I'm trying to add the authentication for my One-Time Pad implementation.
I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication.
But I don't understand why a solution as the following (that's a lot more easy to implement) doesn't provide the same security level :/
ciphertext = ((plaintext || H(plaintext)) XOR OTPKey) With: || = concatenation H = SHA-2 OTPKey is long enough to encrypt the plaintext and H(plaintext)
Mallory here can't brute force the ciphertext (because of the one-time pad), so he can't get the correct plaintext nor the digest...
Is this right? Can this provide unconditionally secure authentication?
I know that in practice it's vulnerable to known-plaintext attacks so please, don't consider it in this particular case. I'm interested in Unconditional Security in the sense that both the plaintext and the digest can benefit of the Information-theoretic security provided by One-Time Pad.
I'm interested in passive attacks and not in active ones.
Assume that Mallory here knows only the ciphertext ;-)
In other words: can I be sure that an attacker can't obtain the plaintext exploiting possible vulnerabilities introduced by the use of a hash function for the digest calculation?
How about this variant? Can I say that it provides Information-theoretic security for the plaintext AND it is vulnerable against active attacks with complexity of 2^256?
So in this case I can provide a certain level of security against known-plaintext attacks too (even if computational security).
ciphertext = (plaintext XOR OTPKey) message = (ciphertext || H(ciphertext || K2)) With: K2 = 32 bytes of random key, NOT correlated with OTPKey
Thank you to everyone :)