Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Combination of encryption and authentication in a way that ensures confidentiality and integrity.

-3
votes
0answers
21 views

VoIP traffic analysis

I want to know that either all the VoIP traffic are encrypted? If not, so anyone list examples of Encrypted VoIP and non-Encrypted VoIP traffic?
2
votes
1answer
23 views

Are Authenticated Encryption ciphersuites supported in legacy TLS versions older than TLS 1.2?

I have read in a paper that Authenticated Encryption (by this I mean those that support GCM mode or ChaCha20 ciphers) are not supported in versions older than TLS 1.2? I could not confirm this as ...
0
votes
0answers
21 views

Best authentication protocol to use Argon2 in?

I've seen that Argon2 is a very popular choice for hashing passwords, but which authentication protocol would it best be used in? E.g. can it be used in SRP?
3
votes
0answers
48 views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
4
votes
3answers
381 views

In what cases might PRESENT be implemented as encryption-only?

In the paper, under section 4.1 Goals and environment of use we read: In applications that demand the most efficient use of space, the block cipher will often only be implemented as encryption-only. ...
-1
votes
0answers
11 views

Can a trusted party perform the key generation step in BGLS aggregate signatures?

BGLS 1 is an aggregate signature scheme by Boneh et al., that allows aggregation of signatures on n different messages from n different signers. In my application, and for the first step of the ...
-1
votes
0answers
21 views

Verify document between pairs without traceability

Two pseudonymous people, identified with their public key, cryptographically verify they saw the same document, without it being traceable to their public key. How can that be achieved?
2
votes
1answer
65 views

Is Strong MAC stronger than existential unforgeability?

Especially in the context of Encrypt-then-Authenticate.
3
votes
4answers
87 views

JWT Login Security

I am new to security and I am wondering if JWT is secure enough. From what I have read online the flow goes like this: Clients log in by sending their credentials to the identity provider. The ...
4
votes
0answers
66 views

Patent Status & Usability of AE Modes [closed]

Post Structure: Sources Cited Question & Details Before You Answer Useful Info From Comments Sources Cited: https://blog.cryptographyengineering.com/2012/05/19/how-to-choose-authenticated-...
1
vote
1answer
39 views

A feasible approach for AEAD on an ethernet link?

The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. ...
1
vote
0answers
63 views

CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure

This is exercise with 4.26 in Katz and Lindell's introduction to cryptography 2nd ed. The question is: Show a CPA-secure private-key encryption scheme that is unforgeable but is not CCA-secure. ...
0
votes
0answers
26 views

In terms of confidentiality and integrity, does it matter if we use the same key for encrypt-then-mac? [duplicate]

Suppose we have the same block cipher for both, AES, and same mode of operation, i.e. CBC. I know we are supposed to use $K_1 \neq K_2$, but I have been unable to think of any confidentiality attacks ...
0
votes
1answer
64 views

Is there any way to track if a ciphertext has been decypted?

Just like the case of a box that has been sealed. We can detect if the box has been opened or not by looking at the seal. Is there any way in cryptography or any encryption scheme that allows this to ...
1
vote
1answer
53 views

Authenticated encryption vs end-end encryption

I am kind of new to crypto. can someone highlight the differences between authenticated encryption and End-to-End encryption
7
votes
1answer
108 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
6
votes
0answers
70 views

GCM mode of operation with long-term keys

Cross-post: https://cstheory.stackexchange.com/q/41435/873 Regarding GCM, NIST specifies the following: The total number of invocations of the authenticated encryption function shall not exceed $2^...
0
votes
1answer
67 views

Re-using information from the first factor for the second factor

Is it safe to re-use my username and password as information for the 2nd-factor? For instance: the first factor is the username and password; the second factor is $H(H(username) \oplus H(password \| ...
0
votes
2answers
87 views

Is an AEAD the recommended method to add encryption + HMAC to a protocol?

Assuming you are dealing with a competent developer/team, and you are advising on adding security to their protocol. Also for the time being lets not worry about the key establishment and validating ...
0
votes
1answer
41 views

Encryption / Decryption method secure

I was wondering whether this encryption / decryption flow is very solid / secure. I encrypt the data using AES CBC 256 bit with an static IV. When the user logs in with his Firebase account (first ...
1
vote
0answers
67 views

XEX vs EME mode of operation

Two of the CAESAR finalists use XEX and EME mode of operations (COLM uses EME, OCB uses XEX). I did literature to summarize the main advantages / disadvantages but I could not find much. My question ...
2
votes
1answer
86 views

Is it safe to use unauthenticated AES CBC when encrypting random bytes?

I am studying an application with an AES crypto implementation that works that like the following: PBKDF2 is used with X iterations and SHA-256 to generate a 256-bit "master key" from a user-provided ...
2
votes
2answers
91 views

Why is release of unverified plaintext so Bad?

Lately I came across of release of unverified plaintext. I was told that this is a bad thing, but I don't really get why. Isn't unverified plaintext released just nonsense? How can this be attacked in ...
0
votes
1answer
43 views

What is the difference between verifying the hash value (MAC) and security provided by authenticated encryption?

I read this post Difference between MAC and Authenticated Encryption? but I'm still confusing the difference. Seems like MAC can guarantee both integrity and authenticity (tbh I dont know the ...
3
votes
3answers
124 views

Secure MAC and secure encryption schemes combined to form insecure Authenticated Encryption?

