Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

COSC362 > Lecture 8: Block Cipher Modes of Operation (features, standards, confidentiality modes, ECB, CBC, CTR, CMAC, HMAC) > Flashcards

Lecture 8: Block Cipher Modes of Operation (features, standards, confidentiality modes, ECB, CBC, CTR, CMAC, HMAC) Flashcards

1
Q

What type of blocks of data do block ciphers encrypt?

A

Single

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Is breaking plaintext into blocks and encrypting each separately secure or insecure?

A

insecure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why do block ciphers have different modes of operation?

A

Different modes have different efficiency and communication properties → trade-off between security and efficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the general reason that different modes were designed?

A

Designed to provide confidentiality and/or authentication (and integrity)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What do all modes that provided confidentiality include?

A

randomisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the problem with having the same plaintext is encrypted to same ciphertext every time?

A

allowing patterns to be found in long ciphertext

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can we prevent the following problem?

same plaintext is encrypted to same ciphertext every time

A

use randomise encryption schemes

OR

vary encryption by including variable state which is updated with each block → update state each time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is used in randomised encryption schemes?

A
  1. Using initialization vector V which propagates through entire ciphertext
  2. IV may be random or unique
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What impact efficiency for practical usage?

A

Parallel processing and error propagation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain parallel processing

A

multiple plaintext blocks encrypted in parallel, multiple ciphertext blocks are decrypted in parallel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Explain error propagation

A

bit error occurs in ciphertext results in multiple bit errors in plaintext after decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

When is padding used?

A

When requiring plaintext to consist of complete blocks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is NIST’s suggestion for padding?

A

1) append ‘1’ bit to data string, 2) pad resulting string by as few ‘0’ bits to complete block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Explain what is meant by “padding bits remove ambiguity if known”

A

1) removing all trailing ‘0’ after last ‘1’ bit, 2) remove ‘1’ bit

Small probability of getting wrong → ½ chance per bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the notation for the plaintext message i.t.o modes?

A

Plaintext message P (n blocks in length)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the notation for the t-th plaintext block i.t.o modes?

A

Pt, for 1 <= t <= n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the notation for the ciphertext message i.t.o modes?

A

C

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the notiation for the T-th ciphertext block i.t.o modes?

A

Ct, for 1 <= t <= n

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the notation for the key i.t.o modes?

A

K

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the notation for the initialisation vector i.t.o modes?

A

V

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can any mode apply to any block cipher?

A

yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does ECB mode stand for?

A

Electronic code block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the formula for ECD mode’s encryption? What does it imply?

A

Ct = E(Pt ,K)

Implies that ECD mode is a basic mode for block ciphers as there is no chaining.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the decryption formula for ECB mode?

