Combination of encryption and authentication in a way that ensures confidentiality and integrity.

learn more… | top users | synonyms

8
votes
1answer
115 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
-1
votes
0answers
23 views

Counter-Mode Message Authentication Code [duplicate]

Excuse my naivety,I don't know much about crypto. But I've been wondering, couldn't counter-mode be used for MAC just like CBC in CBC-MAC, assuming nonce for the counter is not repeated? Am I missing ...
4
votes
0answers
74 views

Security of Fernet Construction (wrt non self delimiting tokens and HMAC short key size)

Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography python ...
4
votes
2answers
41 views

Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

I was just going over my (old) notes from Coursera's Cryptography I course, and I was puzzled by the description of SIV as providing deterministic authenticated encryption (DAE). The general SIV ...
1
vote
1answer
102 views

Encrypting and Authenticating The Simplex Communication Between Embedded Devices

I am planning to build temperature sensor nodes for my home heater control. Central device will control the heater using temperature data read by nodes. These nodes will send temperature data to ...
1
vote
0answers
74 views

Encrypted comms between devices on LAN

I'm trying to encrypt a protocol that shares data between devices on a local area network (i.e.no connection to the internet). I don't want to use predefined keys because they're too easy to read from ...
11
votes
3answers
384 views

Plain text size limits for AES-GCM mode just 64GB?

Based on NIST SP 800-38D section 5.2.1.1, it seems that the maximum length of plaintext is 2^39-256 bits ~ 64 GB. We've got 100+GB files in genomics that need to be GCM encrypted so are concerned ...
3
votes
0answers
31 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
3
votes
1answer
360 views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
2
votes
1answer
159 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...
1
vote
1answer
27 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an MDC (“Manipulation Detection Code”, as also handled in this Q&A) to provide origin authentication when using public-key encryption?
3
votes
1answer
25 views

Encrypt-then-MAC when encrypting data in multiple blocks

Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ? For example, the plaintext is 530 bytes long. We read ...
5
votes
1answer
41 views

Can one make a secure AEAD from any secure cipher and any secure MAC?

Can one make a secure AEAD from any secure cipher and any secure MAC using encrypt-then-MAC: with independent keys and IVs (any cipher and MAC) if the cipher is a stream cipher (including a block ...
1
vote
0answers
24 views

MAC-then-encrypt: Using one-time-MAC with randomized CTR

The Coursera cryptography 1 course says: If you want to use MAC-then-encrypt mode then you should either use randomized-CTR or randomized-CBC. And if you use randomized-CTR then one-time-MAC ...
0
votes
0answers
18 views

Why does HS1-SIV use the universal hash function the second time?

HS1-SIV uses HS1-Hash twice: once with the message as input, and the second time with the authentication tag as input. The second use seems somewhat strange to me: assuming that the core is a strong ...
2
votes
0answers
191 views

What are the constraints on using GCM with a tag size of 96 and 128 bits

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST ...
0
votes
1answer
125 views

What is a branch number in the PAEQ algorithm?

I'm reading an article about authenticated encryption algorithm - PAEQ. It uses a permutation function AESQ, which has transormations from AES. And there is written about MegaSBoxes, which contain 4 ...
0
votes
0answers
13 views

SAM module in Payment transactions & cryptogram key storing

As you know because of low security factors,General MCU's are not appropriate choice for storing Transaction or cryptograms keys.Therefor embedded systems developers used SAM modules for secure ...
2
votes
0answers
49 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
0
votes
0answers
23 views

Advantages of the general digraph trust model over the strict hierarchical model

Are there any advantages of using reverse certificates and the general digraph trust model over the strict hierarchical trust model as described here: In the digraph model each CA can generate ...
3
votes
1answer
139 views

How to enforce data privacy, integrity and authenticity of distributed firmware images for an embedded device?

I'm developing a bootloader for an embedded device, with which it should be possible for customers (i.e. device owners) to update the device's firmware. It is required that: the firmware is ...
3
votes
0answers
63 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
3
votes
0answers
40 views

Benchmarks for second round CAESAR competitors

I'm interested in how the second round CAESAR competitors stack up in terms of software performance against each other and against chacha20-poly1305 with both small and large messages. Sadly the only ...
3
votes
1answer
116 views

The exact definition of a symmetric encryption

I have doubts for the definition of the decryption algorithm $D(.)$. I think I've already seen that the decryption returns a plaintext $M$ on input the key $K$ and $C=E_K(M)$. I have also seen that ...
1
vote
1answer
36 views

Would A5/1 with a much larger state be a good choice of stream cipher for hardware?

