Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Given some string s I want to sign, are following methods are equivalent to produce message with signature, assuming it does not matter whether s is visible in message or not?
s + HMAC(s, secret_key)
AES_CBC(s + string_of_zeroes, secret_key)
And validation:
recalculate HMAC of first part of message and compare it to second one
decrypt message and verify that it ends with string_of_zeroes
If that is true, string_of_zeroes of what length should be taken to make them equivalent?
Given some string
sI want to [integrity protect], are following methods are equivalent to produce message with signature, assuming it does not matter whethersis visible in message or not?
Absolutely not; with AES_CBC, if the attacker modifies one particular block of the ciphertext, then the decryption of the modified ciphertext will have two blocks modified (the one corresponding to the modified block, and one block after that).
Hence, if s is (at least) two blocks long, an attacker can freely modify the first block of the ciphertext; the decryption will still have the string of zeros still in place (as that wasn't modified), and so the attacker has succeeded in undetectably modifying the string.
If you need a MAC, use a MAC (alternatively, authenticated encryption). And, make sure that a MAC is appropriate (that is, both the sender and the receiver share a secret key, and you don't mind if the receiver were able to generate valid-looking messages of his own).
If you need authenticated encryption having only AES available then AES-CMAC is an option. It is standarized in RFC 4493. You must use different keys for encryption and signing.
