I was playing around with the idea of modifying infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any attempts to alter propagating cipher block chaining (PCBC) mode to provide authentication and I stumbled upon this paper analyzing a proposed authenticated encryption mode that looks a lot like IGE mode. The creator of the mode of operation analyzed in that paper has a blog dedicated to it and also developed one of the entries in CAESAR competition, ++AE.

If you aren't familiar with IGE mode, here is how it works:

  • In the case of encryption:
    • $CT_{0} = E(K, PT_{0} \oplus IV) \oplus IV$.
    • $CT_{i} = E(K, PT_{i} \oplus CT_{i - 1}) \oplus PT_{i - 1}$ for $i > 0$.
  • In the case of decryption:
    • $PT_{0} = D(K, CT_{0} \oplus IV) \oplus IV$.
    • $PT_{i} = D(K, CT_{i} \oplus PT_{i - 1}) \oplus CT_{i - 1}$ for $i > 0$.

I might have garbled the details of it, nyuk nyuk nyuk, because I remember that the value XORed with the output of the block cipher to get the first ciphertext block might have been generated by encrypting the IV in one paper.

I figure that an extension to IGE to provide authentication would consist of appending an all-zero block to the end, encrypting it as if it were just another block of plaintext, and then checking that the value equals zero when the ciphertext is decrypted. However, given the similarity of this idea to the one attacked in the first paper I linked to and said paper saying that these "special modes" have all proven weak, I'm wondering if this idea is also susceptible.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.