In FFX mode the format of the ciphertext is same as plaintext. How does it ensure data integrity and authentication? Is there any bit flip attack in FFX mode? Is it malleable?
2
-
$\begingroup$ It doesn't ensure data integrity. $\:$ It doesn't ensure authentication. $\;\;\;\;$ $\endgroup$– user991Commented May 2, 2015 at 8:40
-
$\begingroup$ Just in case somebody gets confused: if a cipher doesn't have integrity and authentication then it doesn't automatically mean that the cipher is malleable. $\endgroup$– Maarten Bodewes ♦Commented May 4, 2015 at 0:09
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
FFX is not malleable. It's a strong tweakable pseudo-random permutation, where the "strong" here indicates that both encryption and decryption look like random permutations from the attacker's perspective. In particular, there's no relationship between the plaintexts of closely related ciphertexts (aside from the trivial observation that different ciphertexts give different plaintexts).
FFX can provide integrity protection in very limited circumstances. If most plaintexts aren't valid, then you can detect tampering by ensuring that the plaintext is valid upon decryption. (This is not true for encryption in general --- it's another feature of algorithms with strong tweakable pseudo-random permutation security.) For example, if the plaintext contains a checksum, as with a credit card number, then validating the checksum provides some degree of integrity. However, in most cases this isn't a very strong check; a single-digit checksum will allow one in ten forgery attempts to succeed. (See "Encode-then-encipher encryption" by Bellare and Rogaway as well as the RAE definition in "Robust Authenticated Encryption: AEZ and the Problem it Solves" by Hoang, Krovetz, and Rogaway.)
-
$\begingroup$ I presume TPRP stands for Tweakable Pseudo Random Permutation here? $\endgroup$– Maarten Bodewes ♦Commented May 3, 2015 at 23:54
-
$\begingroup$ @MaartenBodewes Yes. I edited my answer to expand the acronym out. $\endgroup$– SethCommented May 3, 2015 at 23:58
-
1$\begingroup$ Question: if most plaintext aren't valid, couldn't you save up bits and add an authentication tag? If there are enough bits available you could even forgo FPE completely. Is there any calculation that can be performed in this regard? Happy to post this as a separate question is this is too complex here... $\endgroup$– Maarten Bodewes ♦Commented May 4, 2015 at 0:02
-
1$\begingroup$ @MaartenBodewes : $\;\;\;$ There would need to be a suitable bijection such that [it and its inverse $\hspace{.62 in}$ can both be efficiently calculated] for that to work. $\:$ I'm pretty sure that that can't always be done. $\hspace{.5 in}$ $\endgroup$– user991Commented May 4, 2015 at 1:53