# Tag Info

3

It is certainly wrong to state that "MAC can only be produced with AES in CBC and CFB mode", but there seems to be a simple reason that people were inspired by these modes when thinking up possible MAC constructions: They carry along some state that incorporates information from the message while traversing the input blocks. In both modes, encrypting a block ...

2

That's a lot of questions, I'll try and answer in order. A hash or message digest alone is not secure because anybody can calculate and thus substitute a hash value. If you (correctly) add a key to the mix then you get a HMAC, which can be used. Nowadays often a HMAC is used, or an authenticated mode of authentication such as GCM, CCM (for packet ...

1

Well, you have it right in how nonces are used to make sure that the keys in different SSL sessions; this effectively prevents someone from taking an SSL record from one session, and injecting it into another -- because the keys aren't the same, it won't pass the integrity tests. However, that's not the only place we care about replay attacks; we can also ...

1

For question (1): This page gives some hints on IVs and CBC: https://defuse.ca/cbcmodeiv.htm I copy-paste the part about IVs "predictability" Chosen-Plaintext Attacks Randomness is not enough, though. IVs have to be unpredictable, too[2]. Suppose there is a CBC-mode encryption system that selects a random IV, publishes it, asks the user ...

1

Yes. $\:$ However, note that also using $K$ in the ordinary way would be a huge vulnerability, since learning $H(K,m_1)$ would allow anyone to authenticate $m_1$ together with arbitrary messages $m_2$. The two solutions $H(K,$prefixfree$\hspace{.02 in}(m_1)\hspace{.02 in}||\hspace{.02 in}m_2)$ and if $\: \operatorname{length}(m_2) < ... 1 If the hashing function$H$is secure, then$H(H(K, m_1), m_2)$is secure. But at the cost of applying$H\$ twice.

Only top voted, non community-wiki answers of a minimum length are eligible