Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality and integrity.
360
questions
2
votes
2answers
92 views
Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?
Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
1
vote
1answer
53 views
Decrypt authenticated cipher while still encrypting [duplicate]
Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file ...
1
vote
1answer
33 views
What is the difference between an anonymous-encryption scheme and an authenticated-encryption scheme?
I was going through Indy-SDK when these two schemes were referenced. I want to know the precise differences between the two.
Indy-SDK links for reference to:
authenticated-encryption scheme
...
1
vote
1answer
56 views
AEAD without explicit authentication tag
I'm trying to understand the purpose of tag in AEAD. As far as I can understand, the resulting ciphertext will be slightly longer than the plaintext due to the authentication tag. Will it reduce the ...
1
vote
2answers
38 views
Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?
The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
3
votes
2answers
167 views
Robust authentication and integrity for short OTP message
Using any of the wonders of modern cryptographic technology, how is it possible to package a tweet-sized plaintext, which is to be encrypted with a proper one-time pad, to ensure its integrity and ...
5
votes
2answers
95 views
Append data to authenticated ciphertext encrypted using a stream cipher
Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
2
votes
0answers
24 views
Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?
I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it.
The ...
1
vote
1answer
93 views
Encrypting more than ~64GiB with AES-GCM - Integrity
I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
3
votes
3answers
157 views
Largest message size for XChaCha20-Poly1305
libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size.
However, the only specification available (still a draft) explains that under the hood the IETF version ...
0
votes
1answer
81 views
Entity authentication protocol by encryption
I'm not a cryptography expert, so excuse me if the question seems very trivial.
I need to know if this protocol is secure against a MiTM attacks and ensure a safe entity authentication method.
We ...
2
votes
2answers
70 views
Choice between appending or prepending nonces to ciphertexts
I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant.
However, ...
4
votes
2answers
162 views
Where shall we use an authenticated encryption mode?
I learned from Wikipedia that authenticated encryption modes include OCB, CCM, EAX, GCM, and so on. Does this mean that when we want to use authenticated encryption we shall use these modes? But these ...
1
vote
0answers
43 views
How does the offline authentication work?
In these slides, offline and online PUF-based authentication protocols are explained in minute 16:30 and 17:30, respectively. I understand the way the online protocol works. Basically, the server ...
0
votes
1answer
41 views
What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?
I have messages with the following fixed lengths:
4 byte
8 byte
16 byte
I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g....
3
votes
2answers
114 views
What is the security concept in printer cartridge?
Based on this datasheet or this patent, one of the usage of PUF is printer cartridge identification and authentication. I was wondering why printer cartridge needs identification and authentication. ...
0
votes
2answers
38 views
Quick scan which data (hmac/fernet) can be decrypted with a key?
I am designing a secure vault, which stores tens of thousands of encrypted messages and authenticated with Fernet/HMAC, A user query the vault with a key, could I use some kind of index to tell if the ...
0
votes
1answer
60 views
silly possibly original AE construction
This idea is inspired by a recent question about sending 32 byte messages, encrypted, without a MAC but still achieving the equivalent protection of a MAC just by using a block cipher, extra ...
2
votes
3answers
107 views
Can I achieve data authentication with ChaCha20 without MAC?
My case is rather special. I need to send data in small chunks, each under 32bytes. ChaCha20 state is 64 bytes.
Since I will be receiving data stream in chunks, id like to verify it on the fly (i.e. ...
0
votes
1answer
93 views
Cryptographic equivalent of family coat of arms
As a layman when it comes to cryptography, I have recently been asking myself if there was a cryptographic equivalent of a family code of arms. I'm thinking of something asymmetric, that is future ...
0
votes
0answers
57 views
Is it safe to use ECB mode this way, w/o duplicate blocks?
I wanna make my own "way" of encrypting separate messages. And I want it to have the least possible size overhead while being completely encrypted (hide msg counter). Here's my current idea:
we ...
6
votes
1answer
142 views
Deterministic Authenticated Encryption with AES-OFB and HMAC
I have an encrypted column in a database that stores sensitive information. The existing encryption scheme is deterministic and a database index exists on the encrypted value to allow searching.
I am ...
5
votes
2answers
157 views
What do NM-CPA, and NM-CCA mean?
When I've been researching authenticated encryption, the following terms keep showing up:
NM-CPA
NM-CCA
....without any definition as to what they mean. I've tried searching the web for their ...
2
votes
1answer
108 views
Guessing the key in AES256-GCM? [duplicate]
I assume that my case is weird but I've the following information:
IV: 0x263e or 0x3e26
Auth tag: 0x25
AES256-GCM encrypted payload: 0x4eec96df534ade4c013a
AES256-GCM decrypted payload: ...
2
votes
1answer
106 views
Does the AES-KW (Key Wrap Algorithm) perform authenticated encryption?
The RFC for AES-KW doesn't actually mention authentication, only integrity, where the unwrapping/decryption process should produce an identical IV of ...
9
votes
1answer
252 views
CAESAR finalists: Lightweight case (Ascon vs ACORN)
The Ascon cipher has been selected as the first choice in lightweight case and ACORN as the second. However according to Face-off between the CAESAR Lightweight Finalists: ACORN vs. Ascon paper, the ...
