The Differences Between Rijndael and AES

re: The Differences Between Rijndael and AES

Peter Ritchie — Tue, 10 Oct 2006 23:02:27 GMT

You block size for AES-256 in your table should be 128 not 228. Feel free to delete this if it no longer applies...

re: The Differences Between Rijndael and AES

shawnfa — Wed, 11 Oct 2006 00:01:29 GMT

Yep, stupid typoo. Thanks, I've fixed it now!

-Shawn

re: The Differences Between Rijndael and AES (FIPS compliance?)

David — Fri, 13 Oct 2006 21:04:40 GMT

Hi,

I'm curious, why doesn't Rijndael work when the system cryptography FIPS compliance security setting is enabled?

Since it's the successor to DES, and since FIPS 197 is the official standard for it, I guess I kind of expected it to work.

Has it just not yet been through compliance testing, or is there some reason that it will never be compliant?

David

re: The Differences Between Rijndael and AES

shawnfa — Sat, 14 Oct 2006 00:11:37 GMT

Hi David,

You hit the nail on the head -- the reason that RijndaelManaged doesn't work in FIPS mode is that it has not been certified.

That being said, we have heard the feedback to provide an AES algorithm which will work when FIPS is turned on, so we are looking at that for our next release.

-Shawn

re: The Differences Between Rijndael and AES

christian — Fri, 12 Jan 2007 05:36:13 GMT

Sorry AES crypto ignorant question here.

What about cipher mode and initialization vector?

As you said above like most people I just got RijnDaelManaged and went, when I got the request to encrypt using AES. Wouldn't you need to agree on a cipher mode and exchange init vectors with the deciphering party, in addition to exchanging keys?

Or is CBC what people use when they say AES?

And initVector is not used, or rather all 0?

Thanks

New Crypto Algorithms in Orcas

.Net Security Blog — Wed, 17 Jan 2007 21:21:11 GMT

The January CTP of Orcas is now available , and with it comes a total of 12 new cryptography algorithm

re: The Differences Between Rijndael and AES

shawnfa — Wed, 17 Jan 2007 21:35:47 GMT

Hi Christian,

You're correct that both sides of the encrypted conversation will need to agree on all of the parameters to successfully communicate. AES does not restrict either IV or the cipher mode, however as I mention in the blog post there is a bug in RijndaelManaged which makes CFB and OFB dangerous to use if you need to work with AES. In practice most people just default to CBC.

As for the IV, that's not technically protected information, so one practice is to just send it in plaintext before the beginning of the encrypted conversation.

-Shawn

re: The Differences Between Rijndael and AES

Matt — Thu, 22 Mar 2007 21:58:43 GMT

Is it cryptographically dangerous to simply agree that the IV will be the first (or last) 128 bits of the key? (Is the answer the same for all key sizes?)

I'm thinking there are plenty of other things that need to be agreed upon (mode, feedback, padding, block size, etc) so why not the IV too?

re: The Differences Between Rijndael and AES

shawnfa — Thu, 29 Mar 2007 20:26:17 GMT

Hi Matt,

Generally the IV is not considered a secret, so saying that part of the key is the IV would not be a good idea (since the IV could be transmitted in plain-text, which means that the first portion of your key would be known to attackers). Instead, you can just generate a random IV and send it to the other party to use along with the ciphertext.

-Shawn

re: The Differences Between Rijndael and AES

P Dawson, Doncaster, United Kingdom — Tue, 24 Apr 2007 12:31:09 GMT

The best solution is to encrypt IV with a perminent (persistent) key previously agreed with the other party, so that only you (plural) know how to decode it. cf. The enigma machine during WWII which had day settings (keys)preknown and the message keys which were encrypted using the day keys.

In CBC the PT is XORed with the previous CT, thus ensuring that any changes made to the CT stream will propagate in the decrypted PT.

However, this otherwise gives no better security than ECB except for the matter that no repetitions of PT (and CT) can appear.