# Tag Info

57

I'm assuming you actually know all of this better than I do... anyway, this paper neatly summarises all these approaches and what level of security they do or don't provide. I shall paraphrase it in English, rather than Mathematical notation, as I understand it, here: Encrypt-then-MAC: Provides integrity of Ciphertext. Assuming the MAC shared secret has ...

36

@Ninefingers answers the question quite well; I just want to add a few details. Encrypt-then-MAC is the mode which is recommended by most researchers. Mostly, it makes it easier to prove the security of the encryption part (because thanks to the MAC, a decryption engine cannot be fed with invalid ciphertexts; this yields automatic protection against chosen ...

14

As Chris Smith notes in the comments, HMAC is a specific MAC algorithm (or, rather, a method for constructing a MAC algorithm out of a cryptographic hash function). Thus, HMAC can be used for any application that requires a MAC algorithm. One possible reason for requiring HMAC specifically, as opposed to just a generic MAC algorithm, is that the HMAC ...

13

The word "secure hash function" usually means (for a function $H$) Preimage resistance: Given a value $h$, it is hard to find a message $x$ so that $h = H(x)$. Second preimage resistance: Given a message $x$, it is hard to find a message $x' \neq x$ such that $H(x) = H(x')$. Collision resistance: It is hard to find two messages $x$, $x'$ such that $H(x) = ... 13 The nCipher Advisory #13 cited in your securityfocus.com link contains the explanation of the vulnerability (in the section "Cryptographic details"). The CBC-MAC algorithm works similar to the CBC encryption algorithm, but only outputting the final block (or a part of this). Each block of the plain text is XOR-ed with the previous ciphertext and then ... 11 Hugo Krawczyk has a paper titled The Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?). It identifies 3 types of combining authentication (MAC) with encryption: Encrypt then Authenticate (EtA) used in IPsec; Authenticate then Encrypt (AtE) used in SSL; Encrypt and Authenticate (E&A) used in SSH. It proves ... 10 The reason$H(k|m)$(where$|$is concatenation) is not the standard comes from the message extension attack. If I, as an attacker, have$H(k|m)$and$m$, I can compute$H(k|m|p|m')$(where$p$is the padding that$H$would have applied to$k|m$in computing the digest, and$m'$is an arbitrary message) without knowing$k$. I would then send ... 10 You're missing the most important strength of HMAC: it comes with a proof of security (under some plausible assumptions). The outer key plays an important role in the proofs. The best place to learn more is to read the HMAC papers: Message authentication using hash functions: The HMAC construction, Mihir Bellare, Ran Canetti, Hugo Kawczyk, CryptoBytes ... 9 A Message Authentication Code (MAC) is a string of bits that is sent alongside a message. The MAC depends on the message itself and a secret key. No one should be able to compute a MAC without knowing the key. This allows two people who share a secret key to send messages to each without fear that someone else will tamper with the messages. (At least, if ... 9 I'll assumme All ciphered blocks means the same as ciphertext for CBC-Encryption with implicit zero IV, while CBC-MAC is the last block of that. All ciphered blocks is unsafe as a message authenticator for messages longer than one block, for it succumbs to a trivial attack (here with two blocks): Eve intercepts message$M=M_0||M_1$and its authenticator ... 8 This construction is not secure. It was proposed in this paper in a quick sentence for possibly fixing the insecure secret prefix construction from the other question:$\mathcal{H}(k||m)$. The author then proposes and analyzes an enveloping method:$\mathcal{H}(k_1||x||k_2)$. An attack involving finding an internal collision applies to ... 8 In general, a MAC with a known fixed "key" is not a secure hash. That is, you can have a secure MAC (that is, someone without the key, but with a large number of message/MAC pairs, cannot come up with another valid message/MAC pair) that is not collision resistant, or even preimage resistant, if the attacker does know the key. In addition, you don't have ... 8 The generic model for a MAC is the following: the attacker is given access to a block box which implements the$S$function with a key$k$that the attacker does not know of. The attacker is allowed to make$q$requests to the box on messages that he can choose arbitrarily. The goal of the attacker is to make a forgery, i.e. produce values$m$and$t$such ... 7 UMAC is described in full details in RFC 4418. When the RFC talks about "secret selection", it really means "there is a secret key involved here". UMAC works with universal hashing, which can be viewed as a family of hash functions, and a key which selects which hash function we are talking of. The term "hash function" might be a bit confusing here, because ... 6 As mikeazo notes, PBKDF2 supports the generation of arbitrary amounts of key data. It accomplishes this simply by appending a running counter to the salt and rerunning the key derivation process to generate new output blocks, so there's no obvious reason why you couldn't apply the same construction to bcrypt. The scrypt KDF also supports arbitrary-length ... 6 Answering the question as worded in its body: NO,$\mathrm{SHA1}$is not designed so that the proposed construction is secure under the stated conditions. The design objective of the$\mathrm{SHA1}$and$\mathrm{SHA2}$hashes, as explained by NIST, is that it is computationally infeasible to find a message that corresponds to a given message digest, or ... 6 This scheme is totally insecure. If an attacker modifies any part of the ciphertext except the last block before the ciphertext corresponding to H, your scheme won't catch it. CBC decryption of a block only depends on the ciphertext of the previous and current block. (Based on Cbc decryption.png from Wikipedia) The red parts are left totally unprotected ... 6 How does the length extension attack against$H(k||m)$work? For Merkle-Damgård hashes, if you know$H(x)$but not$x$you can still choose an$e$and then compute$H(x||p||e)$. With$x=k||m$you can compute$H((k||m||p)||e)=H(k||(m||p||e))$which is a valid authentication tag for$m||p||e$. Why doesn't it work against$H(m||k)? With a length extension ... 5 A PRG and a hash function are both PRFs, but they have different security considerations. (At least, historically they do. Moving forward some of them may be more closely aligned.) Due to this, building a hash from an existing PRG designed under older security constraints probably isn't a good idea for the intuitive construction of using the plaintext as the ... 5 Whether we get any information from a MAC collision rather depends on the details of the MAC. HMAC is one extreme. If you happen to find a collision (that is, two distinct messages that happen to MAC to the same value), well, that doesn't tell you very much. We don't know how to use that to generate any more collisions, or to gain any information on the ... 5 In TLS (that's the standard name for SSL; TLS 1.2 is like "SSL version 3.3"), client and server ends up with a shared secret (the "master secret", a 48-byte sequence; when using RSA key exchange, the master secret is derived from the "premaster secret" which is the 48-byte string that the client encrypts with the server public key). That shared secret is ... 5 No, in general, this is not secure, unless you make additional assumptions on the encryption method beyond the standard assumption of privacy. To simplify things a bit, the assumption of privacy means that given a ciphertextC$, the attacker has no information about what the plaintext might be. However, in your case, we don't really care if the attacker ... 5 To see why CBC mode still needs a MAC to guarantee message integrity, first recall how CBC mode decryption works: $$P_i = D_K(C_i) \oplus C_{i-1}$$ Here,$D_K$denotes block cipher decryption using the key$K$, and$C_i$and$P_i$denote the$i$-th ciphertext and plaintext blocks respectively. Now, consider what happens if you modify the encrypted message ... 5 In addition to what mikeazo and Ilmari mentioned, there are also several chosen-ciphertext attacks on various modes of operation, which do not only endanger the message integrity, but also the message privacy, when no message authentication is used. For example, such attacks on CBC mode were used to break the XML Encryption Standard, by analyzing the error ... 5 It is easy to see that this secure, in the sense that the attacker cannot cause Alice to accept any download except for the file that Bob originally sent. This remains true even if the attacker knows the encryption (CBC) key (alternatively, Alice and Bob doesn't bother to encrypt the message at all), and if the attacker also knows the correct$SHA1(M)$... 5 If I understand you correctly, you want to use$C = \mathrm{Enc}_{K,N}(m || \mathrm{hash}(m))$as authenticated encryption. This is a bad idea, even for cryptographically secure hashes. Consider an attacker who knows your plaintext$m$and wants to replace it by$m^\prime$. He calculates$C^\prime = C \oplus (m || \mathrm{hash}(m)) \oplus (m^\prime || ...

