meta user
network profile
| bio | website | |
|---|---|---|
| location | Sweden | |
| age | 40 | |
| visits | member for | 5 months |
| seen | yesterday | |
| stats | profile views | 1 |
|
1d |
comment |
Recommended authenticated stream cipher for minimum overhead? @tylo I understand, but isn't the necessary security of the HMAC also dependent on the protocol. If, for example, a failed HMAC checksum forces a re-negotiation of encryption and signing keys, then you'd basically have to randomly check keys until you get a valid HMAC. And that just gives you the ability to change the bits of a single packet. If the protocol blacklists someone for 5 seconds for violating a HMAC, you have a 50% chance to find a match within 340 years. Or am I doing the maths wrong? |
|
2d |
comment |
Recommended authenticated stream cipher for minimum overhead? I know I shouldn't cross-post, but the type of answers differ widely, so I couldn't resist it. As for the running MAC, I already bundle a counter with the packet (in the encrypted data) to avoid replay attacks. I'm guessing that either: a) putting the counter in the encrypted data or b) adding the counter to the HMAC of c) keep a running hash would be fairly equivalent, or? |
|
Jun 14 |
comment |
Recommended authenticated stream cipher for minimum overhead? What way would that be? |
|
Jun 14 |
awarded | Editor |
|
Jun 14 |
revised |
Recommended authenticated stream cipher for minimum overhead? clarified protocol |
|
Jun 14 |
comment |
Recommended authenticated stream cipher for minimum overhead? @tylo I wasn't seriously suggesting a 1 byte HMAC. What I was wondering was what the good ways are of reducing the size of the extra data needed for integrity. From what I understand then some modes, like CCM offer different MAC sizes, (CCM has a smallest size of 4 bytes). Also, see my clarification regarding how the protocol works in terms of integrity checks. |
|
Jun 14 |
comment |
Recommended authenticated stream cipher for minimum overhead? Yes, but the question is how to minimize the data needed for the fingerprinting. For example as a naive suggestion, one could envision extracting only part of the HMAC for smaller packets making some rule that for a packet of size n the HMAC is max n / 2 bytes long - by taking only that many bytes from the HMAC, starting from the end or front. |
|
Jun 14 |
comment |
Recommended authenticated stream cipher for minimum overhead? @Thomas yes, of course AES-CTR is a stream cipher. In order to avoid trivial bit-flipping of the packets, some integrity checking is necessary. As I understand it there are several ways to put that on top a stream cipher without having a separate HMAC or similar as checksum. |
|
Jun 14 |
asked | Recommended authenticated stream cipher for minimum overhead? |
|
Dec 31 |
awarded | Supporter |
|
Dec 31 |
awarded | Student |
