0
$\begingroup$

Assume the following:

  • $E: \{0, 1\}^k \times \{0, 1\}^b \rightarrow \{0, 1\}^b$ is a block cipher with a $k$-bit key size and a $b$-bit block size.
  • $T$ is a $b$-bit authentication tag that is guaranteed to be untampered with (e.g., by being calculated abd stored by a trusted system).
  • $X_i$ represents the $i$th of a string of data blocks that $T$ is calculated against.
  • $X_i \in \{0, 1\}^b$.
  • $K_1$ and $K_2$ are keys that both $k$ bits long.

If $T_i = E(K_1, X_i \oplus E(K_2, i))$ and $T = T_0 \oplus \ldots \oplus T_{n-1}$, then is $T$ secure as a MAC if it's stored by the party who wants to use it to verify some data? If so, can the calculation of $T_i$ be replaced by a difficult-to-reverse public function that takes $X_i$ and $i$ as input while still remaining secure?

I was driven to design this as an improvement on Apple's anti-replay scheme for their Secure Enclave's memory.

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ In above I think we can presume that $X_i$ is the specific block of plaintext. That's not indicated and I thought that you would use it to represent ciphertext, but no cipher is actually indicated to achieve confidentiality. Note that this is basically CTR followed by ECB mode encryption using a different key, after which the ciphertext is the XOR of all the calculated ECB blocks. That doesn't feel right to me, but I'll have a deeper look. $\endgroup$
    – Maarten Bodewes ♦
    Jul 24 at 20:39
  • $\begingroup$ @MaartenBodewes-onstrike It doesn't matter what $X_i$ is. It's just data stored to be authenticated at a later time, like upon accessing a byte in RAM. It's meant as an improvement upon Apple's replay protection scheme for the Secure Enclave's memory. $\endgroup$
    – Melab
    Jul 24 at 21:06
  • $\begingroup$ can you explain the difference with Apple replay protection scheme and why you think it's an improvement? You have linked to a very long document that you expect people to have the patience to read through. $\endgroup$
    – kodlu
    Jul 24 at 21:23

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.