Timeline for Is there a generic attack on encrypted CRC32 when used as a MAC?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 22, 2014 at 3:20 | history | edited | e-sushi | CC BY-SA 3.0 |
added 4 characters in body
|
| Jul 22, 2014 at 1:58 | history | edited | Antikithira | CC BY-SA 3.0 |
added 458 characters in body
|
| Jul 21, 2014 at 9:19 | history | tweeted | twitter.com/#!/StackCrypto/status/491150372627836928 | ||
| Jul 21, 2014 at 7:03 | comment | added | fgrieu♦ | In my first comment, read "the adversary able to mount a chosen-PLAINTEXT attack". | |
| Jul 21, 2014 at 6:12 | comment | added | fgrieu♦ | @RickyDemer: Yes. Adapted to the present context (with CRC instead of Hash, but that works for a hash just the same): one decides the desired Forgery, computes its CRC, builds 6zeroes||Headers||CRC||Forgery, submits that as (chosen) Data for authentication and encryption; and from the resulting cryptogram removes the first 16 bytes (including 8 bytes IV). What remains will pass verification (the first 8 bytes will be the IV). | |
| Jul 21, 2014 at 5:56 | comment | added | user991 | @fgrieu : $\:$ Is there such an attack when the hash goes before the plaintext? $\;\;\;\;$ | |
| Jul 21, 2014 at 5:52 | answer | added | user991 | timeline score: 3 | |
| Jul 21, 2014 at 5:47 | comment | added | fgrieu♦ | The terminology is not quite right: CRC32 can't be used as (a weak substitute for) a MAC, for it is a keyless transformation of the message. Rather, here, it is used as (a weak substitute for) a hash in a hash-then-encrypt scheme, something which itself does not generally insure message integrity. $\;$ If the IV for the 3DES-CBC encryption is 8 random bytes prepended to the cryptogram, and the length of Data variable, and the adversary able to mount a chosen-ciphertext attacks, then such generic attacks on hash-then-CBC-encrypt work here. | |
| Jul 21, 2014 at 5:26 | review | First posts | |||
| Jul 21, 2014 at 7:21 | |||||
| Jul 21, 2014 at 5:24 | comment | added | Richie Frame | CRC is not a MAC at all, it provides no authentication | |
| Jul 21, 2014 at 5:22 | history | asked | Antikithira | CC BY-SA 3.0 |