# Tag Info

1

It is not secure. Suppose an attacker Mallory has oracle access to the encryption device of Alice. Mallory is able to get Alice to encrypt any chosen plain text, but Mallory is not able to decrypt any cipher text that is not chosen by Mallory. A typical, practical, scenario could be that Mallory controls javascript that is executed by Alice's web browser, ...

4

No, it is not necessarily secure. Here is a simplified example of why not. Assume one block zero messages are encrypted without padding. The ciphertext is $I||E(I \oplus 0)$. The MAC value is thus $E(E(I) \oplus E(I)) = E(0)$. So regardless of the IV, the MAC is the same for all such messages. So if you encrypt several zero messages you can leak that fact ...

0

GMAC, for example, is trivially broken if used as an unkeyed hash algorithm. GMAC is effectively a series of operations on blocks where you take the previous state, XOR it with the next block, then multiply it in $GF(2^{128})$ by the derived secret subkey $H$. That is, for data block $A_i$, the next hash value is computed from the previous one as follows: ...

0

In order to provide message integrity, a hash or message authentication function (MAC) is used. Sometimes, encryption and integrity are used together as (i) encrypt-then-MAC: provides ciphertext integrity, but no plaintext integrity, (ii) MAC-then-encrypt: provides plaintext integrity, but no ciphertext integrity, and (iii) encrypt-and-MAC: provides ...

1

This depends on the MAC because there are different kinds of attacks to consider. If the best attack is randomly trying authentication tags, then the key does not matter. If the best attack is brute forcing the key, then key renewal does mean that the attacker has to "start anew", but as long as the key space is large enough that the probability of finding ...

1

It seems to me that the answer to the question, as literally asked, is $0$. This is because you're asking for the minimum advantage "for every adversary", and the set of possible adversaries includes e.g. the trivial adversary that simply always outputs an empty message and a random tag $t \in T$, and thus has a probability of exactly $1/|T|$ of successful ...

1

I am answering on the basis of this paper (pdf) linked in the comments, as well as some of the related papers it cites or is cited by. I am not aware of more realistic attacks on HMAC. It assumes a DPA side channel that leaks the number of bits flipped when a new value is read into a CPU register (or in another instruction in some of the papers). I.e. it ...

0

You're right, it seems like there is a typo in Step 4. The MAC Slave Key should be encrypted with the MAC Master Key, as that is the information that is shared between partners. This is alluded to in the parenthetical, noting that only the partner has the Master Key to decrypt it.

2

It's trivial to calculate collisions because the message blocks M1..Mn can be interchanged without issue. So EK(M1 XOR M2) = EK(M1' XOR M2') where M1' = M2 and M2' = M1. Different messages should obviously not calculate to the same MAC authentication tag.

1

The problem is with XOR-ing the message blocks together to make a single compressed block. This reduces the message in a highly regular way, meaning it would be very easy to construct collisions. A length extension attack on this MAC design can consist of any data at all provided one of the blocks was the binary complement of the remainder - trivial to ...

2

The reason for the padding (and re-positioning of the AAD length) in the later draft is to make implementations easier and faster - i.e. not for a security reason. The rationale for this change was actually documented on the CFRG mailing list by Alyssa Rowan: Instead of the lengths directly following their ciphertexts: ...

2

Which cryptographic algorithm would they want to use? That will really depend on the situation. To select the algorithms one should ask himself (at least) the following questions: Which standards do you trust? Which standard do you have to use? What computations can you afford? Symmetric, or public key based? It again depends on the situation. ...

Top 50 recent answers are included