Tag Info

New answers tagged

0

I suggest that you look at Signcryption; a short survey appears here, and efficient schemes appear here. Just signing then encrypting or vice versa in a naive way is not secure (especially in the multi-user setting). So you have to do this right. Once you have a concrete scheme, you then have to see what level of security the encryption scheme needs to be. ...


4

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. The ciphertext is the ENTIRE ciphertext (including IV etc.), and this is what must be MACed. This is granted. However, if you MAC-then-encrypt in the ...


1

To obtain the tag, OCB xors the plaintext blocks and encrypts them. Thus a sufficient condition for a forgery is finding another plaintext with the same xor as an existing plaintext. Consider a known plaintext attack where the attacker obtained (plaintext, ciphertext) pairs for two messages encrypted using the same key and nonce. The attacker picks between ...


0

GCM can be defined with 64-bit ciphers, see Appendix A of here: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf NISTs's final GCM spec doesn't include this option. I suspect that this is because the security of GCM's MAC component depends on the difference between the number of blocks in the longest possible message and ...


2

According to Wikipedia, GCM is defined for block ciphers with a block size of 128 bits. So no, you can't use GCM with 3DES or DES, because of the 64-bit block size. You could use something similar to GCM, but it wouldn't be GCM.



Top 50 recent answers are included