Combination of encryption and authentication in a way that ensures confidentiality and integrity.

learn more… | top users | synonyms

2
votes
1answer
159 views

Security of basic SHA256 MAC in an authenticate-then-encrypt scheme

I know the following construct is insecure if the MAC as defined below is appended to the encrypted message in an Encrypt then Authenticate (EtA) scheme. $k_1$: encryption key $k_2$: authentication ...
1
vote
1answer
101 views

Encrypting and Authenticating The Simplex Communication Between Embedded Devices

I am planning to build temperature sensor nodes for my home heater control. Central device will control the heater using temperature data read by nodes. These nodes will send temperature data to ...
0
votes
1answer
78 views

Which one these alternatives using authentication and encryption will solve this multiple-user database problem?

Which one these alternatives using authentication and encryption will solve this multiple-user database problem ? I'm trying to understand the field of cryptography, so I've started reading a ...
4
votes
0answers
74 views

Security of Fernet Construction (wrt non self delimiting tokens and HMAC short key size)

Fernet is a described as a "high level symmetric encryption recipe" (source) that seems to be the default high level encryption scheme in the cryptography python ...
4
votes
0answers
54 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
4
votes
0answers
61 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
3
votes
0answers
31 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
3
votes
0answers
40 views

Benchmarks for second round CAESAR competitors

I'm interested in how the second round CAESAR competitors stack up in terms of software performance against each other and against chacha20-poly1305 with both small and large messages. Sadly the only ...
3
votes
0answers
63 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
3
votes
0answers
30 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
3
votes
0answers
30 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...
3
votes
0answers
102 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
2
votes
0answers
53 views

StoredKey in Salted Challenge Response Mechanism (SCRAM)

In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure ...
2
votes
0answers
189 views

What are the constraints on using GCM with a tag size of 96 and 128 bits

Say we want to use AES (or any other secure 128 bit block cipher) with GCM and a tag size of 96 or 128 bits. I'm assuming an AES key size of 128 bits and an IV size of 96 bits (the default). NIST ...
2
votes
0answers
49 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
2
votes
0answers
167 views

Design requirements for a keyed hash function?

I am actually preparing for a cryptography exam, and I found a question asked by the professor in the class, below are the lines that I copied from the slide : Example: Let $Ek$ be the encryption ...
1
vote
0answers
70 views

Encrypted comms between devices on LAN

I'm trying to encrypt a protocol that shares data between devices on a local area network (i.e.no connection to the internet). I don't want to use predefined keys because they're too easy to read from ...
1
vote
0answers
24 views

MAC-then-encrypt: Using one-time-MAC with randomized CTR

The Coursera cryptography 1 course says: If you want to use MAC-then-encrypt mode then you should either use randomized-CTR or randomized-CBC. And if you use randomized-CTR then one-time-MAC ...
1
vote
0answers
49 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $...
1
vote
0answers
13 views

Why does HS1-SIV allow forgeries when the SIV collides, even when the PMN does not collide?

The HS1-SIV authors claim that forgeries are possible if an SIV collision occurs. However, I do not understand how this is possible unless the PMN collides too. Otherwise, the collision will be in ...
1
vote
0answers
24 views

Can we use the sponge construct to efficiently authenticate any cipher?

The sponge construct facilitates authenticated encryption independently of the function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the mixing function in a sponge to ...
1
vote
0answers
43 views

Is XSalsa20-Poly1305-SIV a reasonable choice for nonce-misuse-resistant authenticated encryption?

Consider XSalsa20-Poly1305-SIV. This is obtained by: computing a MAC $t_{secret}$ of the plaintext from the key and nonce, as in ChaCha20-Poly1305 except that the plaintext, not the ciphertext, is ...
1
vote
0answers
44 views

Is this a better GCM?

Using the keystream from the block cipher for both parts of the GMAC key (initialization and encrypting the auth tag) seems to produce a better mode of operation than GCM, as successful forgeries and ...
1
vote
0answers
45 views

Designing an AES-based protocol for controlling and acessing ioT boards via RF

I'm designing an open ioT protocol to be used on ioT boards based on Texas Instruments RF-based MCUs. These MCUs have an AES module to easily encrypt and decrypt AES content, so that's why I choose a ...
1
vote
0answers
22 views

Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?

I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
1
vote
0answers
220 views

Mutual authentication with Public Key and session Key

I am trying to understand two protocols for mutual authentication and if they are secure or not. $K$ is the session key, and it's calculated $k=H(TimeStamp)$. Are the following both cases secure? ...
1
vote
0answers
60 views

Smart card Strong authentication / Verification ( fingerprints)

I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working ...
1
vote
0answers
167 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES (...
0
votes
0answers
18 views

Why does HS1-SIV use the universal hash function the second time?

HS1-SIV uses HS1-Hash twice: once with the message as input, and the second time with the authentication tag as input. The second use seems somewhat strange to me: assuming that the core is a strong ...
0
votes
0answers
13 views

SAM module in Payment transactions & cryptogram key storing

As you know because of low security factors,General MCU's are not appropriate choice for storing Transaction or cryptograms keys.Therefor embedded systems developers used SAM modules for secure ...
0
votes
0answers
14 views

Can XTS + checksum be used for authenticated encryption?

Is it possible to use XTS+a checksum for authenticated encryption? Specifically, it seems like a good $n$ bit checksum applied before encryption should ensure that any change to the ciphertext ...
0
votes
0answers
18 views

Why does HS1-SIV not encrypt the SIV with the PMN and key?

HS1-SIV is a good nonce-misuse-resistant, two-pass, AEAD scheme that is part of the CAESAR competition. However, it suffers from forgeries if the SIV collides. It seems to me that encrypting the SIV ...
0
votes
0answers
29 views

Is it okay to bail out early when length mismatch is detected?

Is it okay to bail out early when length mismatch is detected? Specifically, when verifying authenticated encryption, is it okay to bail out early if the wrong amount of ciphertext or the wrong ...
0
votes
0answers
57 views

Encrypt/Decrypt cloud passwords with master password

I know it's generally bad to store password in the clouds, and that I should be using salted-hashed password only. I'm making an application that will authenticate a user (with salted-hash), and then ...
0
votes
0answers
49 views

How to test the speed of an Authenticated Encryption algorithm?

I am trying to implement Authenticated Encryption algorithms using CUDA. Most of Authenticated Encryption algorithms have short message length like 64, 254..., 4094 (Byte). these message lengths ...
0
votes
0answers
22 views

Advantages of the general digraph trust model over the strict hierarchical model

Are there any advantages of using reverse certificates and the general digraph trust model over the strict hierarchical trust model as described here: In the digraph model each CA can generate ...
0
votes
0answers
43 views

Signatures with Hybrid Encryption

Typically, in public-key settings, sign-then-encrypt has been used to provide confidentiality and integrity. However, most public-key cryptosystems use hybrid encryption. I've been searching around ...