Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac
Because I don't have an AEAD-scheme, I can encrypt and authenticate my message in two ways:
Use authenticated-encryption for
message
:let key = KDF(key: master_key, info: "Key:" + unique_message_nonce) let nonce = KDF(key: master_key, info: "Nonce:" + unique_message_nonce) let (encrypted_message, mac) = AuthEnc(key: key, nonce: nonce, message: message)
Encrypt the message and compute MAC over
unique_file_nonce + encrypted_message
:let encryption_key = KDF(key: master_key, info: "EncKey:" + unique_message_nonce) let encryption_nonce = KDF(key: master_key, info: "EncNonce:" + unique_message_nonce) let encrypted_message = Enc(key: encryption_key, nonce: encryption_nonce, message: message) let mac_key = KDF(key: master_key, info: "MACKey:" + unique_message_nonce) let mac = Auth(key: mac_key, message: unique_file_nonce + encrypted_message)
Is the first one secure?
Usually, you would use the 2nd one and authenticate everything because if s.o. tempers with the nonce, he might be able to alter the plaintext without changing the MAC.
However, as far as I can see, in the 1st one the unique_message_nonce
is implicitly included in the MAC:
- If s.o. changes
unique_message_nonce
,key
will change too and the authentication will fail - Without knowing
master_key
, an attacker cannot manipulateunique_message_nonce
to create a maliciouskey