I have done a lab about wireless sensor nodes and got in touch with encryption for the very first time. There are some questions on my sheet, especially on integrity protection (the attacker wants to tamper our data) which I wanted to ask about. I read some stuff but I don't feel so comfortable: 1) Why is a simple checksum or MD5 sum insufficient?

I guess because they are not secure anymore. In 2004 some researchers found out that there are 2 different messages with the same MD5 value and one can create more. Same is true for the checksum (?)

2) Is CBCMAC a good way to achieve integrity protection?

If I understood the wikipedia article right it is secure for fixed length messages, for arbitrary long messages it is not secure anymore.

3) Block ciphers are often fast and readily available. When comparing HMAC and CMAC, which do you suspect will work better in a WSN scenario? What are the differences between them?

The differences are quite crucial: HMAC uses hash functions for encrypting and CMAC block ciphers. But I don't know which one is more suited in a WSN. As we have very limited resources one should maybe choose the one which "costs" less in terms of energy?

4) Is it a good idea to use the same key for both encryption and the MAC function?

No it is not, in the CBC-MAC article wikipedia shows a big problem if you use the same key.

5) Are there ways to combine encryption and itegrity protection? Name at least two examples. Is a single key sufficient in these cases? Do different approaches differ with respect to their performance characteristics? Will such an approach be usually faster, slower or equal to doing encryption and MAC calculation as separate steps?

I guess this question is about authenticated encryption. The wikipedia article (http://en.wikipedia.org/wiki/Authenticated_encryption) is quite short and I can't find many information about these questions ...

I am thankful for any help


closed as too broad by D.W., DrLecter, yyyyyyy, poncho, e-sushi Jan 17 '15 at 22:31

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ Doesn't sound very confused to me. $\endgroup$ – Maarten Bodewes Jan 12 '15 at 19:30
  • $\begingroup$ For the future: 1. One question per question please. This site format doesn't work so well when you have a bunch of different questions stuffed together. 2. Please do more research before asking. We expect you to do a significant amount of research and self-study. Many of your questions are already answered in standard resources (textbooks, online resources, other questions on this site). $\endgroup$ – D.W. Jan 15 '15 at 0:04

That's a lot of questions, I'll try and answer in order.

  1. A hash or message digest alone is not secure because anybody can calculate and thus substitute a hash value. If you (correctly) add a key to the mix then you get a HMAC, which can be used.

  2. Nowadays often a HMAC is used, or an authenticated mode of authentication such as GCM, CCM (for packet encryption) or EAX. If you want to use a MAC based on a block cipher you can use AES-CMAC. You'll need a 128 bit block cipher though.

  3. Yes, you should check if hashing or encryption is most efficient on your platform. You could also have a look which one is least vulnerable to side channel (timing / energy usage) attacks. You want to try and find the best crypto library available if you have only just seen crypto for the first time.

  4. You already answered it. Although it is less a worry in HMAC, for AES-CBC-MAC and even AES-CMAC it is considered best practice to use a separate key for encryption and calculation of the authentication tag. Usually deriving an additional key is not that much of a performance issue. Note that it is strongly recommended to use a key for each direction as well, and to make sure your IV is unique (and - for CBC - unpredictable). Your MAC should include the IV, not just the ciphertext.

  5. I think I just named 3 authenticated ciphers in answer 2), all of them use just a single key (externally, anyway) and auto-include the IV within the authentication. GCM and CCM are NIST standardized, EAX is a proposed mode to NIST but - as it simply uses AES-CMAC internally - it's very likely secure.

  • $\begingroup$ Note that this answer doesn't touch the tricky topic called key management - setting up the session keys in a way that is secure, authentication and such. That may be a trickier thing to get right than the actual encryption. Same with random number generation, probably. $\endgroup$ – Maarten Bodewes Jan 12 '15 at 19:25
  • $\begingroup$ Thank you Maarten. Your answers helped me a lot. Do you know about the performance between authenticated encryption and doing both seperatly yet? $\endgroup$ – AlexConfused Jan 12 '15 at 19:38
  • $\begingroup$ That unfortunately depends. CCM is based on CBC-MAC and EAX on AES-CMAC. These are so called "two pass" modes. There is GCM mode, which depends on 32 bit multiplication for GMAC, it can be thought of as 1.5 pass, but it depends on the system how fast GMAC actually is; it may not do so well on embedded systems. There is also OCB mode (version 3 by now, if I'm not mistaken), it's single pass but patented. Except for OCB, probably not that much difference (also depends on the library of course). Overhead may vary somewhat. GCM, CCM and EAX all use AES-CTR underneath by the way. $\endgroup$ – Maarten Bodewes Jan 12 '15 at 19:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.