New answers tagged

0

Unfortunately your question doesn't fully specify the authenticated-encryption mode. In particular, AES is a block cipher, not a mode of operation, and only operates on plaintexts of some fixed length (128 bits for AES). So you need to fix a mode-of-operation for AES, such as CBC mode or CTR mode. (Never use ECB mode.) Let's assume you used CBC mode. Then ...


1

Public key encryption uses a public key of the receiver; anybody can encrypt. So origin authentication would only work if you'd also have a shared secret key (in which case the whole public key encryption becomes kind of useless) or a private key (in which case you'd probably use a signature or an authenticated key agreement protocol).


3

You can do either. Though make sure you tighten up how you do the first scheme. In the first case you are going to have multiple tags, 1 for each chunk. In the latter, you will have a single tag. If you are downloading files that are approximately 1MB, I think #2 makes sense. If you are downloading files that are 1GB or 1TB, maybe #1 makes the most sense, ...


9

The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, using GHASH or Wegman-Carter authentication is not sufficient. (Indeed, in GCM, the result of GHASH is masked and not directly output.) The proof of the general ...



Top 50 recent answers are included