Combination of encryption and authentication in a way that ensures confidentiality and integrity.

learn more… | top users | synonyms

4
votes
1answer
284 views

Signing a GCM MAC

If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message ...
4
votes
2answers
53 views

Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

I was just going over my (old) notes from Coursera's Cryptography I course, and I was puzzled by the description of SIV as providing deterministic authenticated encryption (DAE). The general SIV ...
4
votes
2answers
125 views

Can we build authenticated encryption using Feistel Networks?

Most of the encryption modes of Feistel Networks especially the ones used to build fixed length block ciphers just provide confidentiality . Can we build authenticated encryption using Feistel ...
4
votes
1answer
109 views

Using HMAC as a nonce with AES-CTR encrypt-and-MAC

Suppose I use the following encrypt-and-MAC construction: $E(k_1, k_2, n, m) = E_\text{AES256-CTR}(k_1, n, m) \| \text{HMAC-SHA256}(k_2, m)$, where: $k_1$ and $k_2$ are 256-bit keys $n$ ...
4
votes
2answers
98 views

Is it possible to insert a key derivation function when using EAX?

I am currently investigating use of EAX mode for a dedicated application and following useful clarifications received from my previous post , to consider according to my applicable input security ...
4
votes
1answer
192 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
4
votes
2answers
184 views

Use cases for “online” authenticated encryption?

What is the the point of an "online" mode for an authenticated cipher? I understand what "online" means in this context. However, I have trouble coming up with applications that would benefit from ...
4
votes
2answers
183 views

Can a secret message be securely transmitted within a MAC tag?

A sender wants to transmit an ultra secret code $M$ which could be either 'go', 'stop' or 'wait'. This could be any selection of code words really and adopted for any use such as transmitting short ...
4
votes
1answer
235 views

Combining AEAD with RSA

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
4
votes
1answer
598 views

Using a derived key for CMAC

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication: Two keys are derived from the master key k (16 byte): ...
4
votes
1answer
73 views

Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?

Let's assume we have a message $M$ and it's signature $S$ and that $|$ is the concatenation operator. Should we encrypt $S|M$ or $M|S$? Does it even matter?
4
votes
2answers
407 views

Why must we generate the signature before any compression being done at PGP?

I have done some research on PGP and I found out there are of two reasons why we must generate the signature before doing any compression. Yet, I am not sure I really understand them both. One ...
4
votes
0answers
84 views

Security of Fernet Construction (wrt non self delimiting tokens and HMAC short key size)

Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography python ...
4
votes
0answers
57 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
4
votes
0answers
63 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
3
votes
1answer
705 views

What are the potential security impacts of using CRAM-MD5 for Emails, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. But ...
3
votes
3answers
1k views

RSA digital signature vs authenticated cipher

I want to provide both confidentiality and integrity for data at rest (many large files stored on disk). I plan to encrypt the data using AES, which will cover the confidentiality requirement. So ...
3
votes
1answer
271 views

Difference between lightweight, online and low memory Authenticated Encryption schemes

What is the basic difference between the following types of Authenticated Encryption (AE) schemes? Lightweight Authenticated encryption Online Authenticated Encryption Authenticated Encryption for ...
3
votes
3answers
313 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
3
votes
1answer
453 views

Does CBC encryption of a hash provide authenticity?

Given a message $M$ and a cryptographic hash function $H$, let $f(M) = E_K(M || H(M))$ where $E_K$ is AES-128-CBC encryption with PKCS#5 padding. Take $H = \textrm{SHA-256}$ if it matters. In other ...
3
votes
1answer
84 views

Is it acceptable to write the nonce to the encrypted file during AES-256 GCM? [duplicate]

I've used AES-128 in CTR mode in the past and using the same key but different IVs for each file, I wrote the IV to the first 16 bytes. Is it safe to do so with the nonces used in AES-256 GCM? I'm ...
3
votes
1answer
388 views

Where is the authentication tag stored in file encrypted using AES-GCM?

So I am using cryptopp to encrypt a file in a project and I am using AES-GCM. I have a 256bit key and a 128bit ivec and a 128bit tag that I use to encrypt files. However, I want to know where the ...
3
votes
2answers
200 views

CBC-MAC key can be added to ciphertext?

I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC. Does the second key (for CBC-MAC) need to be secret? How to join such key with the ...
3
votes
1answer
2k views

AES CCM vs CCMP

Are the terms AES CCM and AES CCMP are equivalent, or is there any technical differences between the two?
3
votes
1answer
75 views

Are deployed MACs IND-CPA?

There are a number of message authentication codes (MACs) used in practice. They are highly used in practice (f.ex. in TLS), but there's (at least) one application where they can't be used: Full Disk ...
3
votes
2answers
599 views

Does CCA security imply authenticated encryption?

Does CCA security imply authenticated encryption?
3
votes
1answer
223 views

When is it safe to not use authenticated encryption?

