Combination of encryption and authentication in a way that ensures confidentiality and integrity.

learn more… | top users | synonyms

8
votes
1answer
126 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
3
votes
1answer
105 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
2
votes
2answers
93 views

Is the security of an HMAC equally important as the security of the cipher itself?

I'm a little unclear on how hash based MAC works... So I would like to know, is the security of your hash function as important as the security of the overall cipher? Basically, if you can crack the ...
3
votes
1answer
72 views

Security of this scheme

I am developing a software and I am not sure if it is completely secure. I have 22 Mb of data to encrypt used multiple times, random IV (generated using RAND_bytes from OpenSSL lib) and password ...
1
vote
2answers
45 views

How to check the integrity of a key received through mail using symmetric encryption?

I would like to provide access to encrypted data through a cloud service provider, using a pay-as-you-go model. This means that we will sometimes need to revoke a user's access to the data. To ...
1
vote
1answer
84 views

PBEWithMD5AndDES Cipher does not check for integrity first?

I am running FindBugs with findsecbugs plugin to scan java code for security issues. I am getting "Cipher With No Integrity" error for a Cipher function implemented with "PBEWithMD5AndDES". The legend ...
5
votes
1answer
61 views

Symmetric encryption algorithms with large IVs and authentication?

Most modern symmetric ciphers require a nonce/IV. If the nonce is reused, security is lost. If the nonce is large enough, it can be generated securely by using a CSPRNG. This avoids needing to keep ...
2
votes
1answer
363 views

Authenticated Encryption of UDP packets

I am working on a UDP based file transfer protocol. Congestion Control, Resending of packages and other UDP challenges are dealt with - speedtests shows that the protocol is up to 10 times faster than ...
0
votes
0answers
51 views

How to test the speed of an Authenticated Encryption algorithm?

I am trying to implement Authenticated Encryption algorithms using CUDA. Most of Authenticated Encryption algorithms have short message length like 64, 254..., 4094 (Byte). these message lengths ...
0
votes
1answer
99 views

Unconditionally Secure Authentication

I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ...
1
vote
1answer
35 views

NORX duplex padding

MonkeyDuplex constructions defined by Keccak authors has padding in every duplex block. Why only last duplex block is padded in NORX? Is it because NORX has domain separation, or simply because ...
4
votes
1answer
109 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
2
votes
0answers
62 views

StoredKey in Salted Challenge Response Mechanism (SCRAM)

In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure ...
0
votes
0answers
24 views

Advantages of the general digraph trust model over the strict hierarchical model

Are there any advantages of using reverse certificates and the general digraph trust model over the strict hierarchical trust model as described here: In the digraph model each CA can generate ...
1
vote
0answers
50 views

Designing an AES-based protocol for controlling and acessing ioT boards via RF

I'm designing an open ioT protocol to be used on ioT boards based on Texas Instruments RF-based MCUs. These MCUs have an AES module to easily encrypt and decrypt AES content, so that's why I choose a ...
1
vote
1answer
127 views

AES-256 mode with per-block-key being a SHA-256 of SHA-256 of secret key, random public salt and block number. What's amiss?

Please criticize the (homebrew?) mode described below; to point out a single major defect/uncertainty or the link to (the analysis of) an equivalent construction is quite enough. Assume the ...
4
votes
1answer
73 views

Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?

Let's assume we have a message $M$ and it's signature $S$ and that $|$ is the concatenation operator. Should we encrypt $S|M$ or $M|S$? Does it even matter?
-1
votes
1answer
100 views

About end to end algorithm SMS from Jo Mehmet Sollihagen Øztarman [closed]

This is a signcryption scheme from End-to-End Data Protection of SMS Messages by Jo Mehmet Sollihagen Øztarman (pdf, section 4.3.1): Public parameters C: an elliptic curve over GF(ph) with p ≥ 2^...
3
votes
1answer
112 views

How do I tack on “additional data” to libsodium's public-key authenticated encryption?

I note that libsodium provides AEAD when using symmetric cryptography. And yet, under section 8 (Public-key cryptography) there are no public-key methods described which allow for additional data (AD)...
4
votes
0answers
62 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
6
votes
2answers
82 views

How to propagate error in variable-sized message?

I want to design a scheme to encrypt a variable-length message with a secret key, to provide confidentiality. The message is a short human-readable text string with byte granularity, let's say under ...
1
vote
0answers
22 views

Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?

I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
3
votes
0answers
30 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...
3
votes
1answer
150 views

How to enforce data privacy, integrity and authenticity of distributed firmware images for an embedded device?

I'm developing a bootloader for an embedded device, with which it should be possible for customers (i.e. device owners) to update the device's firmware. It is required that: the firmware is ...
2
votes
1answer
78 views

Can we use the authentication tag as Nonce / IV for the next message?

