Combination of encryption and authentication in a way that ensures confidentiality and integrity.

learn more… | top users | synonyms

3
votes
1answer
392 views

Difference entity authentication and implicit key authentication

From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions: Implicit key authentication is when one party is assured that no other aside from a ...
3
votes
1answer
142 views

efficient authentication with broadcast encryption?

(I am not a crypto expert, so I apologize if the terminology I use is incorrect.) Suppose I have the following simple broadcast encryption scheme for securely sending content to $n$ authorized ...
3
votes
1answer
140 views

What “Tag Length” should be used for the EAX MAC?

Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ...
3
votes
2answers
135 views

Can a secret message be securely transmitted within a MAC tag?

A sender wants to transmit an ultra secret code $M$ which could be either 'go', 'stop' or 'wait'. This could be any selection of code words really and adopted for any use such as transmitting short ...
3
votes
1answer
79 views

The exact definition of a symmetric encryption

I have doubts for the definition of the decryption algorithm $D(.)$. I think I've already seen that the decryption returns a plaintext $M$ on input the key $K$ and $C=E_K(M)$. I have also seen thet ...
3
votes
1answer
231 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
1answer
205 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
3
votes
0answers
55 views

Managing data permissions/access through asymmetric cryptography

I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography. I'm concerned about how is it possible to share access of encrypted data with N entities, and be able to ...
2
votes
3answers
373 views

Can ECB mode really leak some characters?

In an Ars Technica article about Adobe's use of 3DES in ECB mode, there's a paragraph The passwords, according to password expert Steve "Sc00bz" Thomas, are encrypted in a mode known as ECB. That ...
2
votes
2answers
455 views

What are the potential security impacts of using CRAM-MD5 for Emails, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. But ...
2
votes
3answers
150 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
2
votes
2answers
195 views

Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?
2
votes
2answers
153 views

Is there a point using GCM block chiper with Authenticated DH?

I'm delivering shared secret with DH exchange, using a static key for signing and an ephemeral for session, so is there a point using GCM for encrypting the data, or is a simple CBC/CTR block cipher ...
2
votes
1answer
211 views

Does SpongeWrap (from the Keccak team) absorb ciphertext or plaintext?

I have been reading the Cryptographic sponge functions paper, but I'm still confused. Does Keccak in authenticated encryption mode absorb ciphertext or plaintext? Edit: Are there any test vectors to ...
2
votes
1answer
288 views

Encrypt-then-MAC paradigm

I read that the Encrypt-then-MAC paradigm is provably secure. From what I understand, when using for example AES for encryption and HMAC_SHA256 for MAC generation (and the keys $K_1 \neq K_2$), this ...
2
votes
1answer
137 views

How is padding oracle attack mitigated by encrypt-then-MAC?

Let us suppose Alice sends a message to Bob. As far as I know, the most popular scheme of MAC-then-encrypt is as follows: Alice computes the HMAC of the plaintext using her private key, and then ...
2
votes
1answer
158 views

Flaw in the security definition of *Stateful* Authenticated Encryption?

I'm in search of the correct definition of a stateful authenticated encryption scheme (sAE), and its related security notion. This has been treated several times in the academic literature, however, ...
2
votes
1answer
214 views

The security of an encrypt-and-MAC

I would like to know what is the security of an encrypt-and-MAC with different keys for each transaction For example: the one-time-pad with $k_1$ and the HMAC with $k_2$ $$C = M \oplus k_1\\ MAC = ...
2
votes
0answers
94 views

Use cases for “online” authenticated encryption?

What is the the point of an "online" mode for an authenticated cipher? I understand what "online" means in this context. However, I have trouble coming up with applications that would benefit from ...
2
votes
0answers
129 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
1
vote
2answers
213 views

How resilient to attackers with extreme resources available is this encryption method?

How could the following scheme be made more resilient to attacks capable of utilizing massive amounts of resources? Assume all random values are cryptographically secure. Key derivation: scrypt ...
1
vote
2answers
189 views

Why is MAC using nonce+message+hash(nonce+message+identifier) not the standard?

Given that we know that nonce + message + hash(nonce + message + mac-key) all inside the encryption makes it possible to detect if any bits of the message have been ...
1
vote
1answer
897 views

AES GCM symmetric encryption of data at rest in c#, ciphertext much longer than plaintext

I've written encryption/decryption routines using AES GCM. Code can be found here. I recently realized that the cipher text is longer than I believe it should be. It should add the tag and IV onto ...
1
vote
1answer
190 views

Does CBC encryption of a hash provide authenticity?

Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
1
vote
1answer
237 views

Does RSA-OEAP have integrity and authenticity properties?

RSA-OAEP is IND-CCA2 secure (indistinguishable under an adaptive chosen ciphertext attack). Does it also have the INT-CTXT (integrity of ciphertext) and INT-PTXT (integrity of plaintext) properties? ...
1
vote
1answer
73 views

What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

LibSodium, (https://github.com/jedisct1/libsodium), has a function crypto_box_detached() which does authenticated encryption using the public key of the recipient ...
1
vote
1answer
169 views

ID-Secret Scheme

I have an ID-Secret scheme and I'd like to hear if there are any vulnerabilities present. Party 1 and Party 2 hold some credentials, an ID and a Secret. Party 1 Creates this message: ...
1
vote
1answer
451 views

How to supply the GCM authentication tag to the OpenSSL command line tools?

I'm using AES-256-GCM for authenticated encryption. In order to decrypt, the ruby OpenSSL library requires an auth_tag parameter (in addition to the key and iv). ...
1
vote
3answers
181 views

verify contents, but not order

Is there an algorithm that can be used to verify the contents of a cyphertext, but not the order of the elements? I am thinking that a deck of cards could be shuffled, and it must be verifiable that ...
1
vote
1answer
47 views

SpongeWrap without padding and frame bit

Assuming all inputs are same length as rate except last can be shorter. Is it necessary to pad every input (not just last) to sponge for authenticated encryption to be secure? Is this just, because ...
1
vote
1answer
65 views

Publicly Verifiable Authenticator

I am working on a Block Storage system, where I have the need to encrypt and authenticate blocks by a client, but also want the server to be able to detect bit corruption while minimizing the work ...
1
vote
1answer
226 views

is this authenticated key exchange protocol sound? too complicated? obviously flawed?

(significantly reworded this question to fit better into crypto.se). I have static RSA keypairs for both sides and an encrypted transport that needs symmetric keys, and need to exchange session keys. ...
1
vote
1answer
113 views

How to build a secure AE scheme with generic composition?

I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed ...
1
vote
1answer
124 views

What kind of cryptography should i use?

I have a trusted third part A that issues an access token (xml file) to an untrusted client C that uses this token to log into an untrusted server S and access to the authorized files. I want only ...
1
vote
1answer
51 views

secure embedded/microcontroller crypto using AES-ctr with hmac-sha2

The embedded device is a low-power 8-bit microcontroller (memory usage is constrained to about 10kb code, 1kb ram). As the device is battery-powered and manual service should be minimal, more powerful ...
1
vote
0answers
58 views

Mutual authentication with Public Key and session Key

I am trying to understand two protocols for mutual authentication and if they are secure or not. $K$ is the session key, and it's calculated $k=H(TimeStamp)$. Are the following both cases secure? ...
1
vote
0answers
48 views

Smart card Strong authentication / Verification ( fingerprints)

I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working ...
1
vote
0answers
129 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES ...
0
votes
1answer
119 views

Is MAC-then-encrypt with stream ciphers secure?

While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is ...
0
votes
2answers
256 views

Recommended authenticated stream cipher for minimum overhead?

I'm running my TCP/IP protocol secured by encrypting each packet with AES128/CBC, bundling a SHA256 HMAC over that packet. This causes quite a bit of space overhead for small packets, so at first I ...
0
votes
1answer
230 views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
0
votes
2answers
57 views

Operation sequence authentication shared storage

Let's say there is a shared storage: USB flash drive, external HDD, or whatever you like. I'll refer to it as disk. Also, there are multiple parties, let's say Alice and Bob (may be thousands of them) ...
0
votes
0answers
6 views

How is security of server's RSA private key is ensured? [migrated]

We repeatedly hear news of hacking of passwords from PW database (server side) but nothing about hacking of server's RSA private key (not asking regarding finding p and q for a given public modulus ...
0
votes
1answer
77 views

Java: How to handle authenticated encryption for big files

First I need to mention that I can't use BouncyCastle to implement this solution. I have to encrypt files into the file system. Those files are not going to be tranfered over the wire to any other ...
-1
votes
1answer
109 views

Attacking both authenticity and secrecy in authenticated encryption modes

looks like NIST only approved GCM mode for authenticated encryption and other modes don't have any approval or a good implementation available. Is that possible a weakness in $GHASH$ compromise ...