Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality, integrity and authentication
550
questions
2
votes
1
answer
151
views
blake3 keyed hash compression output xor'ed with key secure?
I'm currently trying to write the blake3 algorithm in JS using the official whitepaper or what it's called.
If I understand correctly then... after the 7 round keyed permutation (at the end of the ...
- 12.5k
4
votes
2
answers
2k
views
OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?
If I do a simple encrypt and decrypt test like so:
...
- 2,611
1
vote
0
answers
38
views
Browser javascript: TLS sequence number authentication
I am implementing TLS (or something like it perhaps) because the browser doesn't seem to provide a direct client-script interface to TLS. The browser provides a ...
- 111
3
votes
1
answer
358
views
Data Origin Authentication vs Non Repudiation?
I'm looking into how authenticated encryption primitives work and was wondering if non-repudiation is provided with these. Investigating further into them led to the answer being that data origin ...
- 92.6k
1
vote
1
answer
1k
views
XChaCha20-Poly1305 vs Plain ChaCha20-Poly1305 performance
I know that the security of both are the same (only nonce size is different). But which one is faster and better to use, when encrypting a lot of files (500+, from 1MB to 200MB)?
- 1,803
1
vote
1
answer
59
views
How to achieve encryption at single source and decryption at multiple locations using asymmetric scheme?
I need an encryption scheme where a single source/location can encrypt using their private key and while anyone with access to the corresponding public key can decrypt it. It has to be asymmetric to ...
- 141k
0
votes
1
answer
379
views
Defending MITM attacks during key exchange
As far as I know, key exchanging algorithms are vulnerable to an active MITM attack.
Let A (Alice) and B (Bob) be parties with no secret information. An adversary C
playing man-in-the-middle ...
- 3,188
3
votes
1
answer
468
views
Encrypt multiple chunks of data with an AEAD
Assuming that I want to encrypt a 1 GB file with e.g. AES in GCM mode or ChaCha20Poly1305.
[I'm specifically referring to the cryptography module for Python: https://cryptography.io/en/latest/hazmat/...
- 1,803
5
votes
3
answers
971
views
Is 'authenticated' in AEAD actually authentication? Or is it message integrity?
Despite working with AES-GCM and other AEAD algos for a few years, I've struggled with the concept of 'authenticated' in the term 'AEAD'. In my own experience (of Unix, PKI and blockchain) ...
- 330
0
votes
0
answers
53
views
minimal public-key authenticated encryption protocol
One party (master) wants to send data to another party (slave) over an insecure channel using public-key encryption and signature schemes such that:
master is authenticated,
data is confidential,
...
- 421
21
votes
2
answers
22k
views
What is the advantage of AEAD ciphers?
What is the advantage of AEAD ciphers? Why is the TLS working group pushing for them? I thought modern cipher suites require SHA256 for authentication. What advantage is there to including Poly1305?
...
- 499
2
votes
1
answer
919
views
What does AES-GCM provide?
I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
- 48.5k
1
vote
1
answer
102
views
Is MAC unnecessary for client side encryption?
In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since:
There is no database, the ciphertext, nonce, tag ...
- 3,361
1
vote
0
answers
84
views
What's the difference between CMTD-1 and key-committing security?
The paper Efficient Schemes for Committing Authenticated Encryption introduces a framework for committing security notions that includes:
CMT-1: commit to the key.
CMT-3: commit to the key, nonce, ...
- 1,803
0
votes
2
answers
1k
views
How is AES256-GCM auth tag used in decryption
I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag.
So can a non-tag verified decryption be secure? ...
- 92.6k
12
votes
3
answers
5k
views
How much security is gained from hiding the nonce?
Public nonces can be problematic for privacy when they can be considered metadata. They can also be troublesome for security if you do things like using a hash of the message as the nonce.
PASETO now ...
- 15.3k
8
votes
1
answer
701
views
Is constant-time compare really required for AEAD ciphers?
When verifying a (HMAC) authentication tag it is often indicated that a constant-time comparison is required for security. I can see how leaking information about a password hash can introduce a mild ...
- 36.4k
3
votes
1
answer
199
views
Common pitfalls to be taken care of while implementing Encrypt then HMAC scheme
i would like to implement a custom Encrypt than HMAC scheme instead of using AES-GCM can anyone share resource to do it correctly . are there any common pitfalls i should be aware of for secure ...
- 1,803
6
votes
0
answers
230
views
Are side-channels a concern for AEAD key commitment fixes?
I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
- 1,803
0
votes
0
answers
84
views
Is it safe to use CTR + HMAC with the same key when the key is unique for each message?
Is it safe to use CTR encryption mode and authenticate it with HMAC(message, key), where key is the cipher encryption key, and the key is unique for each message? ...
- 101
1
vote
1
answer
81
views
How do I calculate number of multiplication, exponential, and pairing operations in a cryptographic algorithm (signcryption/unsigncryption)?
I have been working on signcryption scheme and its security proof. I want to compute the efficiency in terms of number of scalar multiplication operation, number of exponential operations, and number ...
- 51
2
votes
4
answers
603
views
Encrypt-then-MAC: full random keys or keys derived from master key?
I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better:
Use the CSPRNG ...
- 1,803
0
votes
0
answers
221
views
Is libsodium's Key Exchange system secure?
I'm building a project using libsodium's AEAD + Key Exchange system and want to write a proof justifying the security of the project. I am wondering if I can find a source detailing the exact security ...
