# Tag Info

7

Thought I'd begin with some references for you that might be of interest. These terms are used as key 'selling points' for a number of schemes, including many of the CAESAR submissions. Some examples using the terms specifically are given below - most of which are from CAESER because I have the zoo in-front of me: "Online": OCB, Ascon, CBA, APE, NORX ...

3

Unless you are absolutely sure that you don't need to and that the cost is going to be significant then I would absolutely say you should use authenticated encryption. One reason is bit-flipping attacks - flipping a few bits at the 'right' point in your encrypted message might lead well to a message that is legal (the classic example is if someone learns ...

3

From RFC 4880 - Open PGP Message Format (emphasis added) OpenPGP implementations SHOULD compress the message after applying the signature but before encryption. As the signature provides authentication, and you specifically ask about authentication, I think that quote from the RFC should answer your question. Compression does not affect ...

1

One of the major advantages of GCM is the authenticated data input that you can pass. Think about headers of a message that you want authenticated but not encrypted. This is a great thing to have in many practical implementations where some data has to stay in clear but manipulating it by an attacker has serious consequences.

1

Seems like the answer is that your goal is obviously impossible, without Bob's cooperation. How would Alice distinguish between (1) a write to the disk by Bob's PC, initiated at Bob's request, vs (2) a write to the disk by Bob's PC, initiated by the malware? She can't. They look identical from Alice's perspective. For instance, having Bob's PC sign ...

1

Yes. $\:$ Since "Eva sees everything written on Bob's PC", the process needs to involve something that's not written on Bob's PC. $\:$ They could use either some sort-of MAC that can be computed with pencil-and paper, or a signature scheme whose private key is held on a hardware token. I don't have any particular such MACs in mind, although my immediate ...

1

Moxie Marlinspike calls it in his article http://www.thoughtcrime.org/blog/the-cryptographic-doom-principle/ the doom principle: if you have to perform any cryptographic operation before verifying the MAC on a message you’ve received, it will somehow inevitably lead to doom. He also demonstrates two attacks which are possible because of trying to ...

Only top voted, non community-wiki answers of a minimum length are eligible