6
$\begingroup$

I have an embedded application that needs to occasionally get secure updates from a server. The only crypto library I have available for the chip is an AES-256 cipher (ECB and CBC, encrypt/decrypt).

Is there any worthwhile way to authenticate the message using only these functions and simple checksums? If I just did something like a 32 bit checksum of the plaintext and appended it before encryption, would that be vulnerable to attack (other than being only 32 bits of protection)?

$\endgroup$
8
$\begingroup$

Is there any worthwhile way to authenticate the message using only these functions and simple checksums?

As usual, of course there is: AES-CCM!

AES-CCM basically is CTR mode with a tagged-on CBC-MAC and length prepending. You can implement CTR trivially using your ECB primitive and CBC-MAC shouldn't be too hard to implement given a CBC primitive and direct function access.
If implementig CTR is infeasible, CBC should do the job just as well.
If you want to go fancy (and don't live with length-prepending) you can also go for AES-EAX although it's a bit more difficult to implement.

If I just did something like a 32 bit checksum of the plaintext and appended it before encryption, would that be vulnerable to attack (other than being only 32 bits of protection)?

No, this is a bad idea. Not only is a checksum usually not safe in the sense that a proper cryptographic hash would be, but also is this composition already insecure as fgrieu explained much better than I ever could in his answer to "Why is plain-hash-then-encrypt not a secure MAC?".


Relevant standards: CCM: RFC 3610, NIST SP 800-38C (PDF); EAX: The original specification

$\endgroup$
  • $\begingroup$ Thanks, very interesting. Can you elaborate on what you mean by "CBC-MAC shouldn't be too hard to implement given a CBC primitive and direct function access"? $\endgroup$ – Chriszuma Jul 15 '16 at 20:19
  • $\begingroup$ @Chriszuma, CBC-MAC basically is just CBC over the data (e.g. the ciphertext) with its own key and maybe (depending on the exact variant used) requires applying ECB (=direct function access, you basically have AES at your disposal) once more on the last block. $\endgroup$ – SEJPM Jul 15 '16 at 22:37
  • 1
    $\begingroup$ EAX mode could also considered; it's CTR mode with AES-CMAC authentication. AES-CMAC is relatively easy to forge from CBC-MAC as used by CCM mode. CCM mode is a packet oriented mode of operation which describes a specific format with some nasty surprises. EAX is a much more flexible AEAD cipher. Of course in the end you can use any authenticated cipher that can be build from AES as single block AES-ECB (without padding) is the block cipher. Dare I mention OCB? Guess I just did. $\endgroup$ – Maarten Bodewes Jul 16 '16 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.