Let's say there are 2 ciphers, $enc$ and $dec$, where:
- $enc$ will encrypt the data, and $dec$ will decrypt it.
- Both $enc$ and $dec$ must be an AES cipher.
- $enc$ and $dec$ will use the same key $k$ and same nonce $n$.
- The mode of $enc$ should not be equal to mode of $dec$.
- They should not be AEAD ciphers (eg. their modes must not be
GCM
,CCM
etc.) - Both of them should use HMAC (here
HMAC-SHA-256
). Encrypt-then-MAC
is used by $enc$.
Following the conditions, let's suppose $enc$ is AES-256-CTR-HMAC
and $dec$ is
AES-256-CFB-HMAC
, both initialized with some key $k$ and nonce $n$ where:
$$ k_{len} = 32 $$
and
$$ n_{len} = 16 $$
Let $data$ represent some data to feed to $enc$, where:
$$ data_{len} = 32 $$
and $ctext$ be the ciphertext, then:
$$ ctext = enc(data) $$
Let $result$ represent the output of $dec$ when $ctext$ is fed to it, ie:
$$ result = dec(ctext) $$
It is known that $data \ne result$, but the hash $h$ of the HMAC for both $enc$ and $dec$ will be the same. Here are my questions.
- Is this some design flaw, or is it bound to happen?
- If this is not a flaw, then where did my assumption go wrong?
- If there was a flaw in my assumption, what is the correct way to use HMAC with
AES modes that are not AEAD, eg.
CTR
,CFB
, etc?