- 113
1
vote
0
answers
131
views
Can I use content-derived deterministic encryption key with hybrid encryption?
My use case, making public-key encrypted backups, requires deterministic public-key authenticated encryption. I favour NaCl box, but the way it is generally used is probabilistic and it yields ...
- 92.6k
25
votes
3
answers
5k
views
Is Encrypt+HMAC stronger than AEAD?
There are a few posts that I've come across that seem to imply that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes.
https://www.daemonology.net/blog/...
- 1,803
7
votes
2
answers
3k
views
Delayed tag checks in AES-GCM for streaming data
There is currently a GitHub discussion on .NET not supporting AES-GCM for any streaming data since releasing decrypted data prior to tag checks somehow reveals the plaintext or the AES key (or some ...
- 113
2
votes
1
answer
139
views
Sponge Duplex authenticated encryption with nonce reuse or no nonce
With a Sponge permutation in a Duplex construction for authenticated encryption.
illustration example: ascon; actual interest if relevant: keccak
Suppose there is no associated data and there is no ...
- 23.8k
1
vote
2
answers
265
views
What is more efficient to Encrypt then MAC or to MAC then encrypt
I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
2
votes
1
answer
142
views
What does the $e$ operation mean in cryptography research papers?
I read a cryptography scheme that it include the following operation:
$$c= H(e(g_1,g_n)^t)$$
where H is a hash function.
I need to know what the operation $e$ means.
- 343
1
vote
1
answer
374
views
Non-committing authenticated encryption schemes vs committing authenticated encryption schemes
I'm told that TLS 1.3 supports only non-committing authenticated encryption schemes. What is a non-committing authenticated encryption scheme? What is the difference between committing and non-...
- 92.6k
4
votes
2
answers
1k
views
Can I reuse a nonce to retransmit the same packet using ChaCha20-Poly1305?
I understand the "sudden death" implications of reusing a nonce with ChaCha20-poly1305, but I believe this rule doesn't apply if you are transmitting exactly the same packet.
I'm putting together a ...
- 423
2
votes
1
answer
3k
views
Validating AES GCM authentication tag between two different implementations
I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations.
One implementation (on my part) is in Java. The other, I don't know.
In my implementation, ...
- 23
0
votes
0
answers
369
views
Nonces in chacha20poly1305 vs chacha20
I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
1
vote
0
answers
57
views
Generalizing randomized permutation functions
The paper on the "SNEIKEN and SNEIKHA" AE and HASH sponge-based algorithms, respectively, presents a 512-bit permutation function "SNEIK512" that, unlike other permutations (ie: ...
- 307
2
votes
2
answers
479
views
Why do most authenticated encryption primitives expect an unpredictable and uniformly random key in order to be secure?
I've noticed that keys for authenticated encryption primitives like AES must be unpredictable and uniformly random in order to be secure. IV values and seeds for PRNGs also have to be unpredictable ...
- 92.6k
3
votes
2
answers
164
views
Does AEAD provide any benefit over raw cipher in this setting?
I'm working on a cryptographic data store where blobs need to be identified and referenced via a hash of the encryped data. Think Merkle tree with encrypted nodes. In such a setting where the hash ...
- 92.6k
1
vote
1
answer
138
views
Public-key authenticated encryption: crypto_box
I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
- 48.5k
2
votes
1
answer
983
views
How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?
I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
- 161
423
votes
13
answers
190k
views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
- 5
1
vote
1
answer
481
views
Can Fixed–Diffie–Hellman be attacked?
Recently I'm studying Diffie-Hellman key exchange protocol and I've noticed that the basic Diffie-Hellman can be attacked by Man-In-The-Middle attack. I've also read about the Fixed Diffie-Hellman ...
- 6,445
1
vote
1
answer
154
views
Does CMS AuthEnvelopedData type provide message authentication?
I was looking through the S/MIME Message specification (RFC 8551) to find out what security services it offers. Section 2.4.4 of this document describing AuthEnvelopedData content type (which uses the ...
- 6,364
2
votes
1
answer
346
views
How is RSA key exchange protected against tampering?
The public key is defined by (N, e) where N is the product of two large primes and e is ...
- 92.6k
1
vote
0
answers
190
views
How to compose (H)KDF, Encryption and (H)MAC
For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC.
A typical task is to transfer data from one node to ...
- 147
1
vote
0
answers
239
views
xChaCha20 Block Keys for Poly1305
So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
- 48.5k
7
votes
1
answer
963
views
How to securely encrypt/decrypt data with a maximum chunk size?
I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
- 48.5k
7
votes
1
answer
930
views
TLS 1.3 - Why have no encrypt-then-MAC modes been specified?
I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
- 123
7
votes
3
answers
2k
views
Are SSH key-pairs an example of a zero knowledge proof?
Quoting from source, authentication using SSH key pairs goes something like this:
1) The client begins by sending an ID for the key pair it would like
to authenticate with to the server.
2) ...
- 29
1
vote
1
answer
153
views
A feasible approach for AEAD on an ethernet link?
The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. ...
- 15.3k
6
votes
1
answer
205
views
Can an authenticated encryption scheme detect if wrong key is used?
Can an authenticated encryption scheme (like AES-GCM) detect if a wrong key is used for decryption? If not, what is the standard way to check whether the entered key is indeed correct. I presume KCVs ...
- 13.2k
1
vote
1
answer
2k
views
Is it possible to partially decrypt an aes-gcm ciphertext?
Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them?
If not, is there another authenticated ...
- 92.6k