0
$\begingroup$

Which one of these functions are preferred for authenticating AES-CTR?

function encrypt(msg, key) {
    encryptionKey, encryptionSalt = newPBKDF2(key)
    hmacKey, hmacSalt = newPBKDF2(key)
    ciphertext = aesCTR(msg, encryptionKey)
    hmac = generateHMAC(ciphertext, hmacKey)
    salt = encryptionSalt + hmacSalt
    return hmac + salt + ciphertext
}

VS

function encrypt(msg, key) {
    encryptionKey, encryptionSalt = newPBKDF2(key)
    hmacKey, hmacSalt = newPBKDF2(key)
    ciphertext = aesCTR(msg, encryptionKey)
    salt = encryptionSalt + hmacSalt
    hmac = generateHMAC(salt + ciphertext, hmacKey)
    return hmac + salt + ciphertext
}
$\endgroup$
1
$\begingroup$

None of them. PBKDF2 should not be used multiple times or for large output. I would recommend to use an additional KBKDF such as HKDF.

function encrypt(msg, passphrase, iterationCount) {
    sessionKey, salt = newPBKDF2(passphrase, iterationCount)
    encryptionKey = HKDF(sessionKey, 'ENC')
    encryptionIV = HKDF(sessionKey, 'IV')
    hmacKey = HKDF(sessionKey, 'MAC')
    ciphertext = aesCTR(msg, encryptionKey, encryptionIV)
    authTag = generateHMAC(ciphertext, hmacKey)
    return salt + ciphertext + authTag
}

Iteration count should be set to high for passphrases. A good passphrase is still required.

As encryption already should be randomised to achieve CPA security there is no need for a salt input to HMAC. Note that replay attacks may still work if you reuse the passphrase, of course. You need to take care of that in the protocol definition.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.