72 reputation
6
bio website
location London, United Kingdom
age 38
visits member for 1 year, 6 months
seen Mar 20 at 11:34

Sysadmin and sometimes BOFH :)


Apr
24
revised Combining AEAD with RSA
Typo
Apr
24
comment Tamper-proofing log files
@StephenTouset I didn't realise I was?! Only thing I'm considering is including the IV and encrypted key in the additional data. I believe you advocate including the IV in the MAC here: crypto.stackexchange.com/a/6076/1254
Apr
24
asked Combining AEAD with RSA
Apr
24
comment Tamper-proofing log files
@StephenTouset I'm no cryptographer! I was planning on using the CNG implementation that ships with Windows
Apr
24
comment Tamper-proofing log files
@RickyDemer Additional Authenticated Data, or just 'AD' if you prefer - I mean the plaintext that is included in the MAC (GHASH) used by authenticated encryption. Assuming AES in GCM mode, I don't believe IV generation is an issue, as the only requirement is that it is non-repeating (doesn't even have to be random) security.stackexchange.com/a/20493/2541
Apr
24
comment Tamper-proofing log files
@RickyDemer do you have any suggestions?
Apr
24
comment Tamper-proofing log files
@StephenTouset but what if the system was down for maintenance (i.e. it stopped logging for a while) - with that scheme (no 'counter' or 'database'), how could we determine whether files were deleted, or the system was down for maintenance?
Apr
24
comment Tamper-proofing log files
Regarding not including the IV or key in the AAD, if I was doing encrypt-then-MAC rather than AE, isn't it good practice to include the IV in the MAC? So shouldn't at least the IV be included in the AAD? crypto.stackexchange.com/a/224/1254
Apr
24
comment Tamper-proofing log files
I'm using Windows, so there is no immutable flag; the next best thing is to change permissions after the file is closed
Apr
24
comment Tamper-proofing log files
Changing the permissions on completed files is a good idea
Apr
24
revised Tamper-proofing log files
Added clarification re confidentiality
Apr
24
comment Tamper-proofing log files
@StephenTouset sorry, I should have said - secrecy of the contents is also important. In which case AE may be considered 'better' because does the encryption and MAC for us in one go - so it may prevent making mistakes during implementation. BTW, it might also be normal for files to be missing for a particular date, for example if the system was down for maintenance, or if simply no data was logged during the period.
Apr
24
awarded  Commentator
Apr
24
comment Tamper-proofing log files
@StephenTouset how is that any better that just using authenticated encryption? How does it allow for detecting if someone deletes a file?
Apr
24
comment Tamper-proofing log files
@rath the IV isn't included in the ciphertext, it's in the additional authenticated data (i.e. in plaintext). Yes, there would be one unique symmetric key per file.
Apr
24
comment Tamper-proofing log files
@Thomas what would they rename it to though - wouldn't we still be able to detect the gap? As a preventative measure, what if the filename is included in the additional authenticated data?
Apr
24
comment Tamper-proofing log files
@RickyDemer the authentication tag provides integrity and authenticity, doesn't it?
Apr
24
asked Tamper-proofing log files
Apr
4
comment RSA digital signature vs authenticated cipher
@HenrickHellström thanks for the clarification - it seems I had the wrong idea about how AES-GCM works and have some more reading to do ;)
Apr
3
comment RSA digital signature vs authenticated cipher
@HenrickHellström maybe I have misunderstood how AES works in GCM mode then - I thought it basically did the same job as if I used AES encryption in CBC mode and then applied an HMAC, such as HMAC-SHA-256, except it did it all in one cryptographic primitive?