I know that one time pad is malleable. Can you give me an example of an encryption scheme which is non-malleable?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ This is the reason why we always (??) use authenticated encryption :) $\endgroup$– gusto2Oct 18, 2016 at 7:00
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
IMHO the best option to mitigate the maleability is using the authenticated encryption. So every scheme that includes the authentication tag should not be malleable (when done properly). Examples - the GCM mode, CCM, etc..
-
$\begingroup$ Just a consideration - the authenticated encryption is used to prevent malleabiity. Therefore using any resonable mode and attaching the a MAC tag will make the schema not maleable. (oh, use only well-known modes, I've seen ways to corrupt the MAC if not done properly) $\endgroup$– gusto2Oct 24, 2016 at 7:47