Questions tagged [authenticated-encryption]

Combination of encryption and authentication in a way that ensures confidentiality and integrity.

Filter by
Sorted by
Tagged with
2 votes
1 answer
56 views

Sponge Duplex authenticated encryption with nonce reuse or no nonce

With a Sponge permutation in a Duplex construction for authenticated encryption. illustration example: ascon; actual interest if relevant: keccak Suppose there is no associated data and there is no ...
user avatar
1 vote
2 answers
69 views

What is more efficient to Encrypt then MAC or to MAC then encrypt

I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
user avatar
  • 13
1 vote
1 answer
188 views

Non-committing authenticated encryption schemes vs committing authenticated encryption schemes

I'm told that TLS 1.3 supports only non-committing authenticated encryption schemes. What is a non-committing authenticated encryption scheme? What is the difference between committing and non-...
user avatar
  • 37
2 votes
1 answer
50 views

Validating AES GCM authentication tag between two different implementations

I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations. One implementation (on my part) is in Java. The other, I don't know. In my implementation, ...
user avatar
0 votes
0 answers
45 views

Nonces in chacha20poly1305 vs chacha20

I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
user avatar
1 vote
0 answers
27 views

Generalizing randomized permutation functions

The paper on the "SNEIKEN and SNEIKHA" AE and HASH sponge-based algorithms, respectively, presents a 512-bit permutation function "SNEIK512" that, unlike other permutations (ie: ...
user avatar
0 votes
0 answers
44 views

calculate a tag of CBC-MAC

with a block cipher having a 256-bit key and 128-bit block length to MAC a 1024-bit message. How many evaluations of the block cipher will be performed to calculate the tag? [Assume there is no ...
user avatar
  • 15
2 votes
2 answers
397 views

Why do most authenticated encryption primitives expect an unpredictable and uniformly random key in order to be secure?

I've noticed that keys for authenticated encryption primitives like AES must be unpredictable and uniformly random in order to be secure. IV values and seeds for PRNGs also have to be unpredictable ...
user avatar
  • 23
1 vote
1 answer
78 views

Public-key authenticated encryption: crypto_box

I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
user avatar
1 vote
1 answer
186 views

How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?

I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
user avatar
  • 131
1 vote
1 answer
373 views

Can Fixed–Diffie–Hellman be attacked?

Recently I'm studying Diffie-Hellman key exchange protocol and I've noticed that the basic Diffie-Hellman can be attacked by Man-In-The-Middle attack. I've also read about the Fixed Diffie-Hellman ...
user avatar
  • 113
1 vote
1 answer
44 views

Does CMS AuthEnvelopedData type provide message authentication?

I was looking through the S/MIME Message specification (RFC 8551) to find out what security services it offers. Section 2.4.4 of this document describing AuthEnvelopedData content type (which uses the ...
user avatar
2 votes
1 answer
143 views

How is RSA key exchange protected against tampering?

The public key is defined by (N, e) where N is the product of two large primes and e is ...
user avatar
1 vote
0 answers
71 views

How to compose (H)KDF, Encryption and (H)MAC

For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC. A typical task is to transfer data from one node to ...
user avatar
1 vote
0 answers
89 views

xChaCha20 Block Keys for Poly1305

So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
user avatar
  • 111
6 votes
1 answer
308 views

TLS 1.3 - Why have no encrypt-then-MAC modes been specified?

I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
user avatar
  • 111
0 votes
0 answers
66 views

INT-CTXT game adversary

I am trying to answer this question. But I think I got it wrong. I am not sure why and how I can improve it. This is the adversary I came up with. Is this correct? ...
user avatar
0 votes
0 answers
21 views

Key exchange with a property as certificate

I am searching for a key exchange protocol that makes use of certificates. I already came across protocols like Authenticated Diffie-Hellman key exchange, but this protocol use public/private key ...
user avatar
5 votes
1 answer
98 views

Can an authenticated encryption scheme detect if wrong key is used?

Can an authenticated encryption scheme (like AES-GCM) detect if a wrong key is used for decryption? If not, what is the standard way to check whether the entered key is indeed correct. I presume KCVs ...
user avatar
1 vote
1 answer
172 views

Is it possible to partially decrypt an aes-gcm ciphertext?

Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them? If not, is there another authenticated ...
user avatar
  • 411
4 votes
1 answer
169 views

Is GCM with zero-length AAD less secure?

In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
user avatar
  • 161
4 votes
1 answer
151 views

Lack of response to CAESAR competition

Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
user avatar
  • 853
0 votes
1 answer
315 views

AES-GCM encryption in .NET Core

I created a crypto service using AES-GCM in order to encrypt the sensitive data in database. Firstly, I'm generating a cryptographic key from a password (probably will be stored in Kubernetes Secrets) ...
user avatar
0 votes
1 answer
139 views

What authenticated encryption do kerberos use in windows?

I have learned about the kerberos protocol and seen that the windows version uses a couple of authenticated encryption schemas (like rc4-hmac-md5). What type of authenticated encryption is it? Is it a:...
user avatar
  • 175
3 votes
2 answers
137 views

Does AEAD provide any benefit over raw cipher in this setting?

