1
$\begingroup$

I want to provide confidentiality and integrity for a protocol. I don't want to encrypt the entire protocol message. I do not want to encrypt the header and timestamp of the protocol message, but I want to have the integrity for the entire protocol message. Thus I do the following:

1- encrypt the message except for the header and timestamp by using CBC.
2- digest the entire message (header, timestamp and encrypted message) by using HMAC.

Is that good practice? if No, what is the best practice?

$\endgroup$
2
$\begingroup$

Is that good practice?

If you use different and independent keys for HMAC and CBC and include the IV for CBC in the digest and use different key-pairs for both transmission directions, then yes, this is a good encryption scheme.

what is the best practice?

As Eugene Styer noted in their answer it is best practice to use ready-made authenticated encryption with associated data (AEAD) like AES-GCM, AES-EAX, AES-CCM, ChaCha20-Poly1305, ... for this which allows you to input your header as "associated data" and your message as plaintext. Your environment may already provide a NaCl / Sodium library which includes AEAD functionality.

$\endgroup$
2
$\begingroup$

Basically what you want is a authenticated encryption with associated data (AEAD) encryption scheme, of which there are several already available in various libraries. So just see what is available on your system and use one of them.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.