# Tag Info

12

The crucial difference between plain encryption and authenticated encryption (AE) is that AE additionally provides authenticity, while plain encryption provides only confidentiality. Let's investigate in detail these two notions. In the further text, we assume $K$ to be a secret key, which is known to authorized parties, but unknown to attackers. Goals ...

10

AES-GCM has the following problems: In the case of nonce reuse both integrity and confidentiality properties are violated. If the same nonce is used twice, an adversary can create forged ciphertexts easily. When short tags are used, it is rather easy to produce message forgeries. For instance, if the tag is 32 bits, then after $2^{16}$ forgery attempts and ...

8

In comparison against CBC mode and HMAC, GCM mode is quite commonly better alternative. But, I'll go to detail where it neccessarily is not. Just like Richie Frame, I also do not agree that CBC + HMAC is always the best comparison target. I've added few other details. Hope you find them useful. Against CBC and HMAC I'll discuss downsides first. The ...

7

The article mentions that 3-DES was used to encrypt these passwords in ECB mode. DES has a 64-bit/8-byte block. So let's say you use ECB to encrypt a nine byte password. The first 8-bytes are encrypted using ECB. So far so good. But what happens when we come to the ninth byte? Well we're now in a new block but only the first byte is populated with any ...

7

Thought I'd begin with some references for you that might be of interest. These terms are used as key 'selling points' for a number of schemes, including many of the CAESAR submissions. Some examples using the terms specifically are given below - most of which are from CAESER because I have the zoo in-front of me: "Online": OCB, Ascon, CBA, APE, NORX ...

7

The GQ identification scheme is essentially a zero-knowledge proof of a value $x$ such that $x^\mu \equiv J \pmod N$ where $N$ is an RSA modulus and $(\mu,N)$ are system parameters and $J$ is known to the verifier and $x$ only known to the prover. Now your question is not directly concerned with the aforementioned proof where a user shows the possession of ...

7

If the data to protect has no built-in redundancy at all (for example, has each of its bit determined by fair coin toss), there is no way to protect integrity without expansion (Proof sketch: there are as many distinct possibilities for valid plaintext as there as possibilities for valid enciphered-and-protected data, hence every possible ...

6

A is acting as a square-root oracle in that protocol. We can use that oracle to factor $n$ and break the scheme. Suppose you are an attacker that wants to impersonate A. You: Pick a random $m$; Send $m^2$ to A; Compute $p = \gcd(m_1 - m, n)$, thus factoring $n$. This works with probability $1/2$ for each attempt.

5

The first 32 bytes of XSalsa20 output are used as key for the one-time-mac Poly1305. Poly 1305 needs a new 32 byte key for each message, using part of the key-stream is a natural way to obtain those. Requiring those empty bytes makes implementing the API easier. The implementer only needs to call XSalsa20 on the zero padded input buffer once, receiving both ...

5

I suppose one of the problems (they mention several after a short reading) with a mode like GCM is nonce misuse (e.g. reuse). When the key is the same and the nonce is reused, by misunderstanding the concept or by a simple programming error, information about the plain texts can be revealed. Phillip Rogaway has already defined an encryption mode (SIV, ...

5

Before answering your questions: GCM is an authentication encryption mode of operation, it is composed by two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It receives as input: a Key a unique IV Data to be processed only with authentication (associated data) Data to be processed by encryption and authentication It ...

5

GCM Personally, I would go for GCM (Galois Counter Mode) since it is efficient – meaning: it handles pretty much everything you’ld expect from it, while other modes sometimes tend to lack a specific feature here and there (see image below for a comparison that shows what I’m hinting at). Also, GCM has a pretty good performance (assuming non-flawed ...

4

It has the disadvantages of any MAC-then-encrypt scheme, which I'm quoting from the linked answer below. In addition: It has the property that you need both a nonce and a hash, so for equivalent security it requires more message space. The nonce has to be random, so it requires strong random numbers for each message, unlike e.g. AES CTR + HMAC. Doesn't ...

4

The simple way to build authenticated encryption using a Feistel Network is to build a Feistel based block cipher, then use one of the many modes of operation that turn a block cipher into an authenticated encryption scheme (eg CCM,OCB,GCM). For a good survey on the subject of modes-of-operation I would recommend this paper by Rogaway. It does not cover the ...

