Do in all the use cases, if I have to encrypt and authenticate, encrypt-then-authenticate or authenticate-then-encrypt, like in IPSEC, SSL or SSH or others, if I were to do these operations to a packet, do I always know that the cipher offset will be greater than authentication offset i.e that authentication length will always be greater or equal to cipher length. For example in IPSEC, we add an esp header and trailer, we need to start encrypting after ESP but need to authenticate starting from ESP.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
When we have regions of the packet that we only authenticate but not encrypt, that happens because we have data that we want to bind to the encrypted region, but we don't need to include within the encrypted region. Examples of this are:
Now, the question is: does the opposite make sense? Do we ever have a case where we care about the privacy of a field (so we need to encrypt it), but we don't care about its integrity (so if someone changes it, we don't really care)?
Personally, I'm having problems thinking of a scenario where this makes sense; if we have an encrypted region, one would expect that we do authentication over that entire region, and not pick and choose.
I also can't think of a protocol which attempts to take advantage of that (other than protocols which don't do integrity checking on anything - we try to discourage that, but they do exist).