Questions tagged [authenticated-encryption]

Combination of encryption and authentication in a way that ensures confidentiality, integrity and authentication

Filter by
Sorted by
Tagged with
2 votes
0 answers
49 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
Nicole Foster's user avatar
2 votes
2 answers
69 views

Using the MAC to verify if Cipher Only attack has succeeded

I am working on an experiment to compare the efficiency of brute-force attacking block ciphers like AES and DES with reduced key sizes for different programming languages and library implementations. ...
Matt's user avatar
  • 21
0 votes
1 answer
103 views

Does using multiple encryption algorithms with different keys on the same cipher text improve security?

I'm looking for maximum possible security. My current scheme is xChaCha20-Poly1305-xSalsa20-Poly1305-AES-CBC-HMACSHA-512. Does combining these algorithms increase security if implemented correctly? ...
bismofunyuns's user avatar
2 votes
1 answer
71 views

Oribatida masking question

Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking?
LightBit's user avatar
  • 1,649
1 vote
1 answer
45 views

Can MCOE AEAD mode be modified to work with Threefish tweak block cipher and generate intermediate tags

The MCOE mode provides a really nice way to implement a nonce-misuse resistant AEAD and is based on an arbitrary tweak block cipher. A specific requirement of the tweak block cipher is that the data ...
cookiecipher's user avatar
0 votes
0 answers
89 views

What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation. As you can see the previous state is XORed with AES applied to itself ...
LightTunnelEnd's user avatar
0 votes
0 answers
76 views

Full-Block Cipher Feedback Mode as a complete AEAD with a free MAC?

Full-State Keyed Sponge (aka Donkey Sponge) appears to cross over into block cipher mode territory such as Full Block Cipher Feedback Mode: Full State Keyed Sponge (FKS) construction: FKS has been ...
LightTunnelEnd's user avatar
1 vote
0 answers
120 views

Can a Full-State Keyed Sponge be used as AEAD by using XEX?

Full-State Keyed Sponge (aka Donkey Sponge) is when a message is absorbed into the full state of the sponge. Such an approach to MAC construction is considered secure. 1 However for an AEAD or a ...
LightTunnelEnd's user avatar
3 votes
2 answers
288 views

Are sponges inherently inefficient when compared to other constructions?

A sponge has by definition 'wasted' operations (the part of the state which always remains private but goes through all the ops of the permutation). In return for that waste you get a MAC at the end - ...
LightTunnelEnd's user avatar
0 votes
1 answer
56 views

Nonce reuse in GMAC without ciphertext (only AAD)

As we all know, nonce reuse in AES/GCM can easily be catastrophic. However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message ...
Julian Durchholz's user avatar
4 votes
1 answer
115 views

How is the Full-State Keyed duplex useful?

In the Full-State Keyed duplex (sponge construction AEAD), plaintext is absorbed into the entire state of the sponge permutation but only a portion of the output can be used else the scheme breaks (...
LightTunnelEnd's user avatar
4 votes
2 answers
332 views

Key commitment in GCM (or AEAD in general)

Many of the presentations at The Third NIST Workshop on Block Cipher Modes of Operation 2023 complain about the lack of key commitment in AES-GCM. But isn't that one application of "associated ...
yoyo's user avatar
  • 367
2 votes
1 answer
117 views

IND-CPA/CCA security of AEAD schemes

I was reading the Hybrid Public Key Encryption (HPKE) RFC and I came across this sentence in section 9.4 "All AEADs MUST be IND-CCA2-secure, as is currently true for all AEADs listed in Section 7....
honzaik's user avatar
  • 382
1 vote
2 answers
88 views

Efficiently detect that a ciphertext is meant for Alice

Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
Guiomar Raissa's user avatar
0 votes
0 answers
30 views

How IV value shapes the State Matrix of PHOTON AEAD?

In PHOTON-Beetle Authenticated Encryption algorithm, the state consists of 64 4-bit elements, which is represented as a (8 × 8) matrix. The Initial Value which consists of Key and Nonce from the ...
Mohammadsadeq Borjiyan's user avatar
1 vote
0 answers
26 views

Tag Management Problem in Authenticated Disk Encryption

1) For authenticated disk encryption, there are extra data such as IV or tag that need to be stored for all the alternative mods that are placed in Table 1. For these data, it will be necessary to use ...
NB_1907's user avatar
  • 538
0 votes
0 answers
21 views

Identity authentication in anonymous public key encryption

In a similar anonymous PKE based on D-H key exchange, in a many-to-one (one-to-many) case, is there any way to implement authentication without revealing the identity of the sender (receiver)? Could ...
Ping Ping's user avatar
3 votes
2 answers
689 views

Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?

