Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 1 down vote favorite

Given an authenticated mode of encryption, when comparing a plaintext string against the contents of a ciphertext, which approach is typically considered safer?

  1. Encrypt the plaintext and compare against the ciphertext, or
  2. Decrypt the ciphertext and compare against the plaintext in $O(n)$

The former appears better to me since the contents of the ciphertext are never decrypted and loaded into memory. However, given that it's an authenticated mode of encryption, this bypasses the authentication checks that would normally occur during decryption.

So, which is hypothetically worse? Potentially allowing Eve to load decrypted ciphertexts into memory, or potentially allowing Eve to force my system into comparing plaintexts (either under Eve's control or unknown to her) to forged ciphertexts?

share|improve this question

1 Answer

up vote 1 down vote

2 is considered better, because the probability of the comparison in 1 returning $\:\text{true}\:$ is always at most $$\frac1{2^{\operatorname{len}(\text{IV})}}$$

share|improve this answer
What would the probability of the comparison returning $true$ be on the second one? Would it be $1 / 2^{len(ciphertext)}, since given a fixed IV, key, and plaintext, there should be one possible ciphertext? – Stephen Touset Dec 4 '12 at 22:37
2  
Note that in method 1, one can reuse the IV that's included with the ciphertext. If you do that, it succeeds with probability 1. This doesn't answer the question; however, it does mean that both options are viable. – poncho Dec 4 '12 at 22:55
Can you elaborate, poncho? I'm not sure I understand. – Stephen Touset Dec 5 '12 at 0:15
1  
@StephenTouset: the encryption process of an authenticated mode takes an IV, which is sent along with the ciphertext (as it is required for decryption). Hence, in method 1, when you re-encrypt the candidate plaintext, you can use the IV included with the ciphertext; this would make the encryption procedure determanistic. Note that this would not necessarily bypass the authenticate check; the authentication tag generated during the encryption should make the authenticate tag included with the ciphertext – poncho Dec 5 '12 at 0:31
In this case, the user of the high-level API has to provide their own IV along with the ciphertext. – Stephen Touset Dec 5 '12 at 1:42
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.