# Tag Info

8

The paper you cite (Deterministic Authenticated-Encryption...) gives quite a bit of useful information (but I'm assuming you already knew that). It looks like a pretty good read (I'll let you know if that assumption holds after I finish it). For why simpler constructions (CBC/CTR with a MAC or even AEX mode) don't satisfy (emphasis added): A key-wrap ...

5

Yes, you are correct; the keywrap algorithm assumes that you have one long term secure key, which you can use to protect other keys. The writers of RFC 3394 assume that you do have a secure key-encrypting-key (KEK). This doesn't appear to be a valid assumption in your case. In your case, you need to do cryptographical operations even though someone can ...

3

With most standard modes of operation, the encryption of the first bit of plaintext is only functionally dependent on the other input bits in its block (plus the IV if one is used). It isn't dependent on any of the bits in the next block of plaintext, for example. Key wrapping is essentially a mode of operation where the encryption of every bit of input is ...

2

That's a really bad idea. The general rule is that a symmetric key can either be used for key wrapping or for data encryption, but never for both. I assume that the keys already in the devices are currently used for processing data. If such keys are now also used for key wrapping, an attacker may abuse the existing protocols and processing facilities and ...

1

Your proposal is malleable, so in particular, confidentiality does not hold against a chosen-W' attack, which is the key-wrap analogue of a chosen-ciphertext attack. $\:$ Also, the fact that your proposal concatenates s with p suggests that H can probably be evaluated too quickly. Although that may be typical, it shouldn't be, since the time needed to try ...

Only top voted, non community-wiki answers of a minimum length are eligible