Let's assume we're in some scenario requiring transfer of large amounts of data. This means we can only use AES-GCM chunk-for-chunk as its maximal size is restricted to a few GiBs. This means we have ...
3
votes
1answer
67 views

Is there an existing AE protocol with forward secrecy for embedded devices?

I'm working on an embedded device that is connected to a computer over an untrusted channel. According to my threat model I need authentication and encryption on the wire with perfect forward secrecy. ...
4
votes
2answers
400 views

Why must we generate the signature before any compression being done at PGP?

I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both. One ...
1
vote
0answers
55 views

Details related to the ZIP algorithm used in PGP message encryption? [closed]

I am very new to PGP. PGP encryption works with hash function, asymmetric encryption, symmetric encryption and a zip algorithm (LZ77). What I know is that the zip algorithm is used to reduce the ...
5
votes
3answers
276 views

Order of MACing and Encrypting in TLS

I've been working through how TLS1.0 works, and think I've basically understood most of it. One thing I can't seem to find a explanation of though is the order in which MACing and encrypting should ...
3
votes
0answers
103 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
2
votes
0answers
211 views

What are the constraints on using GCM with a tag size of 96 and 128 bits

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST ...
0
votes
0answers
46 views

Signatures with Hybrid Encryption

Typically, in public-key settings, sign-then-encrypt has been used to provide confidentiality and integrity. However, most public-key cryptosystems use hybrid encryption. I've been searching around ...
3
votes
1answer
73 views

Are deployed MACs IND-CPA?

There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk ...
2
votes
0answers
49 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
3
votes
1answer
69 views

Is authenticated encryption basically a lockable box?

I recently used a custom construction as a commitment scheme, which was taken from the standard picture you give people while explaining commitment schemes. Basically commitment schemes can be ...
3
votes
1answer
173 views

EAX cipher mode with nonce equal header

I am using EAX AEAD with an 8-byte message header which carries a 32-bit sequence number, a message length, and some other bits that I don't mind exposing. Assuming the sequence number never repeats ...
3
votes
2answers
140 views

Does authenticated encryption add any protection to a signed digital envelope?

The general scenario of hybrid encryption is to use public key cryptography for the exchange of a one time session key that can be used for the encryption of the plaintext with a symmetric encryption ...
1
vote
1answer
53 views

Forgery attack on OCB

When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
2
votes
2answers
127 views

3DES over Galois Counter Mode (GCM) for authenticated encryption

Is it possible to use DES or 3DES over Galois Counter Mode (GCM) to provide authenticated encryption? I haven't seen any implementation yet.
1
vote
2answers
125 views

Secure Channel - Encryption and Decryption Keys For A Message

I'm currently reading Cryptography Engineering and in Chapter 7, the topic of secure channel is discussed. The channel described is using CTR for encryption. Below I include images with pseudo-code ...
-3
votes
1answer
76 views

Would this method allow fast authenticated encryption using only a single encryption and RNG operation per block? [closed]

The most promising of the 4 approaches described here (version 4) has been posted as a separate question. This post should be considered for archiving and historical purposes only. Disclaimer: the ...
0
votes
2answers
46 views

Would this method allow fast authenticated encryption using only a single encryption operation per block?

[This approach is flawed. A different speculative approach using an RNG instead of the cipher as a source of entropy was posted as a separate question] Assume $E$ is a block cipher, $C_0 = IV$ and $...
1
vote
1answer
83 views

What should I think about these unique certificate serial numbers [closed]

I was looking at the serial numbers of the certificates for www.google.com and wordpress.com. Wordpress was listed by openssl as: 04:0B:D4:F8:25:88:C5 This serial is listed as the serial for both ...
2
votes
2answers
273 views

Post-quantum authenticated encryption

It is well-known that the Grover's algorithm reduces cryptographic strength of symmetric ciphers to a square-root - e.g. AES-256 becomes only 2128 strong. However, these statements are always made ...
1
vote
1answer
125 views

How to exchange authentication keys

I am trying to create a secure Bluetooth Low Energy connection. The peripheral server (the main device other people would connect to) would need to service many clients (users) and due to hardware ...
2
votes
1answer
137 views

Format preserving encryption FFX

In FFX mode the format of the ciphertext is same as plaintext. How does it ensure data integrity and authentication? Is there any bit flip attack in FFX mode? Is it malleable?
3
votes
1answer
384 views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
0
votes
1answer
78 views

Which one these alternatives using authentication and encryption will solve this multiple-user database problem?

Which one these alternatives using authentication and encryption will solve this multiple-user database problem ? I'm trying to understand the field of cryptography, so I've started reading a ...
2
votes
1answer
167 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...
1
vote
1answer
55 views

Is authentication length always a subset of encryption length?

Do in all the use cases, if I have to encrypt and authenticate, encrypt-then-authenticate or authenticate-then-encrypt, like in IPSEC, SSL or SSH or others, if I were to do these operations to a ...