2
$\begingroup$

The Skein hash function family defines stream cipher and message authentication code modes of operation.

While these two modes can be used together to perform authenticated encryption with associated data, there is no mention of a single mode of operation to do this.

Ideally, a mode would be defined that would support accepting a key , a nonce, the head associated data, the message data to be encrypted, the tail associated data, and then output a tag of specified length similar to the way Norx does. Note that the head and/or tail associated data could be optional.

Given the specification of Skein, would this be something than can be defined?

If yes, how would this be done?

Improve this question
$\endgroup$
1
  • $\begingroup$ This is much like saying that the KECCAK hash function (now standardized as SHA-3) cannot be used to authenticate data. Instead you'll have to use the underlying primitive, in that case the sponge. Using a hash to encrypt data or to create an authentication tag is taking the long way around; you can do it (create a HMAC for the authentication tag, and use the HMAC as well to create a counter based encryption mode) but it will be pretty inefficient. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jan 23, 2023 at 13:45

1 Answer 1

Reset to default
1
$\begingroup$

There doesn't seem to be a way of using Skein in single mode of operation efficiently.

You could however use underlying Threefish tweakable block cipher in "Tweakable Authenticated Encryption" mode to get single pass online authenticated encryption.

Improve this answer
$\endgroup$
5
  • $\begingroup$ I took a look at the TAE mode you linked to and it appears it only works for message data that needs to be encrypted. If you try to add plaintext associated data, it can be manipulated and the TAG will still checkout ok. Any way to fix this? $\endgroup$
    – cookiecipher
    Commented Aug 26, 2022 at 23:27
  • 1
    $\begingroup$ It just occured to me that a way to add associated data would be to encrypt it as the plaintext, but take the ciphertext as the checksum data. This appears to be a secure. Thoughts? $\endgroup$
    – cookiecipher
    Commented Aug 26, 2022 at 23:32
  • $\begingroup$ Check how OCB3 mode does it. It is same as TAE, except it is for non-tweakable cipher. TAE just uses counter in tweak instead of xoring offset. $\endgroup$
    – LightBit
    Commented Aug 27, 2022 at 7:08
  • $\begingroup$ Thanks. I looked at OCB3 and the processing of associated data is identical to how I imagined it. The only thing different was how the final tag was produced. $\endgroup$
    – cookiecipher
    Commented Aug 30, 2022 at 2:49
  • $\begingroup$ The MCOE mode works perfectly! $\endgroup$
    – cookiecipher
    Commented May 29, 2023 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.