Linked Questions

2 votes
2 answers
115 views

Using the MAC to verify if Cipher Only attack has succeeded

I am working on an experiment to compare the efficiency of brute-force attacking block ciphers like AES and DES with reduced key sizes for different programming languages and library implementations. ...
Matt's user avatar
  • 21
1 vote
1 answer
124 views

Hash-Then-Encrypt or Encrypt-Then-Hash on Keyed Hash Functions

I have seen other answers here on Stack Exchange regarding MAC-Then-Encrypt vs. Encrypt-Then-MAC (and this article regarding MAC-Then-Encrypt padding oracle attacks on SSL) as well as generic Hash-...
Hero's user avatar
  • 11
0 votes
1 answer
98 views

Does sending encrypted hash inside message compromise security

This might sound like a naive question (And maybe it is (It's an early morning Saturday thought, so there might be some clarity of thought missing)). Suppose we havea protocol that sends messages as ...
Tresorb's user avatar
1 vote
1 answer
102 views

Disk encryption and advanced format

As far as I understand, the biggest problem of requesting authentication in disk encryption is that the plaintext and ciphertext are not having the same size -because of tag-. The XTS mode is already ...
NB_1907's user avatar
  • 640
3 votes
1 answer
523 views

Digital signature and salt

I'm wondering whether is of any use to add salt when computing a signature of a piece of data. I looked around but didn't find an answer to this, although there's a very similar question: Why hash or ...
Juraj Martinka's user avatar
3 votes
2 answers
533 views

Are the following ciphersuites vulnerable? if so, what are the vulnerabilities?

Following ciphersuites found to be weak in Qualys(https://www.ssllabs.com/ssltest/analyze.html) tool: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH x25519 (eq. 3072 bits RSA) ...
user105523's user avatar
2 votes
2 answers
234 views

What drivers are causing an increase in authenticated encryption modes?

So I'm currently working through this cryptography question and so far I have the answer of an increase of hackers due to increase in computational power. But apart from that I don't know what else. ...
Thanos's user avatar
  • 193
2 votes
1 answer
478 views

CPA secure to CCA secure encryption

Can we use a MAC to transform a CPA secure encryption scheme into CCA secure one?
user104304's user avatar
-1 votes
1 answer
98 views

Simplification: Should we MAC-then-encrypt or encrypt-then-MAC?

I refer to Should we MAC-then-encrypt or encrypt-then-MAC?. There are 15 answers (today) with many words. It is difficult to tell which is the correct(?) answer. Also, the question excludes the ...
Paul Uszak's user avatar
  • 15.5k
3 votes
2 answers
422 views

Is disabling padding integrity check in CBC implementations a good way of overcoming / mitigating padding oracle attack?

Given that CBC mode has a padding oracle attack, would disabling the padding integrity check be a good way of overcoming the vulnerability (this may result in frustration among existing users with ...
Ravindra HV's user avatar
1 vote
2 answers
280 views

What is more efficient to Encrypt then MAC or to MAC then encrypt

I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
Cobb's user avatar
  • 13
0 votes
1 answer
71 views

Short description of encryption methods? [closed]

I can't seem to wrap my head around these encryption methods. I can't find a brief description for any of them. Hash then encrypt MAC then encrypt Encrypt and MAC Encrypt then MAC
Dylk58's user avatar
  • 1
2 votes
1 answer
354 views

How is RSA key exchange protected against tampering?

The public key is defined by (N, e) where N is the product of two large primes and e is ...
Abhisek Dash's user avatar
0 votes
1 answer
2k views

Using AES-CBC in TLS1.2

Is AES-CBC still vulnerable in TLS1.2 Or does the vulnerability only work for lower TLS versions? If not, why was it deleted in TLS 1.3?
miklo009's user avatar
2 votes
1 answer
166 views

Is the tag generated in MAC equal for equal messages in CBC-MAC?

The Cipher Block Chaining algorithm for generating message authentication codes uses a 0 IV . So my understanding is that same messages will generate same MACs which seems to violate semantic ...
Abhisek Dash's user avatar
2 votes
1 answer
128 views

Is using CFB in SIV secure?

Is SIV mode variant equally secure, if you replace CTR mode encryption with full-block CFB mode encryption? CFB seems to be safe with predictable IV: Is using a predictable IV with CFB mode safe or ...
LightBit's user avatar
  • 1,649
11 votes
2 answers
3k views

Random data CBC padding scheme?

