I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed CTR-Then-CMAC scheme (mainly in order to avoid apparent fragility of GHASH as to limit impacts of accidental IV reuse with gcm)
My questions are the following:
- If for instance I plan to build a composed CTR-Then-CMAC scheme, I think to process as follows
derive two Authentication / Encryption keys from unique input key
encrypt plaintext P using CTR mode & input
Initial counter block (ICB)
lastly authenticate the sequence composed of IV, AD and Ciphertext using CMAC.
- Is is correct ? where / how can we find rules to build correctly a composed AE scheme from input "secure" Encryption & MAC/Authentication modes ?
- the only standard which addresses such AE generic
composition seems to be ISO/IEC 19772:2009 which includes
"Encrypt-Then-Mac" mode beside other AE/AEAD modes; but as such ISO
standard has to be ordered I didn't still get info about content of
"Encrypt-Then-Mac" mode section