Timeline for Is using EAX mode with a 64-bit block cipher a bad idea?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Aug 27, 2014 at 11:43 | history | bounty ended | Maarten Bodewes♦ | ||
| S Aug 27, 2014 at 11:43 | history | notice removed | Maarten Bodewes♦ | ||
| Aug 27, 2014 at 8:11 | comment | added | Maarten Bodewes♦ | @CodesInChaos OK, thanks. I think you understood my question sufficiently to answer. Interesting thought about the 256 bit blocks size for cipher. I'm mostly on embedded, so ciphers not being a available is/was something to consider, unfortunately. | |
| Aug 27, 2014 at 8:04 | comment | added | CodesInChaos | @owlstead 1) I don't get your question. In my comment I worry about birthday attacks, and D.W.'s answer confirms that the proof of security breaks down as you approach the birthday bound. So we're saying pretty much the same thing, except that D.W. wasn't too lazy to look at the details. 2) As a software guy, a cipher not being available doesn't enter my considerations. There are so many good ciphers that I certainly wouldn't bother with a 64 bit cipher, unless I specifically want one. For my taste even 128 bit blocks are a bit on the low side, I prefer 256 bit blocks. | |
| Aug 26, 2014 at 18:19 | answer | added | Maarten Bodewes♦ | timeline score: 2 | |
| Aug 26, 2014 at 17:55 | comment | added | Maarten Bodewes♦ | @CodesInChaos In contrast to D.W.'s answer, do you think there is still an argument in favor of using a 64 bit block cipher with EAX mode of operation (when a 128 bit block cipher is not available)? | |
| S Aug 26, 2014 at 11:37 | history | bounty started | Maarten Bodewes♦ | ||
| S Aug 26, 2014 at 11:37 | history | notice added | Maarten Bodewes♦ | Reward existing answer | |
| Jun 21, 2013 at 13:46 | vote | accept | hunter | ||
| Jun 20, 2013 at 23:52 | answer | added | D.W. | timeline score: 9 | |
| Jun 19, 2013 at 20:07 | comment | added | Henrick Hellström | 64 bit authentication tags are however subject to online attacks. Normally you can live with a $2^{-64}$ risk of someone generating a valid tag by pure chance, but it might be a problem if the authentication scheme is such that the attacker might lower the odds of success by collecting lots of known plain/cipher text pairs. | |
| Jun 19, 2013 at 19:58 | history | tweeted | twitter.com/#!/StackCrypto/status/347443209108086784 | ||
| Jun 19, 2013 at 19:50 | comment | added | CodesInChaos | A 64 bit authentication tag isn't a big problem. Authentiation tags are not subject to offline attacks. With an ideal 64 bit MAC each forgery has a $2^{-64}$ chance of being accepted. Thus HMAC-SHA256 with a 128 bit key truncated to 64 bits would give okay security. But I don't know how close EAX is to an ideal MAC. Many AEAD schemes decay as message length increases or as more messages are observed. I'm too lazy to investigate how EAX fares. There is also the concern of birthday problem related attacks with $2^{32}$ cost. | |
| Jun 19, 2013 at 19:33 | history | asked | hunter | CC BY-SA 3.0 |