I'm working on a cryptographic data store where blobs need to be identified and referenced via a hash of the encryped data. Think Merkle tree with encrypted nodes. In such a setting where the hash ...
user avatar
0 votes
0 answers
23 views

Is there a way to combine the Fuzzy extractor (or SS+ Ext) with state-of-art deep learning model?

I recently reviewed biometric authentication with deep learning model, and I found, in cryptography, the fuzzy extractor,FE (or secure sketch,SS, plus strong extractor) have solve this problem good ...
user avatar
1 vote
1 answer
47 views

Mifare Classic, authentification protocol question

Thanks to reverse engineering papers on Mifare Classic, one can study the authentication protocol. However, I have a problem understanding how it works. In the above document, after the reader ...
user avatar
  • 11
0 votes
1 answer
66 views

What is the term to describe the combination of ciphertext, IV and authentication tag?

Authenticated encryption with associated data, such as AES-GCM, will take as input: IV, optional associated data, plaintext and key. A ciphertext and an authentication tag will be produced. Is there a ...
user avatar
  • 2,698
1 vote
0 answers
52 views

Impact of partitioning oracle attacks on file encryption?

I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now. According to this thread, The aim is the recovery of a ...
user avatar
  • 421
3 votes
1 answer
106 views

Factorization of polynomial in GF(2^128) used in GCM

It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
user avatar
  • 1,447
1 vote
1 answer
45 views

How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?

I have a device that needs to communicate with another host and exchange fixed-length messages. All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
user avatar
  • 111
1 vote
0 answers
46 views

What are the differences between the various Authenticated Encryption schemes using Keccak?

Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption. However, there already seem multiple schemes defined for it, including their own implementations: ...
user avatar
  • 85.1k
2 votes
1 answer
83 views

Is using CFB in SIV secure?

Is SIV mode variant equally secure, if you replace CTR mode encryption with full-block CFB mode encryption? CFB seems to be safe with predictable IV: Is using a predictable IV with CFB mode safe or ...
user avatar
  • 1,322
2 votes
1 answer
128 views

Key Encryption: Does it need to be Authenticated?

Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself. She encrypts the files with keys $k_i$ ...
user avatar
2 votes
0 answers
138 views

Is the following derived MAC where the output is XOR'ed with the key secure?

Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck . More details: It's just any reduction ...
user avatar
0 votes
0 answers
39 views

Is it possible to allow a user to log in if logged out without identifying them?

I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent ...
user avatar
  • 101
0 votes
1 answer
62 views

Authenticated Encryption Sheme with Random Access and proven security?

I am searching for an authenticated encryption sheme with random access and a good performance. The exact requirements are: Data to protect: data = data_block_0 || ... || data_block_n Every data_block ...
user avatar
3 votes
2 answers
277 views

Ciphertext length in TLS 1.3 additional data

RFC8846 says: ...
user avatar
1 vote
0 answers
38 views

Prove that secure authenticated encryption system composed with itself is secure

Suppose $(E,D)$ provides authenticated encryption with key space $K$. Define $(E',D')$ with key space $K^2$ as follows: $$ E'((k_1,k_2),m) = E(k_2,E(k_1,m)) \\ D'((k_1,k_2),c) = \begin{cases} D(k_1,E(...
user avatar
  • 111
0 votes
1 answer
62 views

Authentication in Lattice PQC candidates

I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
user avatar
1 vote
0 answers
141 views

Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives

I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
user avatar
  • 111
1 vote
1 answer
70 views

what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?

Related question here. I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
user avatar
0 votes
1 answer
41 views

Case Scenarios where Identity Based identification (IBI) Scheme can be employed

I was reading about identity based Identification scheme today. There are lot of articles and research paper on it. There is active research being done in this are of IBI schemes. My question is ...
user avatar
1 vote
0 answers
74 views

getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure

I was going through this question of nested encryption: Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
user avatar
  • 49
0 votes
0 answers
42 views

Not getting idea how to formally chose chosen cipher attack so adversay wins with non-negligible probability

I was going through this question and intuition came that same message can be used to break security but I an not able formalize it well...can someone help how to create chosen ciphertext attack ...
user avatar
  • 49
0 votes
1 answer
251 views

IND-CCA insecurity of modified CBC encrypt + MAC scheme

I've been puzzling over the following proof for the past couple of days. Since a block cipher in CBC mode can be used to build both an IND-CPA secure encryption scheme and a EUF-CMA secure block, a ...
user avatar
42 votes
12 answers
12k views

Is it possible to create a "digital seal" to tell if a document has been opened?

So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature ...
user avatar
1 vote
1 answer
105 views

Encrypting h(k) for defeating partition oracle attacks

Is encrypting $h(k)$ (or even just $k$) and verifying it before checking the MAC enough to defeat partition oracle attacks and thus make the whole scheme robust/committing (without depending on ...
user avatar
1 vote
2 answers
103 views

Is nonce-less Encrypt-then-HMAC as secure as poly1305

While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
user avatar
0 votes
0 answers
47 views

Synchronous Sponges

The paper The sponge construction as a source of secure cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
user avatar
  • 73

1
2 3 4 5
10