Heinzi

less info
stack exchange network profile network profile
116 reputation
2
bio website
location
age
visits member for 11 months
seen Jun 18 '12 at 19:00
stats profile views 0

5 Comments

suggestions reviews revisions comments badges posts accepts all
Jun
11
 comment Is this streamable combination of encryption and MAC secure?
I thought it would be enough, because the attacker can't change $IV_i$ for intermediate blocks in CTR mode. But it would be enough to change $m_{x-1}$ to let the algorithm accept the reordered block $data_x$. Didn't see that. So summarizing I have two possibilities: $$m_0=HMAC(IV_0||data_0)$$ $$m_i=HMAC(i||m_{i-1}||data_i)$$ or $$\forall i: m_i=(IV_0||i||data_i)$$Both approaches should provide the same security. Is this correct?
Jun
11
 comment Is this streamable combination of encryption and MAC secure?
Ah you're right. I exchanged CBC by CTR to avoid the BEAST attack. So it would be enough to include $IV_0$ into $m_0$ as described in the question above? Thinking about it I even think that including the block number isn't necessary with CTR mode, because the block number affects the IV. Is this correct? Could I just use the approach of my question with CTR mode and the reordering attack you discovered is prohibited?
Jun
11
 comment Is this streamable combination of encryption and MAC secure?
1) Why do you add $$IV_i$$ 2) Would $$m_x = HMAC(k,m_{x-1} || i || data_i) $$ provide the same security? Including the mac of the last block should prevent file mixing.
Jun
2
 comment Is this streamable combination of encryption and MAC secure?
I don't want to use it in a connection context. I want to encrypt files with it. Files are stored encrypted on an unsecure space (for example dropbox or some other cloud space). When accessing the files I have a proxy which handles encryption/decryption. But the files can be very large and the proxy shouldn't have to keep the whole file in memory.
Jun
2
 comment Is this streamable combination of encryption and MAC secure?
The IV for the encryption is chosen randomly and prepended to the ciphertext. I just mentioned it above to make clear, that the first mac includes it. This should avoid BEAST style attacks - correct?