, replicating and deleting message blocks to alter received message

80
Q

Is providing message integrity independent from using encryption for confidentiality?

A

yes, independent

81
Q

What does MAC stand for?

A

Message Authentication Code

82
Q

Briefly outline the purpose of MAC

A

Cryptographic mechanism to ensure message integrity

83
Q

What it T i.t.o MAC?

A

A MAC tag

84
Q

How do we calculate T for MAC?

A

T = MAC(M,K)

Inputs → arbitrarily-length message M and secret key K

Output → short fixed-length tag T

85
Q

I.t.o MAC, do Alice and Bob share a common key K?

A

yes

86
Q

Explain the process of Alice sending a message M to Bob using MAC

A

Alice computers T = MAC(M,K)

Alice sends message M and adjoins its tag T

Bob computes T’ = MAC(M’, K) on received message M’ and checks that T’ = T

87
Q

What does MAC provide?

A

sender authentication to message

88
Q

Who can produce T from M i.t.o MAC?

A

Only Alice and Bob

89
Q

If T’=T, what does Bob know i.t.o MAC?

A

message received was sent by Alice and not modified in transit

90
Q

If T ≠ T, what does Bob know?

A

(M’,T) not sent by Alice

91
Q

What is unforgeability i.t.o MAC?

A

Basic security property

infeasible to produce M and T s.t. T = MAC(M,K) without knowing K

92
Q

Briefly outline basic CDC-MAC

A

Using block cipher to create MAC providing message integrity (but not confidentiality)

93
Q

Comment on IV for basic CDC-MAC

A

IV must be fixed and public and can set to all zeros

CBC-MAC without IV is not secure!

94
Q

What is P i.t.o basic CDC-MAC?

A

message with n blocks

95
Q

What is the formula for T i.t.o basic CDC-MAC?

A

T = CBC-MAC(P,K)

96
Q

What is the formula for Ct i.t.o basic CDC-MAC?

A

Ct = E(Pt ⊕ Ct-1, K) for 1 <= t <= n s.t. C0 = IV

97
Q

What is the formula for T i.t.o basic CDC-MAC?

A

T = Cn

98
Q

Is T Unforgeable for basic CDC-MAC?

A

Yes, provided message length fixed

99
Q

What is Cipher-based MAC (CMAC) a standardised version of?

A

NIST secure version of CBC-MAC

100
Q

Explain the CMAC process

A

2 keys K1, K2 derived from original key K

K1 or K2 XORed with Mn (padding as needed)

IV set to all 0 block

CBC encryption on message M

101
Q

What is T i.t.o CMAC?

A

T = some number of MSB bits of final block

102
Q

Give the diagram for computing T i.t.o CMAC?

A

see slides –> add to cheat sheet

103
Q

What does the NIST standard of CMAC allow for? Why?

A

any number of |T| chosen for tag T → recommended 64 bits to avoid guessing

104
Q

What does the NIST standard of CMAC require the length of tag T to be?

A

at least length of log2(lim/R) with:

1) lim → limit on how many invalid messages detected before K changed
2) R → acceptable probability (risk) that false message is accepted

105
Q

What are the two types of input data for authentication encryption mode?

A

1) payload → both encrypted and authenticated

2) associated data → only authenticated

106
Q

What are the two modes specified for authentication encryption mode?

A

1) NIST 2004 for Counter with CBC-MAC (CCM) Mode

2) NIST 2007 for Galois/Counter (GCM) Mode

107
Q

What modes do CCM and GCM modes both use? Do they add integrity in the same way?

A

Both use CTR mode for confidentiality but add integrity differently

108
Q

What versions of TLS are CCM and GCM modes used in?

A

Both used in TLS 1.2 and 1.3

109
Q

Briefly outline CCM

A

Combining CBC-MAC for authentication of ALL data (payload and associated data) and CTR mode encryption for payload

110
Q

What does CCM in CCM mode stand for?

A

Counter with CBC-MAC Mode

111
Q

What are the inputs for CCM?

A

Inputs → nonce N for CTR mode, payload P of |P| bits and associated data A

112
Q

I.t.o CCM, what are formated to produce block sets?

A

N, A, P

113
Q

What sort of tag is computed for CCM and what are the length of the blocks they correspond to?

A

Compute CBC-MAC tag T for blocks with length Tlen

114
Q

What mode is used to compete blocks of key stream S0, S1, … , Sm?

A

CTR mode

115
Q

What is m in the key stream S0, S1, … , Sm for CCM mode?

A

m = [Plen/128]

P is plaintext

116
Q

What are the outputs of CCM mode?

A

C = (P ⊕ MSBPlen(S))||(T ⊕ MSBTlen(S0)) where S = S1, …, Sm

117
Q

Briefly outline the CCM mode format

A

Complex format with restrictions w.r.t. different standards

Length of N, P include in 1st block

118
Q

What happens if A is non-zero for the CCM mode format?

A

formatted from 2nd block onwards including its length

119
Q

What is the size of tag T, the nonce N and the max payload size for TLS 1.2?

A

tag T is 8 bytes, CTR mode nonce N is 12 octets, max payload size is 2^(24 - 1) bytes

COSC362 (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions