-3
$\begingroup$

Proposed Cipher suite:

aes-ctr(key, ++iv, sha-1(plainText + aes-ctr(key,iv,0^128))+(plainText + aes-ctr(key,iv,0^128)));

Security targets achieved:

  1. Encryption of the plain text.
  2. Integrity of the plain text.
  3. Authenticity of the plain text.

Used components and reason behind using them:

  1. sha-1: For checking integrity of the plaintext.
  2. aes-ctr: Used for encryption of the plaintext.
  3. aes-ctr(sha-1): sha-1's output is encrypted with aes-ctr to provide authenticity of the plaintext.

Reasons, I think it is secure:

  1. As aes-ctr is secure encryption algorithm we can't predict the key-stream.
  2. To generate a new ciphertext the attacker need to have knowledge about message encrypted. Here the message is sha-1(plainText + aes-ctr(key,iv,0^128))+(plainText + aes-ctr(key,iv,0^128)), which would be unique for every message because of using the key stream aes-ctr(key,iv,0^128). Hence it is not attackable by chosen plaintext attack.
  3. We also can't predict sha-1 value because everytime a new sha-1 would be generated because the text used to generate is plainText + aes-ctr(key,iv,0^128), which contains the unpredictable key stream aes-ctr(key,iv,0^128).
  4. Hence the encrypted message can be authenticated and checked for integrity.

This method is improved version derived from the method proposed in this question.

Improve this question
$\endgroup$
18
  • 2
    $\begingroup$ It's almost certainly not. But your notation is very unclear. "aes-ctr" gets two inuts in one case and only one input in other cases. What does "iv(0)" mean? You should (a) learn some standard notation. (b) If you think you have a secure construction attempt to give a security proof yourself and if you are stuck but still think it's secure ask specific questions. We are not an oracle for half-baked authenticated encryption ideas. $\endgroup$
    – Maeher
    Commented Dec 13, 2018 at 9:18
  • 1
    $\begingroup$ Why don't you just use AES in GCM mode? $\endgroup$
    – forest
    Commented Dec 13, 2018 at 9:24
  • $\begingroup$ @forest may be due to some of these. (crypto.stackexchange.com/questions/18420/aes-gcm-disadvantage) or what if GCM's polynomial H point gets cracked in future. So I am trying to generate a cipher suite which would be totally dependent on aes-crt. Until aes-crt is not broken, we can stay in peace. $\endgroup$
    – distinguishedUser
    Commented Dec 13, 2018 at 9:50
  • 1
    $\begingroup$ @distinguishedUser GCM is not going to get "cracked" in the future. It is proven secure. $\endgroup$
    – forest
    Commented Dec 13, 2018 at 10:00
  • $\begingroup$ @forest This would lead us to know basic working principle of GCM. $\endgroup$
    – distinguishedUser
    Commented Dec 13, 2018 at 10:03

1 Answer 1

Reset to default
3
$\begingroup$

I run a chosen plaintext attack against the authenticity of the scheme as follows:

I request a ciphertext for message $0^{96}\mathbin\|0^{128}\mathbin\|0^{128}\mathbin\|0^{128}\mathbin\|0^{128} = 0^{608}$. A fresh $IV$ will be chosen and a key stream $k_0\mathbin\|k_1\mathbin\|k_2\mathbin\|k_3\mathbin\|k_4\mathbin\|k_5\mathbin\|k_6\mathbin\|k_7$ will be derived from key $k$ and $IV$.

I will receive the $IV$ and a ciphertext \begin{align}c=&(H(0^{608}\mathbin\|k_0)\mathbin\|0^{96})\oplus (k_1\mathbin\|k_2)\mathbin\|0^{128}\oplus k_3\mathbin\|0^{128}\oplus k_4\mathbin\|0^{128}\oplus k_5\mathbin\|0^{128}\oplus k_6\mathbin\|k_0\oplus k_7\\ =&(H(0^{608}\mathbin\|k_0)\mathbin\|0^{96})\oplus (k_1\mathbin\|k_2)\mathbin\|k_3\mathbin\|k_4\mathbin\|k_5\mathbin\|k_6\mathbin\|k_0\oplus k_7\end{align}

I now choose an arbitrary message $m \in \{0,1\}^{96}$ and compute the ciphertext \begin{align} c' = (H(m\mathbin\|k_3)\mathbin\|m)\oplus(k_4\mathbin\|k_5)\mathbin\|k_3\oplus k_6 \end{align} and output $c'$ together with $IV'=IV+3$.

$(IV',c')$ is now a valid ciphertext for $m$. This works, because CTR mode with $IV+3$ will result in a keystream $k'_0\mathbin\|k'_1\mathbin\|k'_2\mathbin\|k'_3 = k_3\mathbin\|k_4\mathbin\|k_5\mathbin\|k_6$

Improve this answer
$\endgroup$
12
  • $\begingroup$ @Maecher This is possible. But how you would get aes-ctr(key,iv,0^128)? aes-ctr(key,iv,0^128) would get dissolved. or I am doing some mistake? $\endgroup$
    – distinguishedUser
    Commented Dec 13, 2018 at 11:49
  • $\begingroup$ I don't understand your question. $\operatorname{AES-CTR}(k,IV',0^{128})=\operatorname{AES-CTR}(k,IV+3,0^{128})=k_3$. So the original ciphertext $c$ just leaks that information. $\endgroup$
    – Maeher
    Commented Dec 13, 2018 at 11:59
  • 1
    $\begingroup$ Which is why, when constructing $c'$ I'm skipping $k_0,k_1,k_2$ and using $k_3$ as my new $k'_0$ by using the initialization vector $IV+3$. $\endgroup$
    – Maeher
    Commented Dec 13, 2018 at 12:12
  • 4
    $\begingroup$ Security against chosen plaintext attacks is the absolute minimum required of any modern encryption scheme. And as I said this is not even necessary. Any known (as opposed to chosen) message of sufficient length is fine. You can reconstruct the keystream by simply xoring the message with the ciphertext. $\endgroup$
    – Maeher
    Commented Dec 13, 2018 at 12:24
  • 1
    $\begingroup$ @distinguishedUser We have a Q&A regarding how to obtain encryptions of chosen messages, you may want to read it. $\endgroup$
    – SEJPM
    Commented Dec 13, 2018 at 12:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.