I would like to encrypt big files using an authenticated cipher. I am convinced to use approach where file is divided into smaller manageable chunks that fit easily in memory (e.g. 1-10MB size) which ...
Tom Raganowicz's user avatar
1 vote
1 answer
226 views

How does AES-GCM and AES-CCM provide authenticity?

My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity. In CCM, as I understand it, the authenticity lies in the MAC, i....
user946822's user avatar
3 votes
1 answer
148 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
1 vote
1 answer
69 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
Melab's user avatar
  • 3,635
5 votes
2 answers
180 views

Authenticated encryption scheme for one-way radio telemetry

I'm designing an authenticated encryption scheme for a noninteractive one-way radio telemetry system. A number of devices in the field send back telemetry to a base station periodically, but no ...
Polynomial's user avatar
  • 3,527
2 votes
1 answer
635 views

When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?

When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used), should we use SHA-...
SeekingAnswers's user avatar
1 vote
0 answers
31 views

Secure ciphersuite from security-wise sub-optimal unkeyed permutation?

Hypothetically, IF we were to create a SSL/TLS or QUIC ciphersuite from a single (unkeyed) permutation operating in sponge mode to provide hashing and duplex mode to provide AEAD cipher, AND IF the ...
DannyNiu's user avatar
  • 9,001
3 votes
1 answer
126 views

Error-correcting as part of an encryption scheme?

If we do not encrypt a message, we can use a checksum to check data integrity. For authenticated encryption, we no longer need the checksum because we use the authentication tag to verify data ...
Ma Joad's user avatar
  • 163
3 votes
1 answer
87 views

Example situation where an authentication tag can prevent an attack?

In Authenticated Encryption, we use an authentication tag to make sure the message is not tampered. The authentication tag can prevent any random bytes sent by the attacker being decrypted by the ...
Ma Joad's user avatar
  • 163
2 votes
1 answer
64 views

Can you make an OCB type AEAD using a stream cipher?

This is a hypothetical question. Is it possible to use a stream cipher instead of a block cipher for an OCB type single pass AEAD? The xor of the plaintext blocks for the authentication tag can't work ...
Nigel's user avatar
  • 21
3 votes
1 answer
141 views

Why in authenticated encryptions do we need separate keys for cipher and MAC?

As asked, I suppose this must have been answered before, even if not in the form asked here. The most notable AEAD schemes GCM-AES and ChaCha20-Poly1305 do this. Also, even outside AEAD, ad-hoc ...
DannyNiu's user avatar
  • 9,001
3 votes
1 answer
108 views

What kind of hashing is GF multiplication in GCM cipher mode and GMAC?

In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing. Is that what's ...
zzazzles's user avatar
  • 117
3 votes
0 answers
50 views

CX vs padding fix for AEAD key commitment

The padding fix by Albertini et al. for AEAD key commitment (pp. 3292 and 3301-3302) involves prepending a block or two of zeros to the plaintext before encrypting. After decryption, these bytes are ...
samuel-lucas6's user avatar
7 votes
1 answer
163 views

Why did Yubico changed U2F Key Derivation method on YubiKey?

Previous: https://web.archive.org/web/20160102181336/developers.yubico.com/U2F/Protocol_details/Key_generation.html https://www.yubico.com/blog/yubicos-u2f-key-wrapping/ $$ PrivateKey = \operatorname{...
youfu's user avatar
  • 253
3 votes
1 answer
152 views

Does authenticating fake Carter Wegman protected OTP messages consume key material at the receiving node?

Assume a message protocol whereby one time pad messages are authenticated with a Carter Wegman type hash on the ciphertext, or some similar construct utilizing a unique authentication key per message. ...
Paul Uszak's user avatar
  • 15.2k
1 vote
0 answers
57 views

Authenticated Encryption with Length Expansion for Storage Devices

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general. I know that ...
NB_1907's user avatar
  • 538
5 votes
1 answer
347 views

For password-based authenticated encryption is it OK to derive the auth key from the crypt key with 1 iteration?

That is, in the case where the iterations value is a large number, since iterations are costly is there a difference in security of doing something like this, where two separate derivations are ...
wabo's user avatar
  • 153
4 votes
1 answer
91 views

Which ciphers have been defined that use the Keccak sponge?

