Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 2 down vote favorite

I'm aware that it's crucial to include the IV when calculating the HMAC of a ciphertext (assuming an IV is used). Can anyone explain, in simple terms, why this is?

Furthermore, assume that there is other metadata associated with the cipher, which needs to be known to correctly decrypt the ciphertext (for example, the type of algorithm used, the mode, options such as configurable block size, etc). Is there any sense in including this information when calculating the HMAC? Or on the contrary, is the any reason not to?

share|improve this question

1 Answer

up vote 2 down vote accepted

Yes, it is best to include all that information in the HMAC. Otherwise an attacker can change those values and you would not get the correct plain text. This would mean that you get either incorrect information, or you leak information that could be used for padding oracle attacks.

In case of the IV, if you don't include it in the HMAC then the attacker can change the first block of plain text you get when you decrypt the first block (assuming CBC mode encryption here).

share|improve this answer
So, the concern is that Alice encrypts a message, Mallory intercepts the ciphertext and modifies it, and Bob decrypts the modified ciphertext (without verifying it's integrity properly), resulting in incorrect decryption (which could help Mallory in launching a padding-oracle attack)? Excluding the metadata (such as IV) from the HMAC-calculation (or not using a HMAC at all) does not per se help Mallory decrypt the message successfully. Do I understand this correctly? – hunter Feb 26 at 2:06
1  
Yes you get the gist of it, although if a padding oracle attack is feasible (which depends on a few other things) then retrieving the plain text is certainly possible. These attacks should not jeopardize the key. – owlstead Feb 26 at 2:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.