0
$\begingroup$

Is it okay to bail out early when length mismatch is detected?

Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong amount of associated data is given?

As I understand it, these two are generally public quantities, and so this does not result in a timing attack.

$\endgroup$
4
  • $\begingroup$ What is your threat model against which you want to determine if bailing out early is okay? $\endgroup$
    – Cort Ammon
    Feb 23, 2016 at 2:44
  • $\begingroup$ "Is it okay to" reveal "when length mismatch is detected?" ​ ​ $\endgroup$
    – user991
    Feb 23, 2016 at 5:55
  • $\begingroup$ Most AEAD ciphers do not check the length, because there is no recorded length in the ciphertext $\endgroup$ Feb 23, 2016 at 7:10
  • $\begingroup$ Moreover: how do you know that you have the wrong length? It sounds like you have some external functionality (packet sizes?) around the outside of your AEAD system that tells you what size the content should be. As Richie says, most AEAD schemes do not require an explicit length parameter -- they work it out from the size of their inputs -- so as far as AEAD is concerned there isn't really a concept of 'length mismatch' $\endgroup$ Feb 23, 2016 at 10:54

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.