Linked Questions

10 votes
5 answers

Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
MurrayA's user avatar
  • 357
1 vote
3 answers

Counter based cipher using HMAC-SHA-256

After trying to invent my own AES mode, I decided to just implement something that's known to work, namely CTR mode with HMAC-SHA-256. From what I understand, I can use the IV as a counter, and the ...
Thorham's user avatar
  • 223
8 votes
1 answer

Understanding the impact of partitioning oracle attacks on stream ciphers

Yesterday I came across some conversation discussing partitioning oracle attacks, against authenticated stream ciphers like ChaCha20 and Salsa20 with poly1305 for MAC. As I understand it (though the ...
Woodstock's user avatar
  • 1,424
2 votes
4 answers

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
Marcello's user avatar
  • 347
1 vote
1 answer

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
Neil Yoga Crypto's user avatar
0 votes
1 answer

AES-CBC authentication and password validation

Let's say, Alice uses AES256-CBC to encrypt some data. The key for encryption is derived using PBKDF2, where password is some passphrase Alice and Bob agreed on (using DH) and salt is random generated ...
ProXicT's user avatar
  • 135
1 vote
1 answer

Aes-Gcm how to perform decryption authentication without plaintext output in C#

I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file. One thing I ...
Elie-M's user avatar
  • 23
2 votes
1 answer

Is HMAC-SHA512 with 512 bit key Quantum Safe?

is HMAC-SHA512 quantum safe , I am planning to use it for encrypt-then-mac scheme with aes256-cfb mode for a post quantum safe PGP like protocol.
ANISH M 18CS006's user avatar
0 votes
1 answer

can Encrypt-then-mac using HMAC-SHA256 with AES-256-GCM protect against attacks from Key committment and make it Post Quantum Secure

I read from Is GCM mode of authenticated encryption quantum secure? that AES-GCM will be insecure if the attacker is allowed to perform entangled queries on your GCM implementation, and return ...
sebastian sultz's user avatar
0 votes
1 answer

Is a static IV really less secure than an IV generated from a master key?

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication. ...
Neil Yoga Crypto's user avatar