Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below:

We show that generic compositions of confidentiality-secure encryption schemes with Manipulation Detection Code (MDC) functions for authenticated encryption are, in general, weaker than "encrypt-than-authenticate" compositions using strong Message Authentication Code [edit: (MAC)] schemes. Since the former compositions lead, in general, to authenticated encryption schemes that are faster, more power-efficient, and simpler implementations than the latter, we conclude that both types of composition are necessary in practice for different application environments.

Now despite this claim I cannot find any protocols that e.g. use the Infinite Garble Extension (IGE) or double IGE (biIGE) modes of encryption.

Furthermore I found the following rather alarming notes (that are more alarming since the aforementioned paper seems to be of a later date than the attack described in the last link):

http://www.metzdowd.com/pipermail/cryptography/2006-September/011423.html

https://groups.google.com/forum/#!topic/sci.crypt/4bkzm_n7UGA

So my two related questions are:

  1. Can there be any practical use of MDCs in general?
  2. Can there be any practical use of IGE or biIGE mode encryption?
share|improve this question
    
This is because I came across a question on stackoverflow about IGE mode encryption. I'm planning on creating OpenSSL compatability classes in Bouncy Castle and I'm wondering if I should include this rather unknown block cipher mode of operation. –  Maarten Bodewes - owlstead Jul 23 '13 at 19:50
    
Regarding your first question, cryptographic hash functions are (conjectured to be) MDCs, so they naturally have lots of practical uses... is this what you were intending? –  Reid Jul 24 '13 at 17:13
    
@Reid Yes, although I don't expect information on hash functions themselves. Only if they are used in combination with a symmetric cipher to provide authentication/integrity in addition to the confidentiality that the cipher should be providing. –  Maarten Bodewes - owlstead Jul 24 '13 at 21:21

1 Answer 1

up vote 6 down vote accepted
+50

Don't believe every claim ever made in any paper ever written, particularly when the paper provides little or no justification for the claim; not everything you read reflects the cryptographic consensus. This is particularly true for a paper written in 2002, which is a time our understanding of authenticated encryption and security engineering was still in flux.

Today, the conventional wisdom is: just use authenticated encryption, such as GCM, EAX, etc. For most purposes, there's really no compelling reason to ever use a special MDC-based scheme.

Can there ever be any practical use to MDCs? I don't know; that's too broad a question to answer. I don't know if anyone can ever convincingly tell you "no, they will never ever be useful, I absolutely guarantee it". But in general, I don't see much use to MDC-based schemes. I find it hard to imagine practical situations where I'd want to use a special MDC-based scheme. Standard authenticated encryption schemes are good enough.

I don't recommend use of IGE nor biIGE modes: if you have to ask, you shouldn't be using them. (There may be some very special situations where one might use them -- see, e.g., this use of biIGE in Minx, a system for anonymous communication -- but those are the exception instead of the norm.) For almost all ordinary real-world situations that you're likely to encounter, an authenticated encryption scheme is going to be adequate. Researchers have invented tons of clever ideas ever invented, but that doesn't mean they're all useful; in practice, a handful of standard primitives will cover you for 99% of real-world situations.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.