There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized ...
Maarten Bodewes's user avatar
  • 91.7k
1 vote
0 answers
30 views

CCM in the RUP setting reduced to CTR?

I have a question regarding the paper: Andreeva, E. et al, Securely Release Unverified Plaintext in Authenticated Encryption , 2014 (DOI: 10.1007/978-3-662-45611-8_6) AE schemes such as GCM [28] and ...
kaiya's user avatar
  • 143
4 votes
2 answers
2k views

OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?

If I do a simple encrypt and decrypt test like so: ...
RocketNuts's user avatar
  • 1,397
2 votes
1 answer
134 views

blake3 keyed hash compression output xor'ed with key secure?

I'm currently trying to write the blake3 algorithm in JS using the official whitepaper or what it's called. If I understand correctly then... after the 7 round keyed permutation (at the end of the ...
slee69's user avatar
  • 25
1 vote
0 answers
37 views

Browser javascript: TLS sequence number authentication

I am implementing TLS (or something like it perhaps) because the browser doesn't seem to provide a direct client-script interface to TLS. The browser provides a ...
personal_cloud's user avatar
3 votes
1 answer
237 views

Data Origin Authentication vs Non Repudiation?

I'm looking into how authenticated encryption primitives work and was wondering if non-repudiation is provided with these. Investigating further into them led to the answer being that data origin ...
Thanos's user avatar
  • 183
1 vote
1 answer
758 views

XChaCha20-Poly1305 vs Plain ChaCha20-Poly1305 performance

I know that the security of both are the same (only nonce size is different). But which one is faster and better to use, when encrypting a lot of files (500+, from 1MB to 200MB)?
kiiro's user avatar
  • 25
1 vote
1 answer
57 views

How to achieve encryption at single source and decryption at multiple locations using asymmetric scheme?

I need an encryption scheme where a single source/location can encrypt using their private key and while anyone with access to the corresponding public key can decrypt it. It has to be asymmetric to ...
Rahul Parthe's user avatar
0 votes
1 answer
233 views

Defending MITM attacks during key exchange

As far as I know, key exchanging algorithms are vulnerable to an active MITM attack. Let A (Alice) and B (Bob) be parties with no secret information. An adversary C playing man-in-the-middle ...
imamangoo's user avatar
2 votes
1 answer
336 views

Encrypt multiple chunks of data with an AEAD

Assuming that I want to encrypt a 1 GB file with e.g. AES in GCM mode or ChaCha20Poly1305. [I'm specifically referring to the cryptography module for Python: https://cryptography.io/en/latest/hazmat/...
Missionar's user avatar
0 votes
0 answers
52 views

minimal public-key authenticated encryption protocol

One party (master) wants to send data to another party (slave) over an insecure channel using public-key encryption and signature schemes such that: master is authenticated, data is confidential, ...
yoyo's user avatar
  • 367
5 votes
3 answers
873 views

Is 'authenticated' in AEAD actually authentication? Or is it message integrity?

Despite working with AES-GCM and other AEAD algos for a few years, I've struggled with the concept of 'authenticated' in the term 'AEAD'. In my own experience (of Unix, PKI and blockchain) ...
mikemaccana's user avatar
2 votes
1 answer
588 views

What does AES-GCM provide?

I am wondering does AES-GCM which uses Authenticated Encryption provide us with all 3 properties (Authenticity, Confidentiality, and Integrity), or does it not provide integrity?
CryptoGuru's user avatar
1 vote
1 answer
90 views

Is MAC unnecessary for client side encryption?

In my open source with offline client side encryption application, I plan to use AES-CTR or ChaCha20 without MAC instead of GCM or Poly1305 since: There is no database, the ciphertext, nonce, tag ...
Kim Mỹ's user avatar
  • 155
1 vote
0 answers
71 views

What's the difference between CMTD-1 and key-committing security?

The paper Efficient Schemes for Committing Authenticated Encryption introduces a framework for committing security notions that includes: CMT-1: commit to the key. CMT-3: commit to the key, nonce, ...
samuel-lucas6's user avatar
0 votes
2 answers
920 views

How is AES256-GCM auth tag used in decryption

I have been playing with AES256-GCM in NodeJS crypto library and it shows that the original message can be decrypted without caring about the auth tag. So can a non-tag verified decryption be secure? ...
Kim Mỹ's user avatar
  • 155

1
2 3 4 5
11