Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality, integrity and authentication
551
questions
0
votes
0
answers
182
views
Security of CCM using 8 byte MAC within TLS
In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient&...
- 92.6k
2
votes
0
answers
24
views
Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?
Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the ...
- 353
0
votes
1
answer
163
views
Using HMAC with AES modes that do NOT require padding [closed]
I'm trying to use HMAC with AES modes that do not require any sort of padding.
Although I am aware that modes like AES-GCM and ...
- 105
0
votes
0
answers
139
views
What is the best deterministic authenticated encryption algorithm to date?
We have a main database where certain properties are PII and want to setup a read-only replica so other parts of the business can able to access (e.g. analytics)
We'd like those PII properties to be ...
- 101
1
vote
1
answer
217
views
MQV protocol and man-in-middle attack
Why MQV is said to be an “authenticated Diffie-Hellman” protocol? The process in the picture shows nothing about authentication. Besides, a man-in-middle can impersonate B to negotiate with A, because ...
- 13
1
vote
0
answers
262
views
Anamorphic Cryptography, what do you think about it? [closed]
I'm currently working on a personal project using a special kind of crypto I've imagined (noooo please don't !!!), called the Anamorphic Cryptography.
The project: create a complete keyless ...
- 111
4
votes
3
answers
1k
views
What are the benefits of using AEAD algorithms as MAC
I've seen in 2 places where NIST acknowledge the possibility of using AEAD algorithm for MAC (e.g. page 7 section 5.2 of GCM spec, summary for LAEM on page 6 of LWC status report).
And I see 2 ...
- 9,207
0
votes
0
answers
31
views
Authenticating and encrypting data for an automated system
I wish to distribute a file from A to an automated system B.
The requirements are:
Contents are encrypted
Contents are tamper proof
Contents origin is verified
To do this I have devised the ...
- 1
3
votes
0
answers
148
views
How to fix the issue with Gimli full permutation distinguisher?
A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and ...
- 2,126
1
vote
0
answers
166
views
is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?
After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
- 467
4
votes
1
answer
352
views
Possible issues with ECIES using a static (non-ephemeral) sender key
After looking at this bitcoin-related ECIES repo I believe the intention is that, at least in some cases, the recipient would know that the message is intended for them and use an secp256k1 public key ...
- 1,249
2
votes
1
answer
284
views
Why Authenticated Encryption the same message again is not secure?
It is the Exercise 9.14 (9.1) from the book A graduate course in applied cryptography by Boneh and Shoup.
Let $(E, D)$ be an AE-secure cipher.
a. $E_1(k,m):=(E(k,m), E(k,m));$
$$D_1(k,(c_1,c_2)):= ...
- 23
1
vote
1
answer
79
views
If two hosts are using a transparent IP level authentication and encryption, is their communication subject to both MITM or replay attacks?
Encryption process for any outgoing packet to the specified "remote IP":
-original payload P is encrypted (the bytes after the IP header) using RC4 with the preestablished key ...
- 13
3
votes
1
answer
5k
views
What does Modification Detection Code (MDC) in OpenPGP do?
The authentication is often done by an HMAC in modern cryptosystems. What does MDC do exactly in OpenPGP and is it a software hack or an algorithmic authentication?
Also, how to force GnuPG to stop ...
- 133
2
votes
4
answers
2k
views
Is Salsa20+Poly1305 an AEAD?
I see Chacha20Poly1305, XsalsaPoly1305 and AES GCM usually used and mentioned in literature and implementations as AEAD cyphers. My question is that Poly1305 provides authentication and Salsa20 ...
- 123
3
votes
1
answer
878
views
Which is the best algorithm for large scale file encryption other than AES?
I've been looking for a fast, powerful and robust algorithm for encrypting large files with authentication .
I would like to implement the algorithm on my own without using third party software. I've ...
- 1,020
1
vote
1
answer
169
views
Are the signcryption and the authenticated encryption same?
The signcryption and the authenticated encryption are both the combine of encryption and authentication with three natural composition (i.e., EtS, StE, E&S). I am not sure that if they are the ...
- 1,622
3
votes
2
answers
2k
views
Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption
What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required.
does it bring any ...
- 786
0
votes
0
answers
95
views
Interactive ECDHE Authentication With Numeric Code
Trying to simplify my question, keeping only core concepts.
Proposed solution:
Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret.
Device that requests ...
3
votes
1
answer
346
views
Relying on a private public key for authentication
I'm Alice, and I generate a public/private key pair. I securely & confidentially share my public key with Bob and Carol, who securely & confidentially share it with various other benevolent ...
- 275
8
votes
2
answers
3k
views
What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?
I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices.
There are many forms ...
- 181
0
votes
0
answers
125
views
If we have chunk encryption for AES-Rijndael-CBC, should we hash Authenticate/tag each single chunk with a hash vs whole file?
was frustrated by which one to pick and my brain could not guess which one is better Authenticate the whole file as one with a hash vs authenticating each ciphered text.
So very quickly: i have super ...
- 123
2
votes
1
answer
162
views
one-pass deterministic authenticated encryption
suppose there is a router with limited storage but good network connection; it could be a good worker for deterministic authenticated encryption on streams; that means it receives data from another ...
- 729
1
vote
2
answers
218
views
Any standards for canonical ordering of HMAC or additional data in AEAD ciphers?
