1
$\begingroup$

I am actually looking for using a secure Encrypt-Then-MAC AE scheme , and consider using either an existing "ready-to-use" dedicated AEAD mode (GCM, OCB, CCM, EAX, etc ..) or an alternate composed CTR-Then-CMAC scheme (mainly in order to avoid apparent fragility of GHASH as to limit impacts of accidental IV reuse with gcm)

My questions are the following:

  • If for instance I plan to build a composed CTR-Then-CMAC scheme, I think to process as follows

  • derive two Authentication / Encryption keys from unique input key

  • encrypt plaintext P using CTR mode & input
    Initial counter block (ICB)

  • lastly authenticate the sequence composed of IV, AD and Ciphertext using CMAC.

  • Is is correct ? where / how can we find rules to build correctly a composed AE scheme from input "secure" Encryption & MAC/Authentication modes ?
  • the only standard which addresses such AE generic
    composition seems to be ISO/IEC 19772:2009 which includes
    "Encrypt-Then-Mac" mode beside other AE/AEAD modes; but as such ISO
    standard has to be ordered I didn't still get info about content of
    "Encrypt-Then-Mac" mode section
Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ You might want to narrow down your question a bit. There are really only two things to think of when it comes to AE generic composition (besides using secure building blocks) and that is to use independent keys for confidentiality and integrity, and to include the entire cipher text including the IV in the MAC calculation. However, fitting such an AE scheme into a protocol is not as trivial, and neither is using generic composition for building an AEAD scheme. $\endgroup$
    – Henrick Hellström
    Jun 23, 2013 at 23:02

1 Answer 1

Reset to default
2
$\begingroup$

You might look at EAX mode, which combines a block cipher in CTR mode with a CMAC. However, EAX does differ from generic Encrypt-than-MAC in that EAX uses a single master key, which would be an absolute no-no for Encrypt-then-MAC. Normally using the same key for both purposes is quite dangerous, but EAX is explicit about the use of the master key for the cipher and MAC, and EAX comes with a formal proof of security for that usage (and the entire mode).

Given that EAX (and CCM to a less flexible degree) provide a proven method for encrypting and authenticating data, for practical purposes my advice would be to just use one of the well known and trusted AEAD modes.

For theoretical purposes, the answers to Why choose an authenticated encryption mode instead of a separate MAC? and Should we MAC-then-encrypt or encrypt-then-MAC? should give you a good idea of the steps required to define a your own general composition, and how tricky it is to get all of those right.

The EAX paper also describes and proves the security of an EAX2 mode, which is a generic composition approach to create a two key AEAD mode based on a cipher and a MAC.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Effectively your are right EAX combines CTR mode and OMAC (which I understand has become CMAC). My main difficulty with EAX is that as specified all OMAC & CTR operations use the same key K, I do not see any key derivation / separation in EAX while EAX2 uses two keys , so I am not sure to understand what you mean by "EAX is explicit about the derivation of the cipher and MAC keys from the master key" for EAX. Lastly I agree that it is preferable to use a trusted AEAD which is provably secure rather than to build a composed scheme when not expert. $\endgroup$
    – william_fr
    Jun 25, 2013 at 5:21
  • $\begingroup$ You're right - I've clarified that 'key derivation' here is actually just careful use of a single key for the underlying CTR and OMAC modes. I also added mention of EAX2 - it's actually a well described (albeit 2 key) generic composition approach, and on it's own could answer your question. $\endgroup$
    – archie
    Jun 26, 2013 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.