I have read the post Why should I use Authenticated Encryption instead of just encryption? When is it safe to not use authenticated encryption? I assumed hard drive volume encryption or per file ...
3
votes
1answer
29 views

Encrypt-then-MAC when encrypting data in multiple blocks

Given a stream cipher such as ChaCha20 and a MAC such as Poly1305, how do we handle data that comes in chunks in the encrypt-then-MAC scheme ? For example, the plaintext is 530 bytes long. We read ...
3
votes
1answer
97 views

Combining public key signature schemes and private key encryption

I'm working on my bachelor thesis and I have some questions. I want to combine a CPA-secure private key encryption scheme and some unforgeable public key signature scheme (in my case some sanitizable ...
3
votes
2answers
376 views

Is authenticated encryption unnecessary if the message is digitally signed?

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
3
votes
1answer
106 views

Encrypt-then-authenticate variant used in IPsec

I am trying to understand the variant of Encrypt-then-Authenticate (EtA) that is used in IPsec. For this I have looked at this chapter. What I got so far is that the integrity and confidentiality ...
3
votes
1answer
72 views

Security of this scheme

I am developing a software and I am not sure if it is completely secure. I have 22 Mb of data to encrypt used multiple times, random IV (generated using RAND_bytes from OpenSSL lib) and password ...
3
votes
1answer
112 views

How do I tack on “additional data” to libsodium's public-key authenticated encryption?

I note that libsodium provides AEAD when using symmetric cryptography. And yet, under section 8 (Public-key cryptography) there are no public-key methods described which allow for additional data (AD)...
3
votes
1answer
93 views

Compression step of PGP

We do compression in PGP. Does this step increase/decrease or either have any effect regarding the authentication of a message?
3
votes
1answer
1k views

Difference entity authentication and implicit key authentication

From the Handbook of Applied Cryptography, in discussions of key sharing algorithms, I see definitions: Implicit key authentication is when one party is assured that no other aside from a ...
3
votes
1answer
310 views

efficient authentication with broadcast encryption?

(I am not a crypto expert, so I apologize if the terminology I use is incorrect.) Suppose I have the following simple broadcast encryption scheme for securely sending content to $n$ authorized ...
3
votes
1answer
229 views

What “Tag Length” should be used for the EAX MAC?

Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ...
3
votes
1answer
56 views

Is it okay to send an encrypted key using XSalsa20-Poly1305, and send subsequent messages using ChaCha20-Poly1305?

I am looking at a cryptographic protocol in a somewhat unusual environment: the communicating parties can share arbitrarily long secret keys over a secure channel. If forward secrecy is not required, ...
3
votes
1answer
67 views

Is there an existing AE protocol with forward secrecy for embedded devices?

I'm working on an embedded device that is connected to a computer over an untrusted channel. According to my threat model I need authentication and encryption on the wire with perfect forward secrecy. ...
3
votes
1answer
69 views

Is authenticated encryption basically a lockable box?

I recently used a custom construction as a commitment scheme, which was taken from the standard picture you give people while explaining commitment schemes. Basically commitment schemes can be ...
3
votes
2answers
141 views

Does authenticated encryption add any protection to a signed digital envelope?

The general scenario of hybrid encryption is to use public key cryptography for the exchange of a one time session key that can be used for the encryption of the plaintext with a symmetric encryption ...
3
votes
1answer
312 views

Is this an acceptable authenticated encryption?

After much deliberation, I've decided to use a normal Encrypt-then-MAC scheme instead of an authenticated encryption mode such as GCM as authenticated encryption primitive. This is due to the lack of ...
3
votes
1answer
56 views

What happens to NORX if the same (key, nonce, header data) triple is reused

As I understand it, reusing a (key, nonce, header data) triple in NORX leaks the XOR of the initial common prefix (but this is zero, so only its length is leaked) the XOR of the first distinct ...
3
votes
1answer
153 views

How to enforce data privacy, integrity and authenticity of distributed firmware images for an embedded device?

I'm developing a bootloader for an embedded device, with which it should be possible for customers (i.e. device owners) to update the device's firmware. It is required that: the firmware is ...
3
votes
1answer
173 views

EAX cipher mode with nonce equal header

I am using EAX AEAD with an 8-byte message header which carries a 32-bit sequence number, a message length, and some other bits that I don't mind exposing. Assuming the sequence number never repeats ...
3
votes
1answer
112 views

Managing data access through asymmetric cryptography

I want to manage authorization, as 3rd-party permissions, through asymmetric cryptography. I'm concerned about how it is possible to share access of encrypted data with N entities, be able to revoke ...
3
votes
1answer
117 views

The exact definition of a symmetric encryption

I have doubts for the definition of the decryption algorithm $D(.)$. I think I've already seen that the decryption returns a plaintext $M$ on input the key $K$ and $C=E_K(M)$. I have also seen that ...
3
votes
0answers
33 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
3
votes
0answers
48 views

Benchmarks for second round CAESAR competitors

I'm interested in how the second round CAESAR competitors stack up in terms of software performance against each other and against chacha20-poly1305 with both small and large messages. Sadly the only ...
3
votes
0answers
66 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...