2
votes
1answer
76 views
Authenticated encryption and file data integrity
I've got a task to provide the integrity and an authenticated encryption for files in our application. I need an assurance if my way of thinking is correct.
I can't use AES GCM, I have to stay with ...
5
votes
0answers
275 views
Key size, performance, and security tradeoffs for AES-GCM, CCM
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
3
votes
1answer
311 views
What is the purpose of an Authentication Tag in AEAD encryption schemes?
AEAD encryption schemes produce something referred to as an "authentication tag." What does this tag consist of, what is its purpose, and is the tag itself human-readable data such as a plaintext ...
7
votes
2answers
117 views
Does there exist a mode of operation that forces mac-then-decrypt?
Alice sends Bob a message using AES-GCM. Bob is a software developer with just enough cryptography knowledge to be dangerous. He wants to start processing data as soon as he receives it. He observes ...
0
votes
1answer
158 views
XTS mode of operation and authentication
I'm wondering if XTS is used (Random Access is needed) what the best solution for authentication is. If I wouldn't need random access, I would take AES-GCM or AES-CBC-HMAC but random access is a must.
...
2
votes
2answers
252 views
Understanding ChaCha20-Poly1305 AEAD
In the AEAD scheme described in https://tools.ietf.org/html/rfc7539#section-2.8.1, the aad and cyphertext are padded to be a multiple of 16 bytes in length. Why is this necessary? Does it provide any ...
0
votes
1answer
123 views
AEAD using AES-CBC and MAC: how to order the input to the MAC
I'm writing code to provide an AEAD utility. It uses AES-256-CBC for encryption and SHA-512(key+data) truncated to 256 bits as the MAC.
...
4
votes
1answer
214 views
Do AEADs also authenticate the nonce?
I'd like to include an authenticated timestamp in my messages. I'm wondering if I can save a little space by putting the timestamp in the nonce.
Concrete example:
Let's say I'm using XChaCha20-...
3
votes
1answer
166 views
Symetric key encryption is not Authentication?
Is there any way to show CCA-secure symmetric-key encryption does not have to be an authenticated encryption?
I know you can create a setup that isn't authentication, but how will you go about it?
1
vote
1answer
81 views
Disadvantage of the using a counter within plain text for encrypting with AES256 and authentication?
What if we use a counter within the plain text and then encrypt the plain text with aes 256 to encrypt & authenticate?
For example:
encryptAES(32bit_counter+plain_text_of_96bit);
or
encryptAES(...
1
vote
2answers
80 views
Using a hash of data instead of the full raw data for authenticated data in AES-GCM
I am serialising JSON objects, and would like to encrypt some of the values. I plan to do this with AES-GCM.
I would also like to ensure the integrity of the overall object.
The requirements are ...
0
votes
1answer
48 views
Verion of crypto_box() which doesn't allow the sender to decrypt previously sent messages
Libsodium's crypto_box() family of functions allow the sender to send messages using its public/private keypair knowing the receiver's public key, and allow the ...
3
votes
1answer
189 views
Are SSH key-pairs an example of a zero knowledge proof?
Quoting from source, authentication using SSH key pairs goes something like this:
1) The client begins by sending an ID for the key pair it would like
to authenticate with to the server.
2) ...
2
votes
1answer
33 views
Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?
I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2?
I could not confirm this as ...
10
votes
1answer
488 views
Why does TLS 1.3 support two CCM variants?
One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
4
votes
3answers
413 views
In what cases might PRESENT be implemented as encryption-only?
In the paper, under section 4.1 Goals and environment of use we read:
In applications that demand the most efficient use of space, the block cipher will often only be implemented as encryption-only.
...
2
votes
1answer
195 views
Is Strong MAC stronger than existential unforgeability?
Especially in the context of Encrypt-then-Authenticate.
4
votes
4answers
494 views
JWT Login Security
I am new to security and I am wondering if JWT is secure enough.
From what I have read online the flow goes like this:
Clients log in by sending their credentials to the identity
provider.
The ...
4
votes
0answers
99 views
Patent Status & Usability of AE Modes [closed]
Post Structure:
Sources Cited
Question & Details
Before You Answer
Useful Info From Comments
Sources Cited:
https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
1
vote
1answer
56 views
A feasible approach for AEAD on an ethernet link?
The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. ...
1
vote
1answer
255 views
Unforgeable CPA-secure private-key encryption scheme that is not CCA-secure
This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed.
The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure.
...
0
votes
1answer
70 views
Is there any way to track if a ciphertext has been decypted?
Just like the case of a box that has been sealed. We can detect if the box has been opened or not by looking at the seal. Is there any way in cryptography or any encryption scheme that allows this to ...
1
vote
1answer
59 views
Authenticated encryption vs end-end encryption
I am kind of new to crypto. can someone highlight the differences between authenticated encryption and End-to-End encryption
6
votes
1answer
167 views
Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh
OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS.
The TLS version
The openSSH version (and here)
The openSSH version uses two ...