When using AES in CBC mode, padding is required when the last plaintext block has not the length required by the cipher. Let's say $k$ mode bytes would be required to fill the block. My idea was to ...
HerpDerpington's user avatar
0 votes
0 answers
97 views

How Mac-then-encrypt provide security in nonce-misuse setting?

From this, it is clear that Encrypt-then-Mac provides more complete security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, ...
hardyrama's user avatar
  • 2,126
0 votes
0 answers
474 views

How secure is Encrypt-And-MAC?

From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
Evan Su's user avatar
  • 449
2 votes
2 answers
412 views

Is E_k(M)||H(m) form of MAC secure?

Would this encryption and signing scenario be considered tamper-proof? ...
Evan Su's user avatar
  • 449
4 votes
2 answers
712 views

MAC-then-encrypt in SIGMA protocol for authenticated key exchange

The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption. The SIGMA-I variant illustrated below ...
DurandA's user avatar
  • 453
3 votes
3 answers
5k views

Is CTR more secure than CBC?

In cryptography, a block cipher mode of operation is an algorithm that uses a block cipher to provide information security such as confidentiality or authenticity. A block cipher by itself is only ...
moyu's user avatar
  • 73
1 vote
1 answer
187 views

CBC mode works well for input greater than "b" bits. What is that "b" bits?

This post on geeksforgeeks.org about block cipher modes of operation, says that one of the advantages of the CBC is that it works well for input greater than b bits. I also saw that in the book "...
Masoud jt's user avatar
  • 165
0 votes
0 answers
48 views

authentication by keyed hash function

assume i have: One-key cipher: E. Hash: H My application is authentication. I have a shared secret key with Bob for the One-key cipher. So, when I send an message to Bob, I also send an authentication ...
pianobegginer's user avatar
0 votes
1 answer
2k views

What is the advantage of Encrypt-then-MAC over Encrypt & MAC separately the plaintext [duplicate]

For secrecy, authentication & integrity, you can either use CipherText = Encrypt(PlainText) Signature = Hash(PlainText) CipherText = Encrypt(PlainText) Signature = Hash(CipherText) Either ...
user93353's user avatar
  • 2,235
0 votes
0 answers
35 views

Why is MAC encrypted in TLS data transmission? [duplicate]

Referring the slide 16 from this link: I want to ask why is MAC encrypted along with the data to be transmitted. Why isn't MAC just appended at the end of encrypted data ?
Jake's user avatar
  • 163
-2 votes
1 answer
197 views

What is the difference between Symmetric authentication systems and Symmetric encryption systems? [closed]

I know Symmetric encryption systems. Can someone explain the difference
Zak's user avatar
  • 1
5 votes
2 answers
3k views

During padding oracle attack (CBC), how is first byte of plaintext block is obtained?

Imagine conducting a padding oracle attack against CBC mode with 16-byte length blocks, and PKCS#5 used for padding. You start, as always, revealing the last byte of plaintext. Then you iteratively ...
bleg's user avatar
  • 51
0 votes
1 answer
88 views

Safely store data before moving to air-gapped machine

This is related to an earlier question, Is it possible to use an algorithm to generate an OTP? I have two machines: A, and B. A is connected to the internet and files are uploaded regularly. B is ...
DatsunBing's user avatar
2 votes
1 answer
705 views

Authenticated Encryption mode & AEAD

I'm studying Authenticated encryption with Associated Data (AEAD). My questions are About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the ...
pioneer's user avatar
  • 325
0 votes
1 answer
227 views

Which HMAC scheme more secure?

Which HMAC scheme is more secure? Or are they of the same level of security? Scheme One Compute a HMAC on the data to encrypt (cleartext/plaintext) Encrypt the data with AES_CTR_256, and append ...
Legorooj's user avatar
  • 474
9 votes
2 answers
2k views

Does secure hashing imply secure symmetric encryption?

I was wondering if the mere existence of a (by some definition) secure cryptographic hash function immediately implies an equally secure symmetric encryption scheme. By my understanding, one could to ...
SE - stop firing the good guys's user avatar
3 votes
2 answers
282 views

Robust authentication and integrity for short OTP message

Using any of the wonders of modern cryptographic technology, how is it possible to package a tweet-sized plaintext, which is to be encrypted with a proper one-time pad, to ensure its integrity and ...
Patriot's user avatar
  • 3,132
2 votes
1 answer
165 views

Authenticated encryption and file data integrity

I've got a task to provide the integrity and an authenticated encryption for files in our application. I need an assurance if my way of thinking is correct. I can't use AES GCM, I have to stay with ...
user avatar
-4 votes
2 answers
641 views

AES_256_ENCRYPT_CTR(key, sha-1(plainText)+plainText) VS AES-GCM, which is more secure? [duplicate]

What if we encrypt sha-1 hash of the plain text, along with the plain text using AES-256 in CTR mode? How much future proof the above method would be in comparison to AES-GCM or any other method ...
Nayan Karan's user avatar
0 votes
1 answer
78 views

Does hashing an encrypted message suffer from any drawbacks?

