0
$\begingroup$

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the System.Security.Cryptography .NET namespace an alternative is to use AES-CTR[k1, nonce, message] where nonce = HMAC[ k2, message] given certain constraints are met. However, AES-CTR is also not implemented within the .NET Framework.

BouncyCastle has a C# API which implements AES-CTR [also known as AES-SIC] mode and is FIPS validated. Documentation is scarce. There are two books written by David Hook and Jon Eaves, two of the original developers. BC Fips in 100 Examples and Java Cryptography: Tools and Techniques are the books. This is the solution I will pursue.

My question is:

Given AES-GCM mode is similar to AES-CTR mode Link 1 Link 2 Link 3 does AES-GCM[ k1, nonce, message] where nonce = HMAC[ k2, message] allow me to safely create a deterministic encryption scheme? Is this also misuse-resistant authenticated encryption MRAE?

Improve this question
$\endgroup$
  • $\begingroup$ Possible duplicate of How bad it is using the same IV twice with AES/GCM? If this question is not satisfies you, let us know. $\endgroup$ – kelalaka Apr 3 '19 at 11:37
  • $\begingroup$ AES-GCM-SIV is a related construction which probably is what you want $\endgroup$ – Natanael Apr 4 '19 at 0:04
  • $\begingroup$ So, reusing a nonce for the same message creates a mild vulnerability in that an adversary would know only that the same message is being sent. But, the adversary does not have enough information to obtain K1, K2 or message? And, if I accidentally reuse the same nonce for different messages this also doesn't create a vulnerability because the algorithm I describe above is also MRAE, correct? $\endgroup$ – user67152 Apr 4 '19 at 0:57
  • $\begingroup$ I guess I just want to know does AES-GCM with nonce = HMAC[ message ] provide both 1.) deterministic encryption as well as 2.) misuse-resistant authenticated encryption? $\endgroup$ – user67152 Apr 4 '19 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.