3
$\begingroup$

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ?

  1. AES-ECB($key$ , $msg$)
  2. SIV($key$, NIL , $msg$) where associated data is NIL.

I could not make out much from Rogaway and Shrimpton's paper on "Deterministic Authenticated Encryption" which introduces Synthentic IV (SIV) mode.

Edit: Here $msg$ is same as single block .

$\endgroup$
12
  • 2
    $\begingroup$ SIV. As long as an adversary never submits exactly the same message the ciphertext remains indistinguishable from random bits $\endgroup$ Feb 19, 2014 at 12:57
  • 2
    $\begingroup$ No, in ECB mode submitting the same block will leak information - rather than SIV where the entire message must be the same to leak information $\endgroup$ Feb 19, 2014 at 13:18
  • 2
    $\begingroup$ For a single block, ECB is perfectly fine. $\endgroup$ Feb 19, 2014 at 15:40
  • 2
    $\begingroup$ Imagine some data type that is 128 bits like say IPv6 address and for some reason i want to encrypt it deterministically. $\endgroup$
    – sashank
    Feb 19, 2014 at 16:32
  • 6
    $\begingroup$ @pg1989 : $\:$ No; SIV also provides authentication. $\;\;\;\;$ $\endgroup$
    – user991
    Dec 22, 2014 at 19:24

1 Answer 1

1
$\begingroup$

Both:

  • Secure deterministic encryption for one-block messages.

ECB:

  • No expansion for block-sized messages.
  • Faster.

SIV:

  • Authentication.
  • Works for messages of any size.
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.