I'm thinking about using a cipher, which uses AES CTR+SHA-3. My basic idea is this:


So, basically, the encrypted data contains the following:

  • IV for AES-CTR
  • AES-CTR encrypted of the following:
    1. size of plaintext in 64-bit little endian encoding
    2. plaintext
    3. Keyed SHA-3 of 1. and 2.

Is there a standard/recommendation, which is like this? I don't want to design the system from scratch, as I certainly will make mistakes, so I'd like to follow some standard designed by experts.

I'd like to use SHA-3 in way I written (if possible), not like as RFC2104 uses it (H(K XOR opad, H(K XOR ipad, text)))

But, if SHA-3 is better if it is used in a Encrypt-then-MAC way, I'll accept it.

  • $\begingroup$ Search for "Encrypt then MAC" and "MAC then Encrypt". Yours is the latter which has some issues in addition to re-using the key. $\endgroup$ Nov 30, 2017 at 22:21
  • $\begingroup$ @ThomasM.DuBuisson: thanks for the note, I've edited my question accordingly. $\endgroup$
    – geza
    Nov 30, 2017 at 22:33
  • 1
    $\begingroup$ Are you sure you aren't conflating prefix-key-hash vs HMAC and the concepts of encrypt-then-mac vs mac-then-encrypt. It seems like you have some crossed wires. $\endgroup$ Nov 30, 2017 at 22:42
  • $\begingroup$ @ThomasM.DuBuisson: it's possible, I'm a beginner in cryptography. That's why I'd like to follow some standard. Basically, I'd like to have a cipher using AES-CTR+SHA-3, but SHA-3 isn't used in a HMAC-* way. $\endgroup$
    – geza
    Nov 30, 2017 at 22:54
  • 3
    $\begingroup$ Look up KMAC. It's the way to use SHA-3 as a MAC. dx.doi.org/10.6028/NIST.SP.800-185 $\endgroup$ Dec 1, 2017 at 1:24


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.