I'm reading up on Authenticated Encryption and can't really wrap my head around how a generally secure MAC and a generally secure encryption scheme can be combined into an insecure AE scheme, such as ...
2
votes
1answer
95 views

Is transporting a salt, IV, ciphertext and HMAC in an encrypted token an acceptable practice?

I’m porting over some crypto code from Mcrypt (deprecated) to OpenSSL. I’m following a process that a former employee implemented, which is as follows: Create a random salt for use in a PBKDF2 key ...
3
votes
1answer
50 views

Propagating CBC insecure Authenticated Encryption

why is Propagating CBC (PCBC) insecure for authenticated encryption? I received the hint that I should feed a message of length $n$ and a message of length $n-1$ to it, but I don't really get what the ...
3
votes
2answers
669 views

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

In the answer of the following post: Why was AES CBC removed in TLS 1.3?, I quote the following from the chosen answer: After the Lucky13 attack (a timing oracle caused by MAC-then-encrypt), it ...
2
votes
0answers
19 views

What happens in the MonkeyWrap-Algorithm of KetjeV2 if the input is a single block?

I am currently implementing KetjeV2 in VHDL. I have a question concerning the MonkeyWrap-Algorithm that is used in KetjeV2. The function $wrap(A, B, l)$ is supposed to work as shown below, where $A$ ...
2
votes
1answer
107 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
2
votes
2answers
65 views

Authentication scheme to protect against fake devices

I want two embedded devices (call them master and slave) to communicate with each other. For intellectual property protection, the master must reject fake slave devices (the other way around is a pre ...
0
votes
1answer
35 views

Distinct MAC and Key for AEAD?

I am implementing some of the algorithms in RFC 7518 and I noticed that AES_CBC_HMAC_SHA2 contains the following paragraph: The secondary keys MAC_KEY and ENC_KEY are generated from the ...
2
votes
0answers
128 views

How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?

I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes). For ...
0
votes
1answer
61 views

6 Byte for HMAC in wireless system secure?

A wireless system has 8 byte payload and 6 byte for message authentication. Scheme: ...
2
votes
0answers
47 views

Rationale behind IETF-ChaChaPoly's padding during MAC computation [duplicate]

RFC 7539 (Section 2.8) specifies a ChaCha20/Poly1305 based AEAD cipher scheme; pseudocode: ...
3
votes
1answer
55 views

Should I include the ciphertext length in an AAD when using Chacha20+Poly1205 AEAD?

I want to construct a time-limited authorization token using ChaCha20 and Poly1305 as defined by RFC7539. I chose the following simple layout: ...
2
votes
1answer
114 views

Security strength for encryption and authentication (wrapping) of cryptographic keys

Let $K$ and $M$ be AES secret keys. The purpose is to wrap $K$ using $M$ to allow $K$ to be used at a later time (see, e.g. NIST SP 800-38F, section 3.1). One method to achieve this goal is to use $M$ ...
3
votes
1answer
142 views

Verifying signature of plaintext using encrypted message only

I'm looking for an algorithm which allows verifying a signature of a plaintext message but while only having the encrypted message. The requirement is for Alice to send Bob a plaintext message (M) ...
0
votes
0answers
32 views

Authorizing someone to open Alice's lock when Alice's lock only has Alice's public key

I'm designing a lock and I want Alice to be able to give temporary permission to someone to open the lock. After a set amount of 'access time' that someone should not have access to open the lock ...
1
vote
1answer
57 views

Do you need to MAC an ECIES message?

Normally, when decrypting messages, you need to check if the message is authentic and integral (aka, never decrypt before checking the MAC). With ECIES, this seems to be done internally. Is it ...
1
vote
1answer
77 views

What does GHASH really do?

I try to understand the GCM-MODE used in TLS. The problem I have had is described below. 1:textbook describes how GHASH works: 2: I get some debuginfo from openssl code that contain enc_key(32 bytes)...
1
vote
0answers
32 views

Extending IGE to provide authentication

I was playing around with the idea of modifying infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any ...
1
vote
1answer
67 views

Robust cryptosystem for files/chunks protection?

I'm not a cryptographic expert by far but I do understand that when it comes to cryptography it's best to stick with established standards. I have to ensure confidentiality and integrity of a bunch ...
0
votes
1answer
70 views

Verifying integrity of large files

I'm looking for the most efficient in memory and time way to verify integrity of large files which have to be encrypted as well. Using SHA256 and other crypto hashes over the whole encrypted file? ...
0
votes
1answer
68 views

CBC-MAC 8 octet ICV compatable with 16 octet block size?

I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8 I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
1
vote
1answer
43 views

Authenticated encryption with forged verification key

Is it part of the (or a common) security model of symmetric authenticated encryption to prevent an adversary from exhibiting a decryption/verification key that makes a given genuine ciphertext verify, ...
0
votes
1answer
62 views

Why not generate the authentication key from the key and nonce in GCM?

In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $...
-2
votes
1answer
60 views

What is the general purpose of concealment algorithms introduced in…? [closed]

What is the general purpose of concealment algorithms introduced in https://eprint.iacr.org/2003/050.pdf?
3
votes
0answers
118 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
4
votes
1answer
100 views

Why would we want parallelizable authentication?

I believe that parallelizable authentication schemes are superior from an aesthetic perspective and because most non-recursive calculations (e.g., CTR, ECB, PMAC, etc.) are better than recursive ones (...