3
$\begingroup$

Cipher modes typically assume data is streamed or read from a reliable channel with guaranteed ordering. However, many communication transports, such as UDP, are not reliable and don't guarantee order of delivery.

I can imagine that there are are some cipher modes which are packet-oriented and can deal with unreliable, unordered datagrams. Is any specific packet cipher mode to be prefered for use with – for example – UDP? And if, what would be the advantages or disadvantages of its alternatives?

$\endgroup$
2
$\begingroup$

All of them can be used to deal with unreliable, unordered datagrams; as long as you can derive an IV for the UDP packet then a cipher mode of operation should succeed. You need some kind of unique method of identifying the packet of course. Note that (the information used to generate the) IV may be public.

Usually you need some way of identifying the packet in the protocol anyway, otherwise you cannot put the packets in the correct order after you've received them out of order.

The form and properties of the IV of course depend on the mode of operation. For instance CBC requires an unpredictable IV, while reuse of the IV in CTR and related modes of encryption will immediately leak information about the plaintext.

CCM is an authenticated mode of operation that was specifically designed for data packets. It consists of a specific combination of CBC-MAC and CTR mode encryption.

EAX has been specified as a successor of CCM and is a lot easier for general use, but it does not include a specific message format to adhere to. So the I/O of EAX is more like GCM, even though internally it has more in common with the CCM mode of encryption.


[EDIT after re-reading the question]

Note that it is not a good idea to rely on cryptography to reorder your datagrams. If you want to reorder, use a sequence number. If you want to verify the reordering, you can of course use a MAC or signature.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Note that CCM has a rather complex interface (with regards to message size, tag size and order of operations) to keep the number of cipher operations to a minimum; it takes some getting used to. $\endgroup$ – Maarten Bodewes Aug 23 '14 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.