A

Pt = D(Ct,K)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Give the diagram for ECB encryption
see slides --> add to cheat sheet
26
Give the diagram for ECB decryption
see slides --> add to cheat sheet
27
Briefly explain ECB mode encryption
Plaintext block Pt encrypted with key K to produce ciphertext block Ct
28
Briefly explain ECB mode decryption
Ciphertext block Ct decrypted with key K to produce plaintext block Pt
29
Is ECD mode randomised?
no
30
Is padding required for ECD mode?
yes
31
Comment on the error propagation for ECD mode.
Errors propagate within blocks
32
Does ECB mode have an IV?
no
33
Is parallel encryption or decryption possible for ECB mode? Why?
Both possible since no chaining for either encryption or decryption
34
Is ECB mode deterministic? What does this imply?
Yes Not normally used for bulk encryption since deterministic encryption schemes always produces the same ciphertext for a given plaintext and key, even over separate executions of the encryption algorithm
35
Is ECB a confidentiality or authentication mode?
confidentiality
36
Is CBC a confidentiality or authentication mode?
confidentiality
37
Is CTR a confidentiality or authentication mode?
confidentiality
38
Is MAC a confidentiality or authentication mode?
authentication
39
Is CDC-MAC a confidentiality or authentication mode?
authentication
40
Is CMAC a confidentiality or authentication mode?
authentication
41
Are blocks chained together in CBC mode encryption?
yes
42
What is the formula for determining Ct in CBC mode encryption?
Ct = E(Pt ⊕ Ct-1, K) s.t. C0 = IV
43
What role does IV play in CBC mode encryption?
IV chosen randomly and sent with ciphertext blocks
44
Briefly outline CBC mode encryption
Pt XORed with previous ciphertext block Ct-1 and encrypted with key K to produce Ct
45
Give the diagram for CBC mode encryption
see slides --> add to cheat sheet
46
What is the formula for determining Pt in CBC mode decryption
Pt = D(Ct,K) ⊕ Ct-1 s.t. C0 = IV
47
Briefly outline CBC mode decryption
Ct decrypted with key K and XORed with previous ciphertext block Ct-1 to produce Pt
48
Give the diagram for CBC mode decryption
see slides --> add to cheat sheet
49
Discuss error propagation in CBC mode decryption
Two blocks affected with 1 bit error → block itself and next plaintext block
50
Give the diagram for CBC mode decryption's error propagation
see slides --> add to cheat sheet
51
Is CBC mode randomised?
no
52
Is padding required for CBC mode?
yes
53
Comment on the error propagation for CBC mode
Errors propagate within blocks and into specific bits of next block
54
Comment on the IV for CBC mode
IV must be random
55
Is parallel encryption possible for CBC mode? What does this mean?
no, have to wait for previous output CBC used for bulk encryption
56
Is parallel decryption possible for CBC mode?
yes, don’t have to wait for previous output
57
What sort of mode is CTR?
a synchronous stream cipher mode
58
What does CTR in CTR mode stand for?
counter
59
What additional things does CTR mode need?
Counter and nounce used, initialized using randomly chosen value N
60
What is Tt in CTR mode?
Tt = N || t → concatenation of nonce N and block t
61
What is the formula for Ot?
Ot = E(Tt,K)
62
Comment on the propagation of channel errors in CTR mode
one-bit change in ciphertext produces a one bit change in plaintext at same location
63
What is the formula for encryption for CTR mode?
Ct = Ot ⊕ Pt
64
Briefly outline CTR mode encryption
Plaintext block Pt XORed with Ot
65
Give the diagram for CTR mode encryption
see slides --> add to cheat sheet
66
Give the diagram for CTR mode decryption
see slides --> add to cheat sheet
67
What is the formula for decryption for CTR mode?
Pt = Ot ⊕ Ct
68
Briefly outline CTR mode decryption
Ciphertext block Ct XORed with Ot
69
Is CTR mode randomised?
yes
70
Does CTR mode require padding?
No, empty is fine at end since same length (fixed)
71
Comment on error propagation in CTR mode
Errors occur in specific bits of current block
72
Does CTR mode use an IV?
yes
73
Does the nonce have to be unique for IV for CTR mode?
yes
74
Can CTR mode do parallel encryption?
Yes since no chaining
75
Can CTR mode do parallel decryption?
Yes since no chaining
76
What is CTR mode good for?
access to specific plaintext blocks without decrypting whole stream
77
What is message integrity?
Ensuring messages are not altered in transmission
78
Should we treat message integrity and message authentication differently or as the same?