5

Just thinking out loud here: Take a picture of the contents of a box. Put these pictures in a safe. Ship box and safe together, lock with key of sender. Receiver unlocks safe, compares pictures with contents of box. The safe and keys are already common for symmetric encryption too.

5

Don't believe every claim ever made in any paper ever written, particularly when the paper provides little or no justification for the claim; not everything you read reflects the cryptographic consensus. This is particularly true for a paper written in 2002, which is a time our understanding of authenticated encryption and security engineering was still in ...

5

Digital signatures are used to solve this type of problem. That is, a way for $A$ to sign the message for $B$ so that $B$ is highly confident that $A$ signed the message in question. There are lots of signature schemes out there, such as RSA signing, DSA, and others. A MAC is not strictly a digital signature, but has a subset of that functionality and may ...

5

Yes, this looks fine. I assume $A$ and $B_i$ are trusted parties. The protocol as I understand it looks like this: $A$, $B_1$,…,$B_n$ agree on a secret key k. $A$ broadcasts messages ($m_1$,MAC($m_1$,$k$)), … , ($m_j$,MAC($m_j$,$k$) which $B_1$,…,$B_n$ receive and authenticate. I assume $A$ and $B_i$ are trusted parties, so no $B_i$ will itself ...

Only top voted, non community-wiki answers of a minimum length are eligible