Tag Info

Hot answers tagged

6

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. The ciphertext is the ENTIRE ciphertext (including IV etc.), and this is what must be MACed. This is granted. However, if you MAC-then-encrypt in the ...


2

No. Yes, by choosing an authenticated encryption scheme with a known $\:I\hspace{.03 in}V\hspace{.04 in}||\hspace{.04 in}C\hspace{.04 in}||\hspace{.04 in}tag\:$ and $k_{\hspace{.02 in}0}$ and $k_1$ such that decrypting $\:I\hspace{.03 in}V\hspace{.04 in}||\hspace{.04 in}C\hspace{.04 in}||\hspace{.04 in}tag\:$ with $k_{\hspace{.02 in}0}$ and $k_1$ yields ...


1

The following picture shows EAX: As you can see there is a OMAC calculation (or CMAC as it is usually called) over both N (the nonce) and H (the header / associated data). With regards to security it doesn't matter where you place the nonce and the other data in the header. I'll not go into the security of XOR'ing the calculated OMAC values for nonce, ...


1

If by authenticated encryption we mean encrypt-then-MAC then that provides some mitigation against side channel attacks - timing, error responses etc - because it allows you to detect that the message has been tampered before you start decrypting it and in something hopefully close to constant time. It is perhaps worth mentioning that in TLS the opposite ...


1

I suggest that you look at Signcryption; a short survey appears here, and efficient schemes appear here. Just signing then encrypting or vice versa in a naive way is not secure (especially in the multi-user setting). So you have to do this right. Once you have a concrete scheme, you then have to see what level of security the encryption scheme needs to be. ...



Only top voted, non community-wiki answers of a minimum length are eligible