New answers tagged authenticated-encryption
It has the disadvantages of any MAC-then-encrypt scheme, which I'm quoting from the linked answer below. In addition: It has the property that you need both a nonce and a hash, so for equivalent security it requires more message space. The nonce has to be random, so it requires strong random numbers for each message, unlike e.g. AES CTR + HMAC. Doesn't ...
I haven't seen much analysis on using ordinary hashes for content authentication. Can anyone can give me a pointer on whether this is safe? With good choice of primitives it is. Public key signatures use a hash function in a similar way to identify the message signed. However, where a MAC only needs what amounts to second preimage resistance, a hash ...
No. RSA-OAEP is indistinguishable under adaptive chosen cipher text attacks (and even non malleable under adaptive chosen cipher text attacks), but it is not an instance of authenticated encryption. - The sender who encrypts the message might even be anonymous to the recipient who decrypts the message. More generally, in a successful Chosen Cipher text ...
No, CCA does not imply authenticated encryption. CCA tries to recover the secret using chosen ciphertexts. A well designed block cipher should in itself already process the property that the key cannot be retrieved. If used with a properly implemented block mode of operation, this property should hold. Using authenticated encryption a CCA attack should not ...
Before answering your questions: GCM is an authentication encryption mode of operation, it is composed by two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It receives as input: a Key a unique IV Data to be processed only with authentication (associated data) Data to be processed by encryption and authentication It ...
Either is fine. If you're not concerned about database size or the size of transmitted keys, it doesn't matter which you choose. They are both secure. Choose whichever is more convenient, or easier to implement, or easier for others to interoperate with, or whatever other (non-security) criteria you might have.
If you are concerned about database size, only the master key needs to be stored when you use HKDF. Ditto when sending it to another computer. Otherwise, two independent random keys are clearly secure and simpler to implement, so you should do that.
If you are certain that SecureRandom is a trusted, verified CSPRNG you can use that without HKDF without problems.
Top 50 recent answers are included