# Tag Info

3

There are a bunch of problems with this protocol. First of all, the way you generate your RC4 key (concatenate a secret key with a public nonce) is known to be weak. The one thing that saves you is that you only do it 256 times before generating a fresh secret key; however it is known that if you were to do it, say, 2000 times with a secret key, you would ...

2

AES-GCM uses single block cipher operation and can be processed in parallel, therefore it should be faster. CTR+HMAC requires block cipher and hash function, which usually can't be processed in parallel. Also it requires 2 keys. It is often miss-implemented (MAC-than-encrypt or MAC-and-encrypt, using single key). Cipher-text length is the same for same ...

1

My goal is to create a voting scheme that doesn't require a lot of crypto infrastructure ... I would like these anonymised ballots to be publicly accessible for verification. It sounds to me like you want a end-to-end voter verifiable voting system. Some of them do require a lot of crypto infrastructure, but it sounds like several others already ...

0

AES-GCM encrypts the plaintext in the Counter Mode. GHASH operates on the resulting ciphertext, so no weakness in GHASH could compromise the confidentiality of plaintext. The GCM authentication is not as strong as that of SHA-256, in particular on short tags. If the tag is $\tau$-bit, an adversary can forge the tag after $2^{\tau/2}$ attempts given the ...

4

The following was originally written as an edit to the question, but I'm going to put it here instead because I think formalizing the schemes might well provide you with enough of a hint for you to solve this question yourself: Let $f(k,m)$ be a pseudo-random function, taking as inputs a key and a message, and outputing a value of the same length as the ...

Top 50 recent answers are included