According to RFC 5116... If the AD input is constructed out of multiple data elements, then it is essential that it be unambiguously parseable into its constituent elements, without the use of any ...
0
votes
0
answers
60
views
Where are labels of a Labeled data used in homomorphic message authenticator stored?
In a fully homomorphic message authenticator, Alice can authenticate
some large data $D$ using her secret key $s$k. She chooses a label $\tau$ for it, and the authentication algorithm authenticates ...
- 13
0
votes
1
answer
142
views
Difference between function $f$ in eval and dec of homomorphic authenticated encryption
In the homomorphic authenticated encryption, as described 1, there are Eval and Dec PPT algorithms:
In Eval, f is the function to be performed on the encrypted data. However, I need to know why it ...
- 13
1
vote
2
answers
571
views
Difference between Tag and Signature
Is there a technical difference between tag such as tag generated by authenticated encryption, and signature such as the signature generated by a functional signature scheme or homomorphic signature ...
- 13
0
votes
2
answers
724
views
Does HMAC provide anything that AEAD does not?
Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available)
Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
1
vote
1
answer
433
views
are there more efficient methods than HMAC to achieve convergent encryption?
I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...
- 125
2
votes
1
answer
231
views
Commitment based on authencticated encryption
Let $(E,D)$ be the encryption/decryption of an authenticated encryption scheme. Consider the following commitment scheme.
Generate a random key $k$. Commit to $m$ by sending $c=E_k(m)$.
Reveal $m$ by ...
- 461
8
votes
1
answer
1k
views
Should we use the new CAESAR competition ciphers?
At the beginning of this year, the CAESAR competition published the final portfolio for authenticated encryption algorithms.
I'm not a cryptographer and when I look at other applications, almost ...
- 573
2
votes
1
answer
692
views
Authenticated Encryption mode & AEAD
I'm studying Authenticated encryption with Associated Data (AEAD).
My questions are
About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the ...
- 325
1
vote
1
answer
199
views
Is using HMAC signature as a long-term password secure?
I'm considering implementing an authentication service without storing users' passwords/hash.
I want to use a key derivation function with a corresponding username...
- 13
0
votes
4
answers
2k
views
Why do one-time pads not provide message authentication?
It is often said that one-time pads do not provide message authentication. But, if you and I have a one-time symmetric key, and I send you a message, and it is not complete gibberish, is that itself ...
- 25
0
votes
1
answer
220
views
Which HMAC scheme more secure?
Which HMAC scheme is more secure? Or are they of the same level of security?
Scheme One
Compute a HMAC on the data to encrypt (cleartext/plaintext)
Encrypt the data with AES_CTR_256, and append ...
- 474
0
votes
1
answer
281
views
Is using the same MAC twice insecure?
I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key.
Here is the full recipe:
Compute a HMAC on the data to encrypt, and append it to the ...
- 474
0
votes
1
answer
503
views
Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]
My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
- 431
4
votes
2
answers
866
views
Is using different public keys for different peers safer than reusing the public key, beyond forward secrecy?
In X25519 (ECDH over Curve25519) Peer A and B exchange their Public Keys ...
- 185
5
votes
1
answer
798
views
AEAD (for AES128-GCM): is it necessary to add a zero-length AAD?
In an implementation of AEAD_AES_128_GCM, if the AAD is defined as a "zero-length octet sequence", is it necessary to call the encryption code that adds an AAD at all? In particular, does an ...
- 53
2
votes
1
answer
78
views
Energy consumption by mobile or sensor node when executing xor / encryption / decryption [closed]
I try to estimate the energy consumption by a sensor node when executing an authentication algorithm witch contains operations (hashing, XOR, Encryption / decryption by public/private key, addition,......
- 21
2
votes
2
answers
773
views
Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?
Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
- 896
1
vote
1
answer
117
views
Decrypt authenticated cipher while still encrypting [duplicate]
Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file ...
- 11
1
vote
1
answer
446
views
What is the difference between an anonymous-encryption scheme and an authenticated-encryption scheme?
I was going through Indy-SDK when these two schemes were referenced. I want to know the precise differences between the two.
Indy-SDK links for reference to:
authenticated-encryption scheme
...
- 11
1
vote
1
answer
339
views
AEAD without explicit authentication tag
I'm trying to understand the purpose of tag in AEAD. As far as I can understand, the resulting ciphertext will be slightly longer than the plaintext due to the authentication tag. Will it reduce the ...
- 77
3
votes
2
answers
1k
views
Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?
The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
- 245
3
votes
2
answers
280
views
Robust authentication and integrity for short OTP message
Using any of the wonders of modern cryptographic technology, how is it possible to package a tweet-sized plaintext, which is to be encrypted with a proper one-time pad, to ensure its integrity and ...
- 3,132
5
votes
2
answers
518
views
Append data to authenticated ciphertext encrypted using a stream cipher
Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
- 1,562
2
votes
0
answers
116
views
Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?
I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it.
The ...
- 21
1
vote
1
answer
430
views
Encrypting more than ~64GiB with AES-GCM - Integrity
I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
user66005
4
votes
3
answers
2k
views
Largest message size for XChaCha20-Poly1305
libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size.
However, the only specification available (still a draft) explains that under the hood the IETF version of ...
- 1,705