The Counter with CBC Mac mode, an authenticated encryption mode of operation for a block cipher based on the CTR mode and the CBC-MAC algorithm. .

learn more… | top users | synonyms

3
votes
1answer
72 views

Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?

I would like an answer that could be sustained by a mathematical proof. Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce. I know that when the nonce space ...
5
votes
2answers
135 views

Picking a nonce in the context of CCM (CTR with CBC-MAC) mode

After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says: A nonce N of 15-L octets. Within the ...
1
vote
1answer
85 views

MAC tag size in AES CCM, when using CTR + CBC-MAC (not CBC MAC only)

Assuming that AES CCM is used with respect of the NONCE unicity // the key life cycle, I wonder about the need of using the highest size for CBC-MAC authentication tag if CTR mode encrypts both ...
2
votes
1answer
128 views

Security of integrity protection with HMAC vs AEAD

I'd like to know how the security of the integrity protection compares between: HMAC-SHA-256 with an 32 byte tag or a truncated 16 byte tag AES-GCM with a 16 byte tag AES-CCM with a 16 byte tag or ...
1
vote
0answers
132 views

How does AES-CCM work in BitLocker?

I'm studying this white-paper: http://jessekornblum.com/publications/di09.pdf The author says that using AES-CCM with the external key (highlighted in green at page 9, figure 4) and with the nonce at ...
1
vote
1answer
370 views

Difference between plain AES CTR and “CCM-style” CTR

I am trying to adapt the following function from SJCL, which does "AES-CCM" style CTR encryption, to do "pure CTR" encryption. I am playing around with SIV and would rather use this well-reviewed ...
2
votes
0answers
77 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
4
votes
1answer
997 views

Security of authenticated encryption modes GCM & CCM

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
2
votes
1answer
374 views

Attacking AES/CCM with random IV

A cryptosystem is using AES-128 in CCM mode with random IV. Suppose an attacker capable of: asking the cryptosystem to encrypt a single plaintext as many times as he wants; and asking the ...
7
votes
1answer
4k views

How to choose between AES-CCM and AES-GCM for storage volume encryption

We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
4
votes
0answers
162 views

Unique GCM/CCM initial counters without recipient side message counters

I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...