0
$\begingroup$

Meaning the same key is used for encryption and decryption (symmetric). The same message always results in the same cipher text (deterministic) and has no memory (conetext free) like nounce or intialisation vector (IV).

Which algorithms exist and are recommended?

Improve this question
$\endgroup$
1
  • $\begingroup$ There is also ECB, but it is insecure even if part of the message is identical so it should not be used. It also - usually - requires padding. $\endgroup$
    – Maarten Bodewes ♦
    Commented Oct 20, 2017 at 9:48

1 Answer 1

Reset to default
3
$\begingroup$

There is SIV mode. It essentially computes a MAC over the plaintext and uses it as IV for encryption. It obviously doesn't offer IND-CPA security, but shouldn't leak anything beyond length of the plaintext and if two plaintexts are identical.

There are some generic constructions as well, like 3 to 4 rounds feistel networks, EME, etc.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Oh, wow. That is rather new and currently incoming to OpenSSL. Is there a current one? Would be a SHA-1 MAC of the message as IV with AES-CBC suffice? $\endgroup$
    – aggsol
    Commented Oct 20, 2017 at 9:44
  • 2
    $\begingroup$ @aggsol Unfortunately that's an area where it's very easy to subtly screw it up in a way that produces practical vulnerabilities to a CCA. Eax prime and various Caesar candidates serve as an example. At minimum you'd have to ensure that padding removal happens after the MAC validation and not before, to avoid padding oracles. I also find the way CBC treats its IV very difficult to reason about (compared to CTR). $\endgroup$
    – CodesInChaos
    Commented Oct 20, 2017 at 10:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.