Combination of encryption and authentication in a way that ensures confidentiality and integrity.
53
votes
5answers
6k views
Should we MAC-then-encrypt or encrypt-then-MAC?
Most of the time, when some data must be encrypted, it must also be protected with a MAC, because encryption protects only against passive attackers. There are some nifty encryption modes which ...
13
votes
2answers
533 views
What do the magic numbers 0x5c and 0x36 in the opad/ipad calc in HMAC do?
Wikipedia lists the following pseudocode for HMAC:
...
8
votes
1answer
402 views
Why choose an authenticated encryption mode instead of a separate MAC?
What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa?
Assume there is no ...
4
votes
1answer
581 views
How can I encrypt + authenticate short strings into similar short ciphertexts?
I wish to manipulate short ASCII strings (namely unpredictable domain names) into a form which cryptographically assures authenticity and confidentiality, for use in the local part of email addresses. ...
3
votes
6answers
311 views
Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
8
votes
1answer
207 views
Is Encrypt+HMAC stronger than AEAD?
There are a few posts that I've come across that seem to infer that using regular encryption and a MAC might be better than using the newer AEAD (ie: AES/GCM) modes.
...
3
votes
1answer
202 views
How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?
When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure:
Using PBKDF2 with then entire 128 bit ...
3
votes
1answer
112 views
How to communicate authentication tag for GCM?
I have written some code to do AES in GCM. I currently manually append the tag property to the ciphertext, is this the proper way to communicate the authentication tag?
