3 ms·

Have you (or any of your colleagues) studied Rijndael-256? I'd be interested in seeing your analyses and conclusions if you have.

tptacek 11y ago
Studied in what sense? It's one of the best studied block ciphers in the world. I wouldn't go out of my way to use it, but I flinched a little when this report suggested its use was a vulnerability. I don't think 32 byte blocks are much better than 16 byte blocks, but 16 byte blocks are much, much better than 8 byte blocks, and so I feel like I should be consistent.
- earthrise 11y ago
  I usually consider this a "vulnerability" in the sense that the author probably intended to use AES and so they may have misunderstood the mcrypt API. Most importantly, they might have wanted AES-256 and missed the fact that mcrypt selects the key size based on the size of key you give it. That does not appear to be the case this time, however, since the page acknowledges (in an update) "256 bit block" and the fact that it isn't AES. So I should probably make note of that in the CryptoFails post. I'm unsure how well the analysis of AES (and the attacks against it) carry over to Rijndael-256, so I'd be hesitant to actually recommend it without asking a cryptographer... but, like you, I'd be very surprised if it was a source of vulnerability itself.
  - tptacek 11y ago
    I wouldn't actively recommend it. I would worry if someone was using Rijndael-128/256 to make a hash function. But apart from that: the gain in reduced malleability probably offsets any reduced security margin; in other words, using a larger block makes the realistic attacks somewhat harder. There are probably zero crypto implementations that that contain the string "AES" that use Rijndael-X/256 that aren't broken in some other comical way.
- deleted 11y ago
  [deleted]
- sarciszewski 11y ago
  > Studied in what sense? It's one of the best studied block ciphers in the world. Are all the studies on the 128-bit block variant of Rijndael (the one christened as AES) also applicable to the 256-bit block variant? I don't know the answer to this question.

tptacek 11y ago

Studied in what sense? It's one of the best studied block ciphers in the world. I wouldn't go out of my way to use it, but I flinched a little when this report suggested its use was a vulnerability. I don't think 32 byte blocks are much better than 16 byte blocks, but 16 byte blocks are much, much better than 8 byte blocks, and so I feel like I should be consistent.

earthrise 11y ago
I usually consider this a "vulnerability" in the sense that the author probably intended to use AES and so they may have misunderstood the mcrypt API. Most importantly, they might have wanted AES-256 and missed the fact that mcrypt selects the key size based on the size of key you give it. That does not appear to be the case this time, however, since the page acknowledges (in an update) "256 bit block" and the fact that it isn't AES. So I should probably make note of that in the CryptoFails post. I'm unsure how well the analysis of AES (and the attacks against it) carry over to Rijndael-256, so I'd be hesitant to actually recommend it without asking a cryptographer... but, like you, I'd be very surprised if it was a source of vulnerability itself.
- tptacek 11y ago
  I wouldn't actively recommend it. I would worry if someone was using Rijndael-128/256 to make a hash function. But apart from that: the gain in reduced malleability probably offsets any reduced security margin; in other words, using a larger block makes the realistic attacks somewhat harder. There are probably zero crypto implementations that that contain the string "AES" that use Rijndael-X/256 that aren't broken in some other comical way.
deleted 11y ago
[deleted]
sarciszewski 11y ago
> Studied in what sense? It's one of the best studied block ciphers in the world. Are all the studies on the 128-bit block variant of Rijndael (the one christened as AES) also applicable to the 256-bit block variant? I don't know the answer to this question.