I'm thinking about using a cipher, which uses AES CTR+SHA-3. My basic idea is this:


So, basically, the encrypted data contains the following:

  • IV for AES-CTR
  • AES-CTR encrypted of the following:
    1. size of plaintext in 64-bit little endian encoding
    2. plaintext
    3. Keyed SHA-3 of 1. and 2.

Is there a standard/recommendation, which is like this? I don't want to design the system from scratch, as I certainly will make mistakes, so I'd like to follow some standard designed by experts.

I'd like to use SHA-3 in way I written (if possible), not like as RFC2104 uses it (H(K XOR opad, H(K XOR ipad, text)))

But, if SHA-3 is better if it is used in a Encrypt-then-MAC way, I'll accept it.

  • $\begingroup$ Search for "Encrypt then MAC" and "MAC then Encrypt". Yours is the latter which has some issues in addition to re-using the key. $\endgroup$ – Thomas M. DuBuisson Nov 30 '17 at 22:21
  • $\begingroup$ @ThomasM.DuBuisson: thanks for the note, I've edited my question accordingly. $\endgroup$ – geza Nov 30 '17 at 22:33
  • 1
    $\begingroup$ Are you sure you aren't conflating prefix-key-hash vs HMAC and the concepts of encrypt-then-mac vs mac-then-encrypt. It seems like you have some crossed wires. $\endgroup$ – Thomas M. DuBuisson Nov 30 '17 at 22:42
  • $\begingroup$ @ThomasM.DuBuisson: it's possible, I'm a beginner in cryptography. That's why I'd like to follow some standard. Basically, I'd like to have a cipher using AES-CTR+SHA-3, but SHA-3 isn't used in a HMAC-* way. $\endgroup$ – geza Nov 30 '17 at 22:54
  • 3
    $\begingroup$ Look up KMAC. It's the way to use SHA-3 as a MAC. dx.doi.org/10.6028/NIST.SP.800-185 $\endgroup$ – SAI Peregrinus Dec 1 '17 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.