4
votes
1answer
59 views

Authenticating Very Short (Sub-Block) Data

If I'm encrypting very short/small data - like an int or a long (32 or 64 bits), does it make any sense to authenticate the ciphertext, when using an "online" mode of operation (like EAX)? ...
3
votes
2answers
67 views

CBC-MAC key can be added to ciphertext?

I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC. Does the second key (for CBC-MAC) need to be secret? How to join such key with the ...
3
votes
1answer
158 views

AES256-GCM - can someone explain how to use it securely (ruby)

I am looking into using AES256-GCM for encrypting some database fields. I know that for AES256-CBC, I need to generate a new IV for each encrypt, but I can use the same key. The IV can be openly ...
2
votes
3answers
124 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
0
votes
1answer
183 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
-1
votes
1answer
104 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
1
vote
2answers
212 views

How resilient to attackers with extreme resources available is this encryption method?

How could the following scheme be made more resilient to attacks capable of utilizing massive amounts of resources? Assume all random values are cryptographically secure. Key derivation: scrypt ...
5
votes
1answer
285 views

Does the GCM authentication tag need to be protected?

I am just learning about the GCM mode of AES and I'd like to start using it in my software. However, I have a question about its use. As I understand it the output of a GCM encryption operation is ...
3
votes
1answer
227 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
5
votes
1answer
314 views

AES-SIV security

I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ...
3
votes
2answers
526 views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. So ...
1
vote
0answers
129 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES ...
10
votes
3answers
2k views

Why is OCB-AES mode not becoming a standard for authenticated encryption?

The OCB mode of authenticated encryption (used for example with AES) is the fastest way to provide authenticity and confidentiality without having to strive into questions like: Encrypt then MAC, MAC ...
3
votes
1answer
860 views

AES CCM vs CCMP

Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
1
vote
1answer
797 views

AES GCM symmetric encryption of data at rest in c#, ciphertext much longer than plaintext

I've written encryption/decryption routines using AES GCM. Code can be found here. I recently realized that the cipher text is longer than I believe it should be. It should add the tag and IV onto ...
4
votes
1answer
185 views

How to communicate authentication tag for GCM?

I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?
4
votes
2answers
216 views

Is this streamable combination of encryption and MAC secure?

I want to combine encryption and MAC. For encryption I use AES-256 with CBC and PKCS5Padding. For MAC I use HmacSHA512. I use the Encrypt-then-Mac approach (calculate MAC over the ciphertext and ...