Linked Questions

152 votes
7 answers
111k views

Should we sign-then-encrypt, or encrypt-then-sign?

Frequently, we want to send messages that are (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
David Cary's user avatar
  • 5,674
73 votes
3 answers
24k views

Signal vs Telegram in terms of protocols?

Some time ago, the question was asked in chat, why MTProto (Telegram's protocol) is supposedly worse than Axolotl (Signal's protocol) as both protocols have been the inventions of their respective ...
SEJPM's user avatar
  • 46.1k
70 votes
3 answers
117k views

Why shouldn't I use ECB encryption?

I'm using Java to generate encrypted strings, and I get this warning at build time: ECB encryption mode should not be used So I'm wondering why I shouldn't use ECB and what I can use instead?
Rogue's user avatar
  • 826
21 votes
1 answer
3k views

Why choose an authenticated encryption mode instead of a separate MAC?

What are cryptographic reasons to choose an authenticated-encryption mode of operation (such as GCM) over a traditional encryption mode plus an independent MAC, or vice versa? Assume there is no ...
zwol's user avatar
  • 785
20 votes
4 answers
10k views

Why is OCB-AES mode not becoming a standard for authenticated encryption?

The OCB mode of authenticated encryption (used for example with AES) is the fastest way to provide authenticity and confidentiality without having to strive into questions like: Encrypt then MAC, MAC ...
curious's user avatar
  • 6,190
13 votes
1 answer
5k views

Why do we encrypt-then-mac but sign-then-encrypt?

This question was asked in comments on my answer to Should we MAC-then-encrypt or encrypt-then-MAC? I think posing the question as a separate entity is best, so: The general advice for applying MACs ...
user avatar
12 votes
1 answer
3k views

For a one-time pad, which MAC method is information-theoretically secure?

In the the main post about MAC methods it mentions a few methods: Authenticate And Encrypt: The sender computes a MAC of the plaintext, encrypts the plaintext, and then appends the MAC to the ...
lightspeeder's user avatar
11 votes
9 answers
720 views

Physical analogue for MACs

What would be a good analogue with which to describe Message Authentication Codes to a person who has little to no understanding of cryptography? For instance, a vault is a reasonable analogue for ...
Stephen Touset's user avatar
11 votes
2 answers
3k views

Random data CBC padding scheme?

When using AES in CBC mode, padding is required when the last plaintext block has not the length required by the cipher. Let's say $k$ mode bytes would be required to fill the block. My idea was to ...
HerpDerpington's user avatar
11 votes
1 answer
4k views

The difference between MAC algorithms and what to use

I've been looking into message authentication codes and found several ways to create integrity for a message. I know of the following algorithms: HMAC, this can use any cryptograhpic hash function ...
Vincent's user avatar
  • 966
10 votes
5 answers
7k views

Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
MurrayA's user avatar
  • 357
10 votes
1 answer
8k views

Does adding a salt to the message before HMAC processing add any security?

An HMAC function is designed to verify message integrity, i.e., that the message has not been tampered with. It is generally (always?) implemented by using a hashing function ...
Josh's user avatar
  • 203
9 votes
2 answers
2k views

Does secure hashing imply secure symmetric encryption?

I was wondering if the mere existence of a (by some definition) secure cryptographic hash function immediately implies an equally secure symmetric encryption scheme. By my understanding, one could to ...
SE - stop firing the good guys's user avatar
9 votes
3 answers
3k views

Encryption-then-encode or encode-then-encryption?

I have this question in which I m struggling. I have read in many sites about encrypt-then-mac etc. If the confidentiality for transmission is needed, discuss the feature for the order of encryption ...
nmurshed's user avatar
8 votes
3 answers
1k views

Is there a companion algorithm for OTP to ensure integrity and/or authentication?

One-Time Padding is (theoretically) perfect encryption algorithm. Let's assume that these problems are solved: Fast generation of independent and identically distributed random variables Perfect key ...
user4982's user avatar
  • 5,329

15 30 50 per page
1
2 3 4 5
8