123 reputation
7
bio website
location France
age
visits member for 1 year, 2 months
seen Aug 31 '13 at 11:36

Jul
2
awarded  Curious
Jul
6
comment Security for IV in AES-GCM mode
you are right as iv is internally used by ghash function (gcm/gmac specifity). In my application the complete security header (key number, iv , anti replay counter ...) is de facto included in AD data but as you indicate it was not mandatory for the iv (redundant protection).thanks for the correction.
Jul
6
comment Security for IV in AES-GCM mode
Complementary comment following previous implementation of gcm-aes : iv has as indicated to be appended in clear form with the ciphertext but in addition it must be part of the clear AD data sequence included in mac computation so to prevent at 100% from iv modification. lastly gcm cannot really be compared with hmac which only performs mac based authentication and not encryption
Jul
3
accepted Is it possible to insert a key derivation function when using EAX?
Jul
3
comment Is it possible to insert a key derivation function when using EAX?
@ Ilmari Karonen: Perfectly clear; as indicated answer & explanations given by Archie in previous post were also quite clear, and in fact I realize that I incorrectly understood EAX2 rather as a reference construction aimed to define EAX and demonstrate its security proof, than a candidate AEAD composition. So now the choice appears clearly between trusted EAX or (Key derivation plus) trusted EAX2 . Thanks to all.
Jul
2
comment Is it possible to insert a key derivation function when using EAX?
i agree of course . solution is either a generic ctr then cmac composition with key dérivation or reuse of gcm which only raised a warning in previous application to the concerned reqt because of partial key derivation (K and H used from input K). still thanks for your precise explanations.
Jul
2
comment Is it possible to insert a key derivation function when using EAX?
the source is the french équivalent of nist fips-140-2 that is applicable to my application covering various reqts about crryptographic fonctions and keys handling for solutions that will be then subject to Common Criteria security évaluation.
Jul
2
comment Is it possible to insert a key derivation function when using EAX?
i understand and i really don't aim to tinker with internal design of any trusted mode it's not my rôle. i have to design a solution using EAX which will have to pass Common Criteria evaluation and one of my applicable security requirement indicates explicitely use or separate keys for authentication and for encryption. I can of course use gcm mode with derived ghash key but i am interested with eax and embedded robust omac for authentication.
Jul
2
asked Is it possible to insert a key derivation function when using EAX?
Jul
1
accepted Are stream ciphers no longer considered by NIST?
Jul
1
comment Are stream ciphers no longer considered by NIST?
thanks for answer & post update with missed URL links. I think you're right and nist might not consider a major interest for stream ciphers. this is not a minor concern according to nist rôle.
Jun
30
comment Are stream ciphers no longer considered by NIST?
thanks for estream derived portfolio while i only mentionned stream ciphers standardized by ISO. it is strange for me that no stream cipher appears approved by nist for PRG or for encryption
Jun
30
asked Are stream ciphers no longer considered by NIST?
Jun
28
awarded  Commentator
Jun
28
comment Does EAX use the same keys for encryption and authentication?
OK thanks for your feedback. I feel during that first week on present forum (that i strongly appreciate)to have experimented (not intentionnaly of course) all kinds of errors (post title, post content, comment missed with answers, ..) so I note all your remarks to correct it.
Jun
26
comment Security of authenticated encryption modes gcm & ccm
Thanks for comments - Effectively in my case security & robustness outweight performances (not an issue with low/medium target data rate). According to infos & clarifications given by Archie, EAX appears to me as a very attractive Encrypt-Then-Mac alternative AEAD mode (with provable security) to GCM according in particular to robust embedded OMAC (i.e. CMAC). I understand that EAX is considered as clearly more efficient & flexible than previous CCM mode. Lastly I ignore all about SIV mode and so I will regard it; thanks
Jun
26
accepted Does EAX use the same keys for encryption and authentication?
Jun
26
comment Does EAX use the same keys for encryption and authentication?
Great thanks for detailed & pertinent answer which comforts me in the idea that EAX with OMAC is a very interesting solution when considering GHASH relative fragility with GCM . Two precisions: A/ I referred to security requirements for distinct A/E Keys that always apply for security solutions to be certified / evaluated (NIST FIPS-140, or Common Criteria) -B/ For CTR counter incrementation I uniquely thought to the case of a hardware implementation (FPGA or ASIC) and eventual impacts of handling a complete 128 bits word incrementation rather than a 32 bits word with CTR32 classical scheme
Jun
26
revised Does EAX use the same keys for encryption and authentication?
deleted 26 characters in body
Jun
26
revised Does EAX use the same keys for encryption and authentication?
added 7 characters in body; edited tags