2
$\begingroup$

Given some string s I want to sign, are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?

  1. s + HMAC(s, secret_key)

  2. AES_CBC(s + string_of_zeroes, secret_key)

And validation:

  1. recalculate HMAC of first part of message and compare it to second one

  2. decrypt message and verify that it ends with string_of_zeroes

If that is true, string_of_zeroes of what length should be taken to make them equivalent?

$\endgroup$
10
  • 1
    $\begingroup$ HMAC produces a message authentication code, not a signature. $\endgroup$
    – mikeazo
    Sep 1 '16 at 15:58
  • 1
    $\begingroup$ AFAIK MAC is a signature. At least I do not know another term for generic way to validate message integrity. $\endgroup$ Sep 1 '16 at 16:09
  • 2
    $\begingroup$ @SergeyAlaev, no MAC is not a signature. See here for differences. That said, what mode-of-operation are you planning on using for AES? $\endgroup$
    – mikeazo
    Sep 1 '16 at 16:17
  • 1
    $\begingroup$ Maybe you are asking about CBC-MAC security? - en.wikipedia.org/wiki/CBC-MAC $\endgroup$
    – kludg
    Sep 1 '16 at 16:28
  • 1
    $\begingroup$ @SergeyAlaev If CBC-MAC is what you are looking for, I suggest you read Why I hate CBC-MAC. $\endgroup$
    – mikeazo
    Sep 1 '16 at 16:58
13
$\begingroup$

Given some string s I want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?

Absolutely not; with AES_CBC, if the attacker modifies one particular block of the ciphertext, then the decryption of the modified ciphertext will have two blocks modified (the one corresponding to the modified block, and one block after that).

Hence, if s is (at least) two blocks long, an attacker can freely modify the first block of the ciphertext; the decryption will still have the string of zeros still in place (as that wasn't modified), and so the attacker has succeeded in undetectably modifying the string.

If you need a MAC, use a MAC (alternatively, authenticated encryption). And, make sure that a MAC is appropriate (that is, both the sender and the receiver share a secret key, and you don't mind if the receiver were able to generate valid-looking messages of his own).

$\endgroup$
4
$\begingroup$

If you need authenticated encryption having only AES available then AES-CMAC is an option. It is standarized in RFC 4493. You must use different keys for encryption and signing.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.