Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality and integrity.
2
votes
1answer
28 views
Authenticated encryption and file data integrity
I've got a task to provide the integrity and an authenticated encryption for files in our application. I need an assurance if my way of thinking is correct.
I can't use AES GCM, I have to stay with ...
0
votes
0answers
15 views
What is the common way to find the distance dual of linear block code?
I know the distance of dual of reed solomon codes is n-k+1 beacuase it is MDS code. Now us consider the following linear block code
\begin{equation}
C:\mathbb{F}^{k}\rightarrow \mathbb{F}^{n}\\
(c_0,...
4
votes
0answers
57 views
Key size, performance, and security tradeoffs for AES-GCM, CCM
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
3
votes
1answer
48 views
What is the purpose of an Authentication Tag in AEAD encryption schemes?
AEAD encryption schemes produce something referred to as an "authentication tag." What does this tag consist of, what is its purpose, and is the tag itself human-readable data such as a plaintext ...
7
votes
2answers
107 views
Does there exist a mode of operation that forces mac-then-decrypt?
Alice sends Bob a message using AES-GCM. Bob is a software developer with just enough cryptography knowledge to be dangerous. He wants to start processing data as soon as he receives it. He observes ...
0
votes
1answer
55 views
XTS mode of operation and authentication
I'm wondering if XTS is used (Random Access is needed) what the best solution for authentication is. If I wouldn't need random access, I would take AES-GCM or AES-CBC-HMAC but random access is a must.
...
1
vote
2answers
97 views
Understanding ChaCha20-Poly1305 AEAD
In the AEAD scheme described in https://tools.ietf.org/html/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide any ...
0
votes
1answer
56 views
AEAD using AES-CBC and MAC: how to order the input to the MAC
I'm writing code to provide an AEAD utility. It uses AES-256-CBC for encryption and SHA-512(key+data) truncated to 256 bits as the MAC.
...
4
votes
1answer
146 views
Do AEADs also authenticate the nonce?
I'd like to include an authenticated timestamp in my messages. I'm wondering if I can save a little space by putting the timestamp in the nonce.
Concrete example:
Let's say I'm using XChaCha20-...
3
votes
1answer
159 views
Symetric key encryption is not Authentication?
Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption?
I know you can create a setup that isn't authentication, but how will you go about it?
1
vote
1answer
78 views
Disadvantage of the using a counter within plain text for encrypting with AES256 and authentication?
What if we use a counter within the plain text and then encrypt the plain text with aes 256 to encrypt & authenticate?
For example:
encryptAES(32bit_counter+plain_text_of_96bit);
or
encryptAES(...
1
vote
2answers
64 views
Using a hash of data instead of the full raw data for authenticated data in AES-GCM
I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM.
I would also like to ensure the integrity of the overall object.
The requirements are ...
0
votes
1answer
32 views
Verion of crypto_box() which doesn't allow the sender to decrypt previously sent messages
Libsodium's crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the ...
3
votes
1answer
129 views
Are SSH key-pairs an example of a zero knowledge proof?
Quoting from source, authentication using SSH key pairs goes something like this:
1) The client begins by sending an ID for the key pair it would like
to authenticate with to the server.
2) ...
2
votes
1answer
27 views
Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?
I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2?
I could not confirm this as ...
9
votes
1answer
195 views
Why does TLS 1.3 support two CCM variants?
One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
4
votes
3answers
401 views
In what cases might PRESENT be implemented as encryption-only?
In the paper, under section 4.1 Goals and environment of use we read:
In applications that demand the most efficient use of space, the block cipher will often only be implemented as encryption-only.
...
2
votes
1answer
94 views
Is Strong MAC stronger than existential unforgeability?
Especially in the context of Encrypt-then-Authenticate.
3
votes
4answers
146 views
JWT Login Security
I am new to security and I am wondering if JWT is secure enough.
From what I have read online the flow goes like this:
Clients log in by sending their credentials to the identity
provider.
The ...
4
votes
0answers
68 views
Patent Status & Usability of AE Modes [closed]
Post Structure:
Sources Cited
Question & Details
Before You Answer
Useful Info From Comments
Sources Cited:
https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
1
vote
1answer
44 views
A feasible approach for AEAD on an ethernet link?
The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. ...
1
vote
0answers
165 views
CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure
This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed.
The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure.
...
0
votes
1answer
65 views
Is there any way to track if a ciphertext has been decypted?
Just like the case of a box that has been sealed. We can detect if the box has been opened or not by looking at the seal. Is there any way in cryptography or any encryption scheme that allows this to ...
1
vote
1answer
53 views
Authenticated encryption vs end-end encryption
I am kind of new to crypto. can someone highlight the differences between authenticated encryption and End-to-End encryption
6
votes
1answer
128 views
Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh
OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS.
The TLS version
The openSSH version (and here)
The openSSH version uses two ...
7
votes
0answers
79 views
GCM mode of operation with long-term keys
Cross-post: https://cstheory.stackexchange.com/q/41435/873
Regarding GCM, NIST specifies the following:
The total number of invocations of the authenticated encryption function shall not exceed $2^...
