2
$\begingroup$

I wonder if there is an AES mode which would verify data integrity after decryption operation.

Due to the reasons which does not matter here, there is a possibility that AES implementation I use may produce wrong results under certain conditions (particular data length, memory alignment etc). On the platform, two authenticated encryption modes are available: GCM and CCM.

There is an answer on Crypto which explains that CCM does MAC on plaintext whereas GCM does on cyphertext. Does it mean that if AES should malfunction during decryption, CCM will detect it whereas GCM won't?

Improve this question
$\endgroup$
3
  • $\begingroup$ Why, exactly, would it malfunction? That sounds like a serious bug. I would ensure that the preconditions were met for correct operation. $\endgroup$
    – Demi
    Commented Jun 1, 2017 at 3:48
  • $\begingroup$ @Demi It's just that. The question proper is whether CCM checks tag against decrypted plaintext. $\endgroup$
    – olegst
    Commented Jun 1, 2017 at 5:05
  • $\begingroup$ CCM authentication uses AES (in CBC-MAC). So a bug in AES would break CBC-MAC as well. As an alternative, may I suggest ChaCha20-Poly1305, in one of its many portable, high-quality implementations? $\endgroup$
    – Demi
    Commented Jun 3, 2017 at 18:19

1 Answer 1

Reset to default
3
$\begingroup$

Yes, you are correct, as long as it really only is the AES part which could dysfunction.

Quoting another source, for example Wikipedia's CCM page:

These two primitives are applied in an "authenticate-then-encrypt" manner, that is, CBC-MAC is first computed on the message to obtain a tag t; the message and the tag are then encrypted using counter mode.

Note that we generally do not recommend to do "Mac then Encrypt", however CCM is a mode of encryption which features its very own proof of security, so you are good to go.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.