# Tag Info

3

This is vulnerable to a length extension attack. Given a valid nonce/MAC, the nonce can be extended to forge a new valid nonce/MAC value. This is because $m_4$ is appended to the end inside the outer hash. How this affects you will depend on how you validate your nonce. But in general, this is not a secure construction. There's probably more things wrong ...

2

Yes, you are reading this right. The requests for random value from NIST 800-90 drbgs perturbed the state. If this is a problem you can add a layer that optionally buffers values and always makes constant size requests.

1

As you can make up from this encryption scheme, I'm using the encrypt-then-authenticate approach to enforce ciphertext integrity. In step 2 of the decryption process I perform this authentication step. If the calculated HMAC turns out to be equal to the HMAC in the file, does this mean, apart from the implied ciphertext integrity, that the supplied ...

Only top voted, non community-wiki answers of a minimum length are eligible