4

Because $r$ is not guaranteed to be a Quadratic Residue, so for random $r$ there wouldn't be $m_1$ such that $r \equiv m_1^2(\mod n)$, therefore authentication will be impossible in this case.

4

AES-GCM uses single block cipher operation and can be processed in parallel, therefore it should be faster. CTR+HMAC requires block cipher and hash function, which usually can't be processed in parallel. Also it requires 2 keys. It is often miss-implemented (MAC-than-encrypt or MAC-and-encrypt, using single key). Cipher-text length is the same for same ...

4

What Stephen says in the comment is correct. It is safe to not use authenticated encryption whenever your adversary model assumes that the attacker does not have the ability to manipulate ciphertexts. I assumed hard drive volume encryption or per file encryption that is not transmitted over an insecure network should be considered safe to do without a ...

4

From the sound of your questions, it almost appears that you have some confusion between the CBC-MAC key and the CBC-MAC tag. The CBC-MAC algorithm takes the message (in this case, most likely the ciphertext) and a secret key; it outputs a tag (which can be public). The security property of CBC-MAC is that someone who does not know the key cannot generate ...

3

Unless you are absolutely sure that you don't need to and that the cost is going to be significant then I would absolutely say you should use authenticated encryption. One reason is bit-flipping attacks - flipping a few bits at the 'right' point in your encrypted message might lead well to a message that is legal (the classic example is if someone learns ...

3

When we transmit information across an insecure channel, we wish for our data to be secure. So, what does this mean? To discuss these we'll use the standard cryptographic situation of Alice and Bob. Alice wants to send something (the plaintext) across an insecure channel (what this means will be discussed) to Bob. This channel will be listened to by Eve ...

3

In general signature creation contains the hashing part within the algorithm. A signature algorithm may also contain a padding mechanism such as PKCS#1 v1.5 or PSS for RSA. Finally it contains a one-way trap door function (modular exponentiation within RSA). Encryption has other requirements, and uses a different padding mechanism. Basically you are ...

3

As correctly pointed out in a comment, the authenticated encryption model assumes that the attacker knows the algorithm; the attacker can query the encryption oracle with any plaintext $P$ (and a unique nonce $N$) and get MAC-then-Encrypt ciphertext $C$; the attacker can query the decryption oracle with any string $C$ pretending to be a ciphertext. No ...

3

From RFC 4880 - Open PGP Message Format (emphasis added) OpenPGP implementations SHOULD compress the message after applying the signature but before encryption. As the signature provides authentication, and you specifically ask about authentication, I think that quote from the RFC should answer your question. Compression does not affect ...

3

I guess the answer is no, as long as you are using ECIES then this protocol does not work - you cannot trust the public key of Bob, which is required for ECIES. You could however use ephemeral-static Diffie-Hellman, using ECDH as cryptographic algorithm. Alice would supply the static part as her public key is trusted, Bob may use any key pair. That means ...

3

I would pick EAX as it is by far the simplest to implement and therefore to understand and audit. It is reasonably fast if based on AES. GCM seems quite popular, but I personally see a number of issues with it: it is very difficult to implement in software (which is not surprising, since it was developed with hardware in mind). it is slower than it seems ...

2

If there exists an encryption scheme, then there exists an encryption schemes such that one can easily modify a single ciphertext so that whether or not that modifies the decryption result depends in a predictable-and-useful way on what the plaintext message was, such as: The modified encryption operation outputs a zero concatenated with the original ...

2

A symmetrically encrypted hash is not a secure MAC. You should use either an authenticated encryption scheme or a secure MAC in encrypt-then-MAC. With asymmetric encryption, it may be secure – "encrypting" with the author's private key means you are actually signing the message which is fine. However, you need to use the actual asymmetric primitive, not ...

2

ECB leaks the identity of blocks. After padding some blocks on the end will be eminently predictable, for instance a block with a single 'e' and all zero padding.

2

There exists a case where developers implemented a new version of the GHASH algorithm that used the new PCLMULQDQ instruction found in Intel processors, and a bug in the implementation allowed message forgery. The code change appeared to improve the performance of AES-GCM on newer processors as well as processors with additional cores that do not support ...

2

encrypt it with the message author's private key This statement makes me uncomfortable. Normally, in asymmetric cryptography, one encrypts with the public key and signs with the private key. Did you mean “sign it with the message author's private key”? Otherwise, I would not accept your protocol without a clear, detailed explanation of what encryption ...

Only top voted, non community-wiki answers of a minimum length are eligible