Tag Info

Hot answers tagged

18

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples. In CTR mode, an attacker who fiddles with the IV can forge authenticated messages, but the content of the corresponding plaintext is beyond his control (since he doesn't know the key). Depending on the ...


4

The Encrypt then MAC is done in general in order to be sure to decrypt into the correct plaintext, without risking of parsing a non-authentic plaintext message. If you don't MAC the IV, then Mallory (attacker that can tamper with messages as a man-in-the-middle) can modify the IV and your MAC will be still validated as good. So you will decrypt into an ...


3

The answer may depend on your exact definitions of "homomorphic" and "malleable", but I'll give it a shot. Basically, homomorphic encryption denotes that, given encryptions $E_k(x)$ and $E_k(y)$ of some values $x$ and $y$, it is possible to obtain an encryption of $x\ast y$ under $k$ from $E_k(x)$ and $E_k(y)$, where $\ast$ is some binary operation, without ...


3

Vigenere Cryptosystem is as follow: You chose a key $(K_0,...,K_{m-1})$ consisting of elements in $Z_{26}$. Then a ciphertext for the message $(M_0,...,M_{n-1})$ is $$(M_i+K_{i\mod m}\mod 26)_{i \in [0..n-1]}$$ It is easy to see that you can generate a ciphertext for the message $(M_0+1,...,M_{n-1}+1)$ by adding 1 to each letter. It is therefore by ...


2

FFX is not malleable. It's a strong tweakable pseudo-random permutation, where the "strong" here indicates that both encryption and decryption look like random permutations from the attacker's perspective. In particular, there's no relationship between the plaintexts of closely related ciphertexts (aside from the trivial observation that different ...


1

Will this method deliver true non-malleability? No. If we set the ciphertext to the value $(B, B)$, then the decrypted plaintext will have the second block as $B$ (assuming that the PCBC mode uses an implicit plaintext/ciphertext IV of 0; if it's two known constants, it's easy to adjust for that). Even if we ignore this, it also fails to make sure ...



Only top voted, non community-wiki answers of a minimum length are eligible