the same
79
What does message integrity prevent?
adversary from reordering, replacing, replicating and deleting message blocks to alter received message
80
Is providing message integrity independent from using encryption for confidentiality?
yes, independent
81
What does MAC stand for?
Message Authentication Code
82
Briefly outline the purpose of MAC
Cryptographic mechanism to ensure message integrity
83
What it T i.t.o MAC?
A MAC tag
84
How do we calculate T for MAC?
T = MAC(M,K) Inputs → arbitrarily-length message M and secret key K Output → short fixed-length tag T
85
I.t.o MAC, do Alice and Bob share a common key K?
yes
86
Explain the process of Alice sending a message M to Bob using MAC
Alice computers T = MAC(M,K) Alice sends message M and adjoins its tag T Bob computes T’ = MAC(M’, K) on received message M’ and checks that T’ = T
87
What does MAC provide?
sender authentication to message
88
Who can produce T from M i.t.o MAC?
Only Alice and Bob
89
If T’=T, what does Bob know i.t.o MAC?
message received was sent by Alice and not modified in transit
90
If T ≠ T, what does Bob know?
(M’,T) not sent by Alice
91
What is unforgeability i.t.o MAC?
Basic security property infeasible to produce M and T s.t. T = MAC(M,K) without knowing K
92
Briefly outline basic CDC-MAC
Using block cipher to create MAC providing message integrity (but not confidentiality)
93
Comment on IV for basic CDC-MAC
IV must be fixed and public and can set to all zeros CBC-MAC without IV is not secure!
94
What is P i.t.o basic CDC-MAC?
message with n blocks
95
What is the formula for T i.t.o basic CDC-MAC?
T = CBC-MAC(P,K)
96
What is the formula for Ct i.t.o basic CDC-MAC?
Ct = E(Pt ⊕ Ct-1, K) for 1 <= t <= n s.t. C0 = IV
97
What is the formula for T i.t.o basic CDC-MAC?
T = Cn
98
Is T Unforgeable for basic CDC-MAC?
Yes, provided message length fixed
99
What is Cipher-based MAC (CMAC) a standardised version of?
NIST secure version of CBC-MAC
100
Explain the CMAC process
2 keys K1, K2 derived from original key K K1 or K2 XORed with Mn (padding as needed) IV set to all 0 block CBC encryption on message M
101
What is T i.t.o CMAC?
T = some number of MSB bits of final block
102
Give the diagram for computing T i.t.o CMAC?
see slides --> add to cheat sheet
103
What does the NIST standard of CMAC allow for? Why?
any number of |T| chosen for tag T → recommended 64 bits to avoid guessing
104
What does the NIST standard of CMAC require the length of tag T to be?
at least length of log2(lim/R) with: 1) lim → limit on how many invalid messages detected before K changed 2) R → acceptable probability (risk) that false message is accepted
105
What are the two types of input data for authentication encryption mode?
1) payload → both encrypted and authenticated | 2) associated data → only authenticated
106
What are the two modes specified for authentication encryption mode?
1) NIST 2004 for Counter with CBC-MAC (CCM) Mode | 2) NIST 2007 for Galois/Counter (GCM) Mode
107
What modes do CCM and GCM modes both use? Do they add integrity in the same way?
Both use CTR mode for confidentiality but add integrity differently
108
What versions of TLS are CCM and GCM modes used in?
Both used in TLS 1.2 and 1.3
109
Briefly outline CCM
Combining CBC-MAC for authentication of ALL data (payload and associated data) and CTR mode encryption for payload
110
What does CCM in CCM mode stand for?
Counter with CBC-MAC Mode
111
What are the inputs for CCM?
Inputs → nonce N for CTR mode, payload P of |P| bits and associated data A
112
I.t.o CCM, what are formated to produce block sets?
N, A, P
113
What sort of tag is computed for CCM and what are the length of the blocks they correspond to?
Compute CBC-MAC tag T for blocks with length Tlen
114
What mode is used to compete blocks of key stream S0, S1, … , Sm?
CTR mode
115
What is m in the key stream S0, S1, … , Sm for CCM mode?
m = [Plen/128] | P is plaintext
116
What are the outputs of CCM mode?
C = (P ⊕ MSBPlen(S))||(T ⊕ MSBTlen(S0)) where S = S1, …, Sm
117
Briefly outline the CCM mode format
Complex format with restrictions w.r.t. different standards Length of N, P include in 1st block
118
What happens if A is non-zero for the CCM mode format?
formatted from 2nd block onwards including its length
119
What is the size of tag T, the nonce N and the max payload size for TLS 1.2?
tag T is 8 bytes, CTR mode nonce N is 12 octets, max payload size is 2^(24 - 1) bytes

COSC362 (21 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions