I'm looking to accomplish a Enc-then-Mac approach using AES-CTR and ECBC-MAC

Now ECBC-MAC requires 2 distinct keys, one for the MAC, and one to encrypt the Tag.

If I do this: Use AES256-CTR for the encryption. Then split the AES256 key into 2, and use each 128 bit key to do AES-128-CBC-MAC and Encrypt the Tag using AES-128.

Is this semantically secure? Or do I definitely need 3 distinct keys?


Don't share keys (or derive new keys with a simple method like splitting the original key) for different purposes. If you can't generate truly seperate keys, get a "master key" and derive two keys for encryption and MAC with a strong hash function.

Sharing a key for encryption and authentication with ECBC-MAC is really bad. Splitting the key to generate new ones sounds insecure, but it could also be secure - do you know it? In any case your scheme will break totally if an attacker learn either your encryption or MAC key. That itself is already bad, but with your scheme it's really simple to get the respective other key, compromising both.

|improve this answer|||||
  • $\begingroup$ Thank you for the answer. Yes I totally get that if someone gets a key, all bets are off! That being said, I was looking to see if there was anyway to eavesdrop or tamper with the message if the attacker did not have access to the key. e.g. a Chosen Cipher Text Attack... $\endgroup$ – nvkris Apr 25 '17 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.