Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality and integrity.
487
questions
2
votes
1
answer
56
views
Sponge Duplex authenticated encryption with nonce reuse or no nonce
With a Sponge permutation in a Duplex construction for authenticated encryption.
illustration example: ascon; actual interest if relevant: keccak
Suppose there is no associated data and there is no ...
- 33
1
vote
2
answers
69
views
What is more efficient to Encrypt then MAC or to MAC then encrypt
I have been searching for resources on the internet about the efficiency of Encrypt then MAC, MAC then encrypt, MAC and encrypt, and hash then encrypt and I have come up short with all of them. Most ...
- 13
1
vote
1
answer
188
views
Non-committing authenticated encryption schemes vs committing authenticated encryption schemes
I'm told that TLS 1.3 supports only non-committing authenticated encryption schemes. What is a non-committing authenticated encryption scheme? What is the difference between committing and non-...
- 37
2
votes
1
answer
50
views
Validating AES GCM authentication tag between two different implementations
I'm a bit confused on how to validate the authentication tag between two different AES GCM implementations.
One implementation (on my part) is in Java. The other, I don't know.
In my implementation, ...
- 23
0
votes
0
answers
45
views
Nonces in chacha20poly1305 vs chacha20
I'm currently working on replacing the chacha20 encryption in my app with chacha20poly1305, but I'm running into a few questions that I can't seem to find clear answers to, mainly stemming from the ...
1
vote
0
answers
27
views
Generalizing randomized permutation functions
The paper on the "SNEIKEN and SNEIKHA" AE and HASH sponge-based algorithms, respectively, presents a 512-bit permutation function "SNEIK512" that, unlike other permutations (ie: ...
- 123
0
votes
0
answers
44
views
calculate a tag of CBC-MAC
with a block cipher having a 256-bit key and 128-bit block length to MAC a 1024-bit message. How many evaluations of the block cipher will be performed to calculate the tag?
[Assume there is no ...
- 15
2
votes
2
answers
397
views
Why do most authenticated encryption primitives expect an unpredictable and uniformly random key in order to be secure?
I've noticed that keys for authenticated encryption primitives like AES must be unpredictable and uniformly random in order to be secure. IV values and seeds for PRNGs also have to be unpredictable ...
- 23
1
vote
1
answer
78
views
Public-key authenticated encryption: crypto_box
I have been reading crypto_box encryption and have a question. In the details of the algorithm, it uses Key exchange: X25519. However, I don't see why they need to ...
1
vote
1
answer
186
views
How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?
I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
- 131
1
vote
1
answer
373
views
Can Fixed–Diffie–Hellman be attacked?
Recently I'm studying Diffie-Hellman key exchange protocol and I've noticed that the basic Diffie-Hellman can be attacked by Man-In-The-Middle attack. I've also read about the Fixed Diffie-Hellman ...
- 113
1
vote
1
answer
44
views
Does CMS AuthEnvelopedData type provide message authentication?
I was looking through the S/MIME Message specification (RFC 8551) to find out what security services it offers. Section 2.4.4 of this document describing AuthEnvelopedData content type (which uses the ...
2
votes
1
answer
143
views
How is RSA key exchange protected against tampering?
The public key is defined by (N, e) where N is the product of two large primes and e is ...
- 69
1
vote
0
answers
71
views
How to compose (H)KDF, Encryption and (H)MAC
For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC.
A typical task is to transfer data from one node to ...
- 147
1
vote
0
answers
89
views
xChaCha20 Block Keys for Poly1305
So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
- 111
6
votes
1
answer
308
views
TLS 1.3 - Why have no encrypt-then-MAC modes been specified?
I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
- 111
0
votes
0
answers
66
views
INT-CTXT game adversary
I am trying to answer this question. But I think I got it wrong. I am not sure why and how I can improve it.
This is the adversary I came up with. Is this correct?
...
- 21
0
votes
0
answers
21
views
Key exchange with a property as certificate
I am searching for a key exchange protocol that makes use of certificates. I already came across protocols like Authenticated Diffie-Hellman key exchange, but this protocol use public/private key ...
5
votes
1
answer
98
views
Can an authenticated encryption scheme detect if wrong key is used?
Can an authenticated encryption scheme (like AES-GCM) detect if a wrong key is used for decryption? If not, what is the standard way to check whether the entered key is indeed correct. I presume KCVs ...
- 81
1
vote
1
answer
172
views
Is it possible to partially decrypt an aes-gcm ciphertext?
Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them?
If not, is there another authenticated ...
- 411
4
votes
1
answer
169
views
Is GCM with zero-length AAD less secure?
In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
- 161
4
votes
1
answer
151
views
Lack of response to CAESAR competition
Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
- 853
0
votes
1
answer
315
views
AES-GCM encryption in .NET Core
I created a crypto service using AES-GCM in order to encrypt the sensitive data in database. Firstly, I'm generating a cryptographic key from a password (probably will be stored in Kubernetes Secrets) ...
- 3
0
votes
1
answer
139
views
What authenticated encryption do kerberos use in windows?
