13 reputation
4
bio website
location
age
visits member for 1 year
seen Dec 13 '13 at 11:07

Dec
8
awarded  Popular Question
Apr
11
awarded  Commentator
Apr
11
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
A MAC with the same key would also avoid that problem, I guess? But never reuse the same key, as Gilles also stated, is better.
Apr
11
accepted AES+CTR+HMAC Encryption and Authentication on an Arduino
Apr
11
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
thanks! The last paragraph is very helpful.
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
@fgrieu: could you explain why encrypt-then-HMAC-except-IV does not provide integrity? I can still verify the integrity of the ciphertext, right? But then the decryption of the ciphertext would lead to garbage in case someone had altered the IV, is that the reason? Thanks!
Apr
9
awarded  Scholar
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
@Gilles: I agree. But the plaintext I thus decrypt can't be checked successfully with the hash that is included in the encrypted message. I.e. I wouldn't even try to use the content if the message authentication fails. As for the entity authentication, I agree, except for what you stated earlier: it does not prevent replay attacks. But the HMAC data authentication, it does imply integrity.
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
@Gilles: Sorry, I can't follow you. How does the HMAC provide entity authentication? It is using symmetric keys, thus we cannot say who is authenticated. But we can authenticate the message with the HMAC? Maybe I am dead wrong here, but I don't get it (yet).
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
@Gilles: Thanks for answer about authenticating the IV as well. Do you have a link to a peer-reviewed article about this, or a book? Not trying to be ironic here, I need to provide some sort of literature on why I have chosen this particular approach.
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
@Gilles: I am absolutely positive that message authentication implies message integrity. Replay does not matter in this context. link But maybe you mean entity authentication?
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
I beg to differ on one point: authentication always implies integrity.
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
Since I need an IV that the Arduino can reproduce, I need a counter. Of course I can start with 128 0's, but I thought that it would be more suitable to use a hash function to derive the IV from the counter, since we are using AES in CTR mode. Also, using TLS is hard on Arduino Uno? I know of no libraries that perform fast enough.
Apr
9
comment AES+CTR+HMAC Encryption and Authentication on an Arduino
Gilles, thanks for your answer. For performance reasons and for the lack of a suitable library, we have to invent our own protocol. What I do not understand is: if I encrypt the SHA-256 hash of the message together with the message, then by decrypting the message I should be able to verify the integrity and also authenticate it? Not really according to the book, but still? Also, if I don't authenticate the IV, there will only be garbage that cannot be successfully checked for integrity, since the encrypted message itself contains a hash of it for checking integrity?
Apr
9
awarded  Student
Apr
9
asked AES+CTR+HMAC Encryption and Authentication on an Arduino