-1
votes
1answer
46 views

AES CBC MAC splicing attack

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is: given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, ...
-1
votes
1answer
69 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...
1
vote
1answer
116 views

Derive both MAC and AES keys from same PBKDF2?

When doing password-based encryption, is it OK to create one instance of PBKDF2 from the password, and then use it to create both the AES key and the MAC key? (Or should a new instance of PBKDF2 be ...
1
vote
1answer
76 views

Is OCB with short MAC malleable?

At the beginning of OCB's white paper [pdf], OCB is compared to other modes, and non-malleability is one of the properties advertised. At the end of the paper, it is mentioned the MAC length can be ...
3
votes
2answers
195 views

Does encrypting a hash of the message yield a secure MAC?

Is $mac = enc(hash(x))$ a secure MAC for hash = SHA256 and enc AES in CBC mode or ECB mode. Normally AES-CBC is malleable. But in this case I use a hash function for the one-way property. For ...
3
votes
1answer
199 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
1answer
129 views

When truncating an AES MAC value by “w” , how do I justify that “w” is still negligible?

I'm taking an online class on cryptography at corsera.org / Stanford, and the professor is explaining that it's OK to truncate an AES MAC to $w$ bits as long as $1/2^w$ is still negligible (say $w ...
1
vote
2answers
481 views

Deriving HMAC key and cipher key from passphrase? [duplicate]

I'm encrypting a file with AES-256 in CBC mode. I needed to add an HMAC for authentication and validation of the file contents and passphrase, so I used a SHA-256 HMAC over chunks of my file ...
1
vote
0answers
115 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES ...
1
vote
1answer
612 views

AES-CMAC passes every test except two

i wrote this code: ...