# Tag Info

2

If a MAC is encrypted using CTR specifically then specific bits can still be flipped by an attacker. So although the MAC isn't known, specific bits can still be altered in transit. This may allow certain attacks, depending on the error handling of the receiver of the protected messages. [The question I cannot readily answer is if such a small authentication ...

1

No, this is not a typical way to go. Actually Encrypt-then-MAC would be the best way to go, attaching the MAC (in this case a CMAC) as is to the encrypted data. Before starting the decryption, you would first check the MAC. Even in this setup using two different keys - one for the AES encryption and one for the CMAC - should be used. Finally I am confused ...

1

1) To perform verification in the order $p$ subgroup (if the order is $n=pq$ for $p,q$ prime, $a^q$ maps an element $a$ into the order $p$ subgroup - and this clearly also holds in the target group). 2) The argumentation in the unforgeability proof is that switching from $h$ of order $n$ in the common reference string of the GS proof to $h$ of order $q$, ...

1

It is clear that if $r_i$ is picked randomly the above Mac [defined in the second paragraph] would be secure. Actually, that's not at all clear. I would claim that if I were given that values of $Mac_i(a)$ and $Mac_i(b)$, I could compute the value of $Mac_i(x)$ for any $x$, as long as $a-b$ is relatively prime to $p-1$. To do this, I need the value of ...

Only top voted, non community-wiki answers of a minimum length are eligible