I am working on this problem where the set up is like this: There are three hosts: A, B and C. A wants to send a message to C which passes through B. At A the message is hashed, the hash is padded to ...
Kishan Kumar's user avatar
4 votes
2 answers
275 views

Is this algorithm good enough for small radio messages?

This question is related to: How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages? I am looking for a message that an attacker listening to the radio ...
Victor Iorinescu's user avatar
1 vote
1 answer
6k views

Hash-Then-Encrypt or Encrypt-Then-Hash?

The question is about site-to-site transmission where the recipient needs to decrypt the incoming data. What method is more secure and make it harder to decrypt, Hash-Then-Encrypt or Encrypt-Then-Hash?...
R1w's user avatar
  • 1,960
4 votes
2 answers
2k views

HMAC does it matter if I chose the cipher text or the plain text as the message? [duplicate]

I am using HMAC to create a message authentication code. My question is, does it matter if I use cipher text + encryption key or ...
pesdfa's user avatar
  • 43
1 vote
1 answer
280 views

Advantages of a TLS handshake over pre-shared public keys

Lets assume the following setup: A vendor manufactures IoT devices where each is able to generate an individual private/public key-pair. Only the public key is exposed, the private key is assumed to ...
derptank's user avatar
  • 115
3 votes
1 answer
6k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
pls no's user avatar
  • 919
4 votes
1 answer
2k views

Encrypt-and-mac IND-CCA security

I have been stuck all day trying to understand how to show that an Encrypt-and-Mac ($SE_{EaM}$) scheme is not IND-CCA secure. I have seen this similar post, however it is slightly different and the ...
Nooby's user avatar
  • 63
0 votes
1 answer
227 views

How can we know who sent a MAC-then-encrypt message?

I read about MAC-then-encrypt vs encrypt-then-MAC and I understood why MAC-then-encrypt is better but what if we have two parties that needs to know who signed the message before read it? Example: A ...
Vivi's user avatar
  • 159
5 votes
1 answer
1k views

In a AES-CBC + HMAC architecture, Is it secure to send a second IV in a message to a device incapable of producing satisfactory random numbers?

There are many threads here explaining the need of a random and unpredictable IV for the AES-CBC. I am building a home automation system with security for a school project where a Raspberry Pi ...
victortv's user avatar
  • 153
1 vote
4 answers
362 views

Including the next random One Time Pad as part of the encoded message?

I've tried to do something very simple here, which is to encrypt a message with a one-time-pad (OTP) and include the next OTP as part of that same encrypted message. i.e. The first message consists of ...
Sci's user avatar
  • 21
1 vote
2 answers
490 views

Can a hash of the original plain text file be used to brute force an encrypted copy?

I have encrypted files stored on a public cloud, in the same directory on the cloud I have the sha256 hash of the files before they were encrypted in a text file. The keys used to encrypt the files ...
Wilyarti Howard's user avatar
1 vote
1 answer
2k views

CTR and CBC-MAC Demystified

I am trying to understand the background processes within the CCMP. However the concept of CTR and CBC-MAC made me lost. According to the CCMP Encapsulation block diagram there are inputs like ...
markojic's user avatar
7 votes
1 answer
1k views

Is Encrypt(m||k2, k1) secure authenticated encryption?

I don't fully understand the need for MAC algorithms to authenticate encrypted messages. As I understand, the standard is to send something like $\mathrm{E}(m,k) \| \mathrm{MAC}(m,k)$ where $E$ is an ...
user2972359's user avatar
1 vote
1 answer
504 views

sign data and append certificate VS sign data and certificate

I am currently writing my masters thesis in which I need to develop a licensing module for an application. The license itself is a JSON Web Token which is signed using a RSA private key. Since we ...
MischCon's user avatar
7 votes
1 answer
52k views

Why is padding used in CBC mode?

I am newbie to CBC crypto: When I try decrypt the cipher text to recover the plain text, things are not going smoothly as I face some issues in the decryption process with padding and not obtaining ...
danny's user avatar
  • 253

15 30 50 per page