3
votes
2answers
200 views

Security issues of a MAC-then-Encrypt-then-MAC approach?

Encrypt-then-MAC does provide ciphertext integrity, but no plaintext integrity. With MAC-then-Encrypt it’s the other way around: Plaintext integrity but no ciphertext integrity. What comes to mind is ...
5
votes
2answers
123 views

Does data authenticity always, implicitly, provide data integrity?

Does a scheme which provides data authenticity (e.g. HMAC or RSA signature) always implicitly provide integrity? It seems, to me at least, that it must by necessity. However, I have seen ...
6
votes
1answer
474 views

Practical uses of Manipulation Detection Code (MDC) and IGE

I've just skimmed over most of the paper "On Message Integrity in Symmetric Encryption". I've included (the last) part of the abstract below: We show that generic compositions of ...
3
votes
1answer
198 views

Advantages/disadvantages of different message numbering schemes

For a stream of packets, where each packet is individually encrypted with a block cipher, it's desirable to have each encrypted packet only valid for that position in the stream. A message number ...
2
votes
1answer
265 views

Encrypt-then-MAC paradigm

I read that the Encrypt-then-MAC paradigm is provably secure. From what I understand, when using for example AES for encryption and HMAC_SHA256 for MAC generation (and the keys $K_1 \neq K_2$), this ...
3
votes
1answer
503 views

CBC-MAC , fixed length, all blocks returned

CBC-MAC, with fixed length message. Is it safe to return all ciphered blocks instead of the last? My intuition says it is less secure, since is gives an attacker more information. But how could one ...
5
votes
3answers
601 views

Can I jettison MAC if I already have SHA1(M)?

I'm currently using SSL with AES-CBC and HMAC for a file transfer containing string M. Now suppose Alice already knows SHA1(M) (and the adversary does not), and she downloads M from Bob using only ...