3 ms·

Please don't put words into my mouth. The original top level comment was poor and my comment was responding to it, e.g. Armstrong says "AES assumes the data to

Please don't put words into my mouth. The original top level comment was poor and my comment was responding to it, e.g. Armstrong says "AES assumes the data to be encrypted is a multiple of 16 bytes long", which is correct so I don't know why the OP felt the need to say "for the record, the AES algorithm itself does not encrypt arbitrarily sized data" as Armstrong did not claim as such.

mehrdada 11y ago
Yes, I stand by what I said. AES (Rijndael) block cipher operates only on 128-bit blocks, not on data that's divisible by 16-bytes. This is an important distinction. Calling AES used in CTR/CBC/etc. mode without mentioning it at all, "AES" speaks much about the sophistication and cryptographic quality of the guide. That's what I was alluding to.
jsnell 11y ago
The original comment is correct here. AES by itself is indeed just going to encrypt a single block of 128/192/256 bits. To encrypt a plaintext longer than that, you need to apply the cipher repeatedly on subsequent blocks. The exact mode in which that's done is important. For example in this case the code uses the CBC mode (a fact not mentioned anywhere in the document). CBC has the funny property that flipping bit X in cipherblock N will flip bit X in plaintext block N+1 (while completely scrambling plaintext block N). This is a very exploitable property. Which is why the standard advice would be that you always need to authenticate, not just encrypt. (E.g. encrypt-then-mac). But of course this document doesn't give even this most basic of crypto recommendations. Which endangers anyone who reads it and thinks they learned something.
- mehrdada 11y ago
  nit: all AES variants are 128-bit block ciphers, i.e. they transform 128-bit data blocks. AES-192 and AES-256 take 192-bit and 256-bit keys but still operate on 128-bit blocks. (Rijndael itself supports varying block sizes, but the AES standard has only adopted the 128-bit version.)
  - jsnell 11y ago
    You're of course correct, thanks. This is exactly why no one but an expert should say anything at all about crypto. It'll always be wrong somehow :-P

mehrdada 11y ago

Yes, I stand by what I said. AES (Rijndael) block cipher operates only on 128-bit blocks, not on data that's divisible by 16-bytes. This is an important distinction. Calling AES used in CTR/CBC/etc. mode without mentioning it at all, "AES" speaks much about the sophistication and cryptographic quality of the guide. That's what I was alluding to.

jsnell 11y ago

The original comment is correct here. AES by itself is indeed just going to encrypt a single block of 128/192/256 bits. To encrypt a plaintext longer than that, you need to apply the cipher repeatedly on subsequent blocks. The exact mode in which that's done is important. For example in this case the code uses the CBC mode (a fact not mentioned anywhere in the document). CBC has the funny property that flipping bit X in cipherblock N will flip bit X in plaintext block N+1 (while completely scrambling plaintext block N). This is a very exploitable property. Which is why the standard advice would be that you always need to authenticate, not just encrypt. (E.g. encrypt-then-mac). But of course this document doesn't give even this most basic of crypto recommendations. Which endangers anyone who reads it and thinks they learned something.

mehrdada 11y ago
nit: all AES variants are 128-bit block ciphers, i.e. they transform 128-bit data blocks. AES-192 and AES-256 take 192-bit and 256-bit keys but still operate on 128-bit blocks. (Rijndael itself supports varying block sizes, but the AES standard has only adopted the 128-bit version.)
- jsnell 11y ago
  You're of course correct, thanks. This is exactly why no one but an expert should say anything at all about crypto. It'll always be wrong somehow :-P