Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sorry, the question is not easy to state (or wasn't for me, anyhow).

So I'm writing a very flexible format for security. It allows for full choice of cipher, key size, and so on, along with key confirmation and derivation. All of this is communicated in objects with Protocol Buffers serialisation. Now, I get that I need to authenticate the cipher configuration (using Encrypt-then-MAC), but in my protocol, the authentication method itself is highly configurable just like the rest. Is this a situation where I need to NOT provide flexibility, or can I actually NOT "authenticate the authentication"? I would prefer retaining the flexibility, but not at the cost of security.

The high level description of a PayloadItem (the format that defines how to write/read an item to/from the payload) is, with their types:

  • Type (string)
  • Name (string)
  • ExternalLength (long)
  • InternalLength (long)
  • Encryption (SymmetricCipherConfiguration)
  • KeyConfirmation (VerificationFunctionConfiguration)
  • KeyDerivation (VerificationFunctionConfiguration)

And I am thinking of adding EncryptionAuthentication (as a VerificationFunctionConfiguration) ... it seems to me that I cannot authenticate KeyConfirmation or KeyDerivation (I do not have the key at this point, yet, after all), too. Please help me through the security implications of this. I have already thought about the problem a good deal but would like some thoughts from others.

The key confirmation works by accepting a set of possible keys a receiver holds for a sender, and iterating through them, testing for equality with a verified output. The confirmation method is configured by its configuration object, which allows use of a MAC or KDF, with salt.

Similarly the key derivation is configured by its configuration object, allowing a selection of functions.

Is it okay if I just make sure that I do NOT use short-circuiting comparisons?

share|improve this question
    
I recommend that this question is moved to Cryptography SE. –  Polynomial Dec 22 '13 at 2:48
add comment

migrated from security.stackexchange.com Dec 22 '13 at 8:53

This question came from our site for Information security professionals.

1 Answer

up vote 2 down vote accepted

Though a full analysis would require some details and, presumably, a lot of work, guidance can be obtained from what is done in SSL: at the end of the handshake, a verification step occurs with the Finished messages. These messages are protected with the negotiated algorithms and keys (both encryption and MAC) and, crucially, the contents of a Finished message are a one-way hash of all the previously exchanged handshake messages, thus including the cipher negotiation, the server's public key, the key exchange messages... For instance, see this article for some discussion on the subject. The security of the SSL handshake against various types of active attacks relies heavily on the contents of these Finished messages, and (this must not be forgotten) on their mandatory aspect (client and server ought to refuse to send or receive application data until they have sent/received appropriate Finished messages).

With such a verification, a client (or server) implementing SSL will ensure some security level against active attacks on the handshake which should be at least as great as the weakest of the MAC algorithms that the client (or server) accepts to use. Getting beyond that level (i.e. showing a posteriori that a given connection was protected with the strength of the MAC algorithm which was apparently used, regardless of whether some system would have accepted a weaker MAC) can get tricky.

share|improve this answer
    
Sorry I took a while to 'accept' the answer. I did appreciate the time taken. I ended up MACing the encryption configuration (as a protobuf-serialised object byte array) concatenated to the cipher text - so, EtM. While you mistook my question as relating to a network protocol, the type of answer given reminded me that it's all about detecting cipher text changes, so information about the plaintext cannot be leaked out to the attacker. So long as I make sure that doesn't happen (by detecting and discarding), things should be good. (do tell me if I'm wrong about this, of course) –  zenith Dec 30 '13 at 12:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.