I have learned about the kerberos protocol and seen that the windows version uses a couple of authenticated encryption schemas (like rc4-hmac-md5).
What type of authenticated encryption is it? Is it a:...
- 175
3
votes
2
answers
137
views
Does AEAD provide any benefit over raw cipher in this setting?
I'm working on a cryptographic data store where blobs need to be identified and referenced via a hash of the encryped data. Think Merkle tree with encrypted nodes. In such a setting where the hash ...
0
votes
0
answers
23
views
Is there a way to combine the Fuzzy extractor (or SS+ Ext) with state-of-art deep learning model?
I recently reviewed biometric authentication with deep learning model, and I found, in cryptography, the fuzzy extractor,FE (or secure sketch,SS, plus strong extractor) have solve this problem good ...
1
vote
1
answer
47
views
Mifare Classic, authentification protocol question
Thanks to reverse engineering papers on Mifare Classic, one can study the authentication protocol. However, I have a problem understanding how it works.
In the above document, after the reader ...
- 11
0
votes
1
answer
66
views
What is the term to describe the combination of ciphertext, IV and authentication tag?
Authenticated encryption with associated data, such as AES-GCM, will take as input: IV, optional associated data, plaintext and key.
A ciphertext and an authentication tag will be produced.
Is there a ...
- 2,698
1
vote
0
answers
52
views
Impact of partitioning oracle attacks on file encryption?
I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now.
According to this thread,
The aim is the recovery of a ...
- 421
3
votes
1
answer
106
views
Factorization of polynomial in GF(2^128) used in GCM
It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
- 1,447
1
vote
1
answer
45
views
How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?
I have a device that needs to communicate with another host and exchange fixed-length messages.
All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
- 111
1
vote
0
answers
46
views
What are the differences between the various Authenticated Encryption schemes using Keccak?
Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption.
However, there already seem multiple schemes defined for it, including their own implementations:
...
- 85.1k
2
votes
1
answer
83
views
Is using CFB in SIV secure?
Is SIV mode variant equally secure, if you replace CTR mode encryption with full-block CFB mode encryption?
CFB seems to be safe with predictable IV: Is using a predictable IV with CFB mode safe or ...
- 1,322
2
votes
1
answer
128
views
Key Encryption: Does it need to be Authenticated?
Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself.
She encrypts the files with keys $k_i$ ...
2
votes
0
answers
138
views
Is the following derived MAC where the output is XOR'ed with the key secure?
Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck .
More details:
It's just any reduction ...
- 73
0
votes
0
answers
39
views
Is it possible to allow a user to log in if logged out without identifying them?
I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent ...
- 101
0
votes
1
answer
62
views
Authenticated Encryption Sheme with Random Access and proven security?
I am searching for an authenticated encryption sheme with random access and a good performance.
The exact requirements are:
Data to protect: data = data_block_0 || ... || data_block_n
Every data_block ...
3
votes
2
answers
277
views
1
vote
0
answers
38
views
Prove that secure authenticated encryption system composed with itself is secure
Suppose $(E,D)$ provides authenticated encryption with key space $K$. Define $(E',D')$ with key space $K^2$ as follows:
$$
E'((k_1,k_2),m) = E(k_2,E(k_1,m)) \\
D'((k_1,k_2),c) = \begin{cases}
D(k_1,E(...
- 111
0
votes
1
answer
62
views
Authentication in Lattice PQC candidates
I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
- 31
1
vote
0
answers
141
views
Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives
I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
- 111
1
vote
1
answer
70
views
what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?
Related question here.
I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
1
answer
41
views
Case Scenarios where Identity Based identification (IBI) Scheme can be employed
I was reading about identity based Identification scheme today. There are lot of articles and research paper on it. There is active research being done in this are of IBI schemes.
My question is ...
- 269
1
vote
0
answers
74
views
getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure
I was going through this question of nested encryption:
Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
- 49
0
votes
0
answers
42
views
Not getting idea how to formally chose chosen cipher attack so adversay wins with non-negligible probability
I was going through this question and intuition came that same message can be used to break security but I an not able formalize it well...can someone help how to create chosen ciphertext attack ...
- 49
0
votes
1
answer
251
views
IND-CCA insecurity of modified CBC encrypt + MAC scheme
I've been puzzling over the following proof for the past couple of days.
Since a block cipher in CBC mode can be used to build both an IND-CPA secure
encryption scheme and a EUF-CMA secure block, a ...
42
votes
12
answers
12k
views
Is it possible to create a "digital seal" to tell if a document has been opened?
So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature ...
- 521
1
vote
1
answer
105
views
Encrypting h(k) for defeating partition oracle attacks
Is encrypting $h(k)$ (or even just $k$) and verifying it before checking the MAC enough to defeat partition oracle attacks and thus make the whole scheme robust/committing (without depending on ...
- 77
1
vote
2
answers
103
views
Is nonce-less Encrypt-then-HMAC as secure as poly1305
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
- 77
0
votes
0
answers
47
views
Synchronous Sponges
The paper The sponge construction as a source of secure
cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
- 73