Would A5/1 with a much larger state be a good choice of stream cipher for hardware? Assume that a reasonable choice of MAC is made such as GMAC, with the first 128 bits of the stream cipher output ...
1
vote
0answers
49 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $...
6
votes
1answer
316 views

Security of a simple AEAD construction

Introduction I want securely communicate with a small 8-bit device which has a very limited program program memory (Arduino Uno - 32K). My goal is to minimize code size and RAM usage. There are ...
2
votes
1answer
48 views

security of a block cipher mode of operation

Consider the following block cipher mode of operation: \begin{align} tag_0 &= mac\:key\\ plaintext_0' &= plaintext_0 \oplus iv\\ E(tag_0 | plaintext_0') = C_0 &= tag_1 | ciphertext_0\\ E(...
3
votes
0answers
30 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
1
vote
0answers
13 views

Why does HS1-SIV allow forgeries when the SIV collides, even when the PMN does not collide?

The HS1-SIV authors claim that forgeries are possible if an SIV collision occurs. However, I do not understand how this is possible unless the PMN collides too. Otherwise, the collision will be in ...
0
votes
0answers
14 views

Can XTS + checksum be used for authenticated encryption?

Is it possible to use XTS+a checksum for authenticated encryption? Specifically, it seems like a good $n$ bit checksum applied before encryption should ensure that any change to the ciphertext ...
6
votes
1answer
96 views

Is IPsec IND-CCA secure provided the used block cipher is a pseudorandom function?

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC) As a resource I am given ...
192
votes
11answers
47k views

Should we MAC-then-encrypt or encrypt-then-MAC?

Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
4
votes
0answers
54 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
1answer
89 views

Authenticated encryption with Signatures

I've given a CPA secure private key encryption scheme (wich gets to a CCA secure scheme or better to an authenticated encryption scheme, when i combine it with a given MAC) and a unforgeable public ...
3
votes
1answer
41 views

The solution of insert MAC in a ciphertext without Authenticated Encryption supported

From Should we MAC-then-encrypt or encrypt-then-MAC?, I understand I should do Encrypt-than-MAC, which the MAC included all the information such as IV and cipher text. After reading Why choose an ...
3
votes
1answer
89 views

Combining public key signature schemes and private key encryption

I'm working on my bachelor thesis and I have some questions. I want to combine a CPA-secure private key encryption scheme and some unforgeable public key signature scheme (in my case some sanitizable ...
3
votes
1answer
77 views

Is it acceptable to write the nonce to the encrypted file during AES-256 GCM? [duplicate]

I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm ...
4
votes
1answer
121 views

What is Deterministic Authenticated Encryption?

I came across something known as deterministic authenticated encryption in my studies and a lot of people were associating it with Synthetic IV mode. I am having trouble what exactly DAE is because I ...
1
vote
2answers
96 views

Difference between MAC and Authenticated Encryption?

I am currently studying authenticated encryption and I was wondering if there was a difference between using a MAC and authenticated encryption. It seemed like authenticated encryption schemes use ...
0
votes
0answers
18 views

Why does HS1-SIV not encrypt the SIV with the PMN and key?

HS1-SIV is a good nonce-misuse-resistant, two-pass, AEAD scheme that is part of the CAESAR competition. However, it suffers from forgeries if the SIV collides. It seems to me that encrypting the SIV ...
7
votes
1answer
1k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
1
vote
0answers
24 views

Can we use the sponge construct to efficiently authenticate any cipher?

The sponge construct facilitates authenticated encryption independently of the function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the mixing function in a sponge to ...
1
vote
1answer
56 views

Public-key encryption with associated data

In the symmetric-key world, we have authenticated encryption with associated data (AEAD). I'm looking for something similar, but for public-key encryption: public-key encryption with associated data (...
1
vote
2answers
130 views

Why can't NORX produce intermediate auth tags like Keyak can?

Why can't NORX produce intermediate auth tags like Keyak can? Keyak appears quite attractive because of this, but seems to be slow in the absence of hardware acceleration.
1
vote
2answers
84 views

Step by step conceptual implementation of AUTHENTICATED Diffie-Hellman?

I'm already doing classic DH with pre-shared key in my setup, and it prevents people knowing the same password from eavesdropping on others' traffic. But it doesn't cover situations where a third ...
2
votes
1answer
77 views

Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?

What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV? I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC. Edit: To hide the Poly1305 ...
1
vote
1answer
40 views

What do associated data and message numbers mean?

I'm reading an article about authenticated encryption and don't understand some inputs to an encryption function. They are associated data, public and secret message numbers. Can you explain me their ...
0
votes
0answers
29 views

Is it okay to bail out early when length mismatch is detected?

Is it okay to bail out early when length mismatch is detected? Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong ...