3
$\begingroup$

I'm running through a protocol specification (LoRaWAN, pdf), and I'm puzzled by the crypto. The data is encrypted and authenticated in the following way:

  • a unique 128-bit key is used;

  • the plaintext is first encrypted in classical counter mode with AES, with counter = fixedData1 | nonce | blockCounter;

  • a MAC is then computed with CMAC AES, on the following message: B0 | ciphertext, where B0 is a block: B0 = fixedData2 | nonce | messageLength; the MAC is truncated an appended to the ciphertext.

I am unable to find any reference to this mode of operation. It seems to be a variation of EAX, but I could not find anything.

Does someone know this mode of operation?

|improve this question
$\endgroup$
  • 1
    $\begingroup$ Looks like a custom "mode" just to allow some associated data to be authenticated with low overhead. $\endgroup$ – otus Oct 27 '15 at 11:46
  • $\begingroup$ B0 (block 0, the first block) feels like a back reference to CCM. EAX was created to have a more flexible mode compared to CCM. So I guess that this is somewhat of a mix of the two (CCM uses CBC-MAC so it is definitely not CCM in case you are wondering about that). $\endgroup$ – Maarten Bodewes♦ Oct 27 '15 at 15:23
  • $\begingroup$ I agree with you Marteen, seems a mix of EAX and CCM. Then, I wonder if the security is ok, since in this case we cannot rely on any proof of security. $\endgroup$ – dots Oct 27 '15 at 16:03
  • 1
    $\begingroup$ Well, it uses CTR and CMAC, which are both pretty standard modes. Both are also used in EAX. One thing that troubles me is that the same key seems to be used for CTR and CMAC (for FPort = 0, whatever that means). I'm not sure if that would be an exploitable weakness. $\endgroup$ – Maarten Bodewes♦ Oct 27 '15 at 23:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.