# Is there any cipher standard based on SHA-3, where it is not used as part of RFC2104?

I'm thinking about using a cipher, which uses AES CTR+SHA-3. My basic idea is this:

IV|AES-CTR(PLAINTEXT_SIZE|PLAINTEXT|SHA-3(KEY|PLAINTEXT_SIZE|PLAINTEXT))


So, basically, the encrypted data contains the following:

• IV for AES-CTR
• AES-CTR encrypted of the following:
1. size of plaintext in 64-bit little endian encoding
2. plaintext
3. Keyed SHA-3 of 1. and 2.

Is there a standard/recommendation, which is like this? I don't want to design the system from scratch, as I certainly will make mistakes, so I'd like to follow some standard designed by experts.

I'd like to use SHA-3 in way I written (if possible), not like as RFC2104 uses it (H(K XOR opad, H(K XOR ipad, text)))

But, if SHA-3 is better if it is used in a Encrypt-then-MAC way, I'll accept it.

• Search for "Encrypt then MAC" and "MAC then Encrypt". Yours is the latter which has some issues in addition to re-using the key. – Thomas M. DuBuisson Nov 30 '17 at 22:21
• @ThomasM.DuBuisson: thanks for the note, I've edited my question accordingly. – geza Nov 30 '17 at 22:33
• Are you sure you aren't conflating prefix-key-hash vs HMAC and the concepts of encrypt-then-mac vs mac-then-encrypt. It seems like you have some crossed wires. – Thomas M. DuBuisson Nov 30 '17 at 22:42
• @ThomasM.DuBuisson: it's possible, I'm a beginner in cryptography. That's why I'd like to follow some standard. Basically, I'd like to have a cipher using AES-CTR+SHA-3, but SHA-3 isn't used in a HMAC-* way. – geza Nov 30 '17 at 22:54
• Look up KMAC. It's the way to use SHA-3 as a MAC. dx.doi.org/10.6028/NIST.SP.800-185 – SAI Peregrinus Dec 1 '17 at 1:24