0
$\begingroup$

I want to send/receive messages with A (an peer) using TCP socket.
I want to encrypt messages using AES CBC.
Only I and A know a symmetric key K1 used in AES CBC, and K2 used in HMAC.
The size of each message is small( < 100 bytes).
Low latency is needed.
(verification per message is needed.)

Then, I want to verify if the messages are encrypted by A.

Idea 1:
Calculate HMAC of each message.
example: Messages = M1 HMAC(M1) M2 HMAC(M2) ....
Send(AES_CBC(Messages))
Receiver decyprt Messages and checks if sent "HMAC(M1)" is the same as HMAC(sent "M1").

Idea 2:
Pad zero bits.
example: Messages = M1 Z1 M2 Z2 ....
Send(AES_CBC(Messages))
Receiver decrypt Messages and check if Z1 is zero.

My question is "Are Idea 1 and 2 secure as assumed by length of bits?"
(example: I put 8bit HMAC or zeros, then I can't break verification the probability of larger than 1 / 256?)

Sorry for my poor English.
Thank you.

$\endgroup$
2
$\begingroup$

Idea 1 is similar to what TLS actually does (and begs the question "why aren't you using TLS?"). Modern thought is that it'd be generally better if you first encrypt, and then perform the MAC, as in:

E := AES(M)

Send IV, Encrypted HMAC(IV | Encrypted)

But no radical problem is known with your idea (unless you send M1 and M2 at different times; if you do, you open yourself up to a chosen plaintext attack -- however, that's an issue with CBC mode, not your general idea)

On the other hand, idea 2 is known to be broken; if the messages are longer than 32 bytes, then the attacker can (for example) modify one of the first bytes in the encrypted region that holds M1; on decryption, this would modify the first 32 bytes of M1, but nothing past that. That is, the encrypted zeros would still decrypt as zero, and so the attacker has managed to modify M1 undetected.

$\endgroup$
  • $\begingroup$ You could argue that IV is part of the ciphertext. Anyway, if it is not included in the MAC calculation and the attacker can alter the IV then the HMAC will succeed but the plaintext will still be invalid. So I put it into the answer just to be sure. $\endgroup$ – Maarten Bodewes Jun 18 '15 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.