0
votes
1answer
67 views
Re-using information from the first factor for the second factor
Is it safe to re-use my username and password as information for the 2nd-factor?
For instance:
the first factor is the username and password;
the second factor is $H(H(username) \oplus H(password \| ...
0
votes
2answers
167 views
Is an AEAD the recommended method to add encryption + HMAC to a protocol?
Assuming you are dealing with a competent developer/team, and you are advising on adding security to their protocol. Also for the time being lets not worry about the key establishment and validating ...
0
votes
1answer
58 views
Encryption / Decryption method secure
I was wondering whether this encryption / decryption flow is very solid / secure. I encrypt the data using AES CBC 256 bit with an static IV.
When the user logs in with his Firebase account (first ...
1
vote
0answers
104 views
XEX vs EME mode of operation
Two of the CAESAR finalists use XEX and EME mode of operations (COLM uses EME, OCB uses XEX).
I did literature to summarize the main advantages / disadvantages but I could not find much. My question ...
2
votes
1answer
148 views
Is it safe to use unauthenticated AES CBC when encrypting random bytes?
I am studying an application with an AES crypto implementation that works that like the following:
PBKDF2 is used with X iterations and SHA-256 to generate a 256-bit "master key" from a user-provided ...
2
votes
2answers
94 views
Why is release of unverified plaintext so Bad?
Lately I came across of release of unverified plaintext. I was told that this is a bad thing, but I don't really get why. Isn't unverified plaintext released just nonsense? How can this be attacked in ...
0
votes
1answer
45 views
What is the difference between verifying the hash value (MAC) and security provided by authenticated encryption?
I read this post Difference between MAC and Authenticated Encryption? but I'm still confusing the difference.
Seems like MAC can guarantee both integrity and authenticity (tbh I dont know the ...
3
votes
3answers
175 views
Secure MAC and secure encryption schemes combined to form insecure Authenticated Encryption?
I'm reading up on Authenticated Encryption and can't really wrap my head around how a generally secure MAC and a generally secure encryption scheme can be combined into an insecure AE scheme, such as ...
2
votes
1answer
178 views
Is transporting a salt, IV, ciphertext and HMAC in an encrypted token an acceptable practice?
I’m porting over some crypto code from Mcrypt (deprecated) to OpenSSL. I’m following a process that a former employee implemented, which is as follows:
Create a random salt for use in a PBKDF2 key ...
3
votes
1answer
61 views
Propagating CBC insecure Authenticated Encryption
why is Propagating CBC (PCBC) insecure for authenticated encryption?
I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
3
votes
2answers
930 views
Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?
In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer:
After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt),
it ...
2
votes
0answers
20 views
What happens in the MonkeyWrap-Algorithm of KetjeV2 if the input is a single block?
I am currently implementing KetjeV2 in VHDL. I have a question concerning the MonkeyWrap-Algorithm that is used in KetjeV2.
The function $wrap(A, B, l)$ is supposed to work as shown below, where $A$ ...
2
votes
1answer
138 views
AES-PMAC-SIV AE algorithm
AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
2
votes
2answers
77 views
Authentication scheme to protect against fake devices
I want two embedded devices (call them master and slave) to communicate with each other. For intellectual property protection, the master must reject fake slave devices (the other way around is a pre ...
0
votes
1answer
44 views
Distinct MAC and Key for AEAD?
I am implementing some of the algorithms in RFC 7518 and I noticed that AES_CBC_HMAC_SHA2 contains the following paragraph:
The secondary keys MAC_KEY and ENC_KEY are generated from the
...
2
votes
0answers
144 views
How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?
I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes).
For ...
0
votes
1answer
98 views
6 Byte for HMAC in wireless system secure?
A wireless system has 8 byte payload and 6 byte for message authentication.
Scheme:
...
2
votes
0answers
49 views
Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]
RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode:
...
3
votes
1answer
63 views
Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?
I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout:
...
2
votes
1answer
155 views
Security strength for encryption and authentication (wrapping) of cryptographic keys
Let $K$ and $M$ be AES secret keys. The purpose is to wrap $K$ using $M$ to allow $K$ to be used at a later time (see, e.g. NIST SP 800-38F, section 3.1). One method to achieve this goal is to use $M$ ...
3
votes
1answer
147 views
Verifying signature of plaintext using encrypted message only
I'm looking for an algorithm which allows verifying a signature of a plaintext message but while only having the encrypted message.
The requirement is for Alice to send Bob a plaintext message (M) ...
0
votes
0answers
32 views
Authorizing someone to open Alice's lock when Alice's lock only has Alice's public key
I'm designing a lock and I want Alice to be able to give temporary permission to someone to open the lock. After a set amount of 'access time' that someone should not have access to open the lock ...
1
vote
1answer
66 views
Do you need to MAC an ECIES message?
Normally, when decrypting messages, you need to check if the message is authentic and integral (aka, never decrypt before checking the MAC).
With ECIES, this seems to be done internally. Is it ...
1
vote
1answer
88 views
What does GHASH really do?
I try to understand the GCM-MODE used in TLS.
The problem I have had is described below.
1:textbook describes how GHASH works:
2:
I get some debuginfo from openssl code that contain enc_key(32 bytes)...
