Linked Questions

10 votes
5 answers
7k views

Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
MurrayA's user avatar
  • 357
1 vote
3 answers
3k views

Counter based cipher using HMAC-SHA-256

After trying to invent my own AES mode, I decided to just implement something that's known to work, namely CTR mode with HMAC-SHA-256. From what I understand, I can use the IV as a counter, and the ...
Thorham's user avatar
  • 223
8 votes
1 answer
1k views

Understanding the impact of partitioning oracle attacks on stream ciphers

Yesterday I came across some conversation discussing partitioning oracle attacks, against authenticated stream ciphers like ChaCha20 and Salsa20 with poly1305 for MAC. As I understand it (though the ...
Woodstock's user avatar
  • 1,424
2 votes
4 answers
604 views

Encrypt-then-MAC: full random keys or keys derived from master key?

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better: Use the CSPRNG ...
Marcello's user avatar
  • 347
1 vote
1 answer
798 views

Using AES-256-GCM, is your security only 128 bits when solely relying on the MAC?

Since the maximum authentication tag (MAC) size of AES-256-GCM is 16 bytes, And given that in one implementation, that breaking the MAC would break the security (ex. when a boolean 'decrypted' is used ...
Neil Yoga Crypto's user avatar
0 votes
1 answer
540 views

AES-CBC authentication and password validation

Let's say, Alice uses AES256-CBC to encrypt some data. The key for encryption is derived using PBKDF2, where password is some passphrase Alice and Bob agreed on (using DH) and salt is random generated ...
ProXicT's user avatar
  • 135
1 vote
1 answer
753 views

Aes-Gcm how to perform decryption authentication without plaintext output in C#

I'm mainly trying to verify large file chunks which are encrypted each alone with a different key/salt/nonce for each chunk then appended to the whole file in the end to form 1 file. One thing I ...
Elie-M's user avatar
  • 23
2 votes
1 answer
480 views

Is HMAC-SHA512 with 512 bit key Quantum Safe?

is HMAC-SHA512 quantum safe , I am planning to use it for encrypt-then-mac scheme with aes256-cfb mode for a post quantum safe PGP like protocol.
ANISH M 18CS006's user avatar
0 votes
1 answer
449 views

can Encrypt-then-mac using HMAC-SHA256 with AES-256-GCM protect against attacks from Key committment and make it Post Quantum Secure

I read from Is GCM mode of authenticated encryption quantum secure? that AES-GCM will be insecure if the attacker is allowed to perform entangled queries on your GCM implementation, and return ...
sebastian sultz's user avatar
0 votes
1 answer
94 views

Is a static IV really less secure than an IV generated from a master key?

As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication. ...
Neil Yoga Crypto's user avatar