Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality and integrity.
476
questions
1
vote
1answer
23 views
Does CMS AuthEnvelopedData type provide message authentication?
I was looking through the S/MIME Message specification (RFC 8551) to find out what security services it offers. Section 2.4.4 of this document describing AuthEnvelopedData content type (which uses the ...
2
votes
1answer
105 views
How is RSA key exchange protected against tampering?
The public key is defined by (N, e) where N is the product of two large primes and e is ...
1
vote
0answers
44 views
How to compose (H)KDF, Encryption and (H)MAC
For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC.
A typical task is to transfer data from one node to ...
1
vote
0answers
56 views
xChaCha20 Block Keys for Poly1305
So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
5
votes
1answer
251 views
TLS 1.3 - Why have no encrypt-then-MAC modes been specified?
I have been scratching my head for a while why TLS 1.3 does not include any encrypt-then-MAC (EtM) modes. All the previous problems in TLS have been caused by MAC then and encrypt. Whereas encrypt ...
0
votes
0answers
23 views
INT-CTXT game adversary
I am trying to answer this question. But I think I got it wrong. I am not sure why and how I can improve it.
This is the adversary I came up with. Is this correct?
...
0
votes
0answers
21 views
Key exchange with a property as certificate
I am searching for a key exchange protocol that makes use of certificates. I already came across protocols like Authenticated Diffie-Hellman key exchange, but this protocol use public/private key ...
5
votes
1answer
63 views
Can an authenticated encryption scheme detect if wrong key is used?
Can an authenticated encryption scheme (like AES-GCM) detect if a wrong key is used for decryption? If not, what is the standard way to check whether the entered key is indeed correct. I presume KCVs ...
1
vote
1answer
73 views
Is it possible to partially decrypt an aes-gcm ciphertext?
Say that I encrypt a large file using aes-gcm and upload it somewhere. Can I then download only the first few blocks (as well as IV and tag) and decrypt them?
If not, is there another authenticated ...
4
votes
1answer
137 views
Is GCM with zero-length AAD less secure?
In a previous question, it was made clear that in the case of GCM, there is no distinction between "no AAD" and "zero-length AAD". Since I have noticed "zero-length AAD" ...
4
votes
1answer
133 views
Lack of response to CAESAR competition
Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR ...
0
votes
1answer
141 views
AES-GCM encryption in .NET Core
I created a crypto service using AES-GCM in order to encrypt the sensitive data in database. Firstly, I'm generating a cryptographic key from a password (probably will be stored in Kubernetes Secrets) ...
0
votes
1answer
74 views
What authenticated encryption do kerberos use in windows?
I have learned about the kerberos protocol and seen that the windows version uses a couple of authenticated encryption schemas (like rc4-hmac-md5).
What type of authenticated encryption is it? Is it a:...
3
votes
1answer
98 views
Does AEAD provide any benefit over raw cipher in this setting?
I'm working on a cryptographic data store where blobs need to be identified and referenced via a hash of the encryped data. Think Merkle tree with encrypted nodes. In such a setting where the hash ...
0
votes
0answers
22 views
Is there a way to combine the Fuzzy extractor (or SS+ Ext) with state-of-art deep learning model?
I recently reviewed biometric authentication with deep learning model, and I found, in cryptography, the fuzzy extractor,FE (or secure sketch,SS, plus strong extractor) have solve this problem good ...
1
vote
1answer
40 views
Mifare Classic, authentification protocol question
Thanks to reverse engineering papers on Mifare Classic, one can study the authentication protocol. However, I have a problem understanding how it works.
In the above document, after the reader ...
0
votes
1answer
57 views
What is the term to describe the combination of ciphertext, IV and authentication tag?
Authenticated encryption with associated data, such as AES-GCM, will take as input: IV, optional associated data, plaintext and key.
A ciphertext and an authentication tag will be produced.
Is there a ...
1
vote
0answers
44 views
Impact of partitioning oracle attacks on file encryption?
I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now.
According to this thread,
The aim is the recovery of a ...
3
votes
1answer
88 views
Factorization of polynomial in GF(2^128) used in GCM
It is widely known, that using a GCM nonce twice or even more often can be used to disclose the authentication key H. I understand, why this is theoretically possible. However, I have no feeling about ...
1
vote
1answer
37 views
How to properly guarantee authentication, confidentiality, and replay-resistance for multiple messages using a pre-shared key?
I have a device that needs to communicate with another host and exchange fixed-length messages.
All traffic should be encrypted and authenticated, and it should be resistant to replay attacks. ...
1
vote
0answers
41 views
What are the differences between the various Authenticated Encryption schemes using Keccak?
Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption.
However, there already seem multiple schemes defined for it, including their own implementations:
...
2
votes
1answer
72 views
Is using CFB in SIV secure?
Is SIV mode variant equally secure, if you replace CTR mode encryption with full-block CFB mode encryption?
CFB seems to be safe with predictable IV: Is using a predictable IV with CFB mode safe or ...
1
vote
1answer
106 views
Key Encryption: Does it need to be Authenticated?
Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself.
She encrypts the files with keys $k_i$ ...
2
votes
0answers
110 views
Is the following derived MAC where the output is XOR'ed with the key secure?
Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck .
More details:
It's just any reduction ...
0
votes
0answers
39 views
Is it possible to allow a user to log in if logged out without identifying them?
I have to verify that the user has registered and is currently logged out without identifying the user. Essentially, I am looking for privacy-oriented authorization mechanisms which prevent ...
0
votes
1answer
45 views
Authenticated Encryption Sheme with Random Access and proven security?
I am searching for an authenticated encryption sheme with random access and a good performance.
The exact requirements are:
Data to protect: data = data_block_0 || ... || data_block_n
Every data_block ...
3
votes
2answers
234 views
1
vote
0answers
37 views
Prove that secure authenticated encryption system composed with itself is secure
Suppose $(E,D)$ provides authenticated encryption with key space $K$. Define $(E',D')$ with key space $K^2$ as follows:
$$
E'((k_1,k_2),m) = E(k_2,E(k_1,m)) \\
D'((k_1,k_2),c) = \begin{cases}
D(k_1,E(...
0
votes
1answer
60 views
Authentication in Lattice PQC candidates
I am looking into Authentication in lattice cryptography. Specifically in the NIST KEM finalists. I was specifically looking to see if there was a GCM (Galois counter mode) equivalence in the lattice ...
1
vote
0answers
113 views
Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives
I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
1
vote
1answer
62 views
what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?
Related question here.
I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
1answer
40 views
Case Scenarios where Identity Based identification (IBI) Scheme can be employed
I was reading about identity based Identification scheme today. There are lot of articles and research paper on it. There is active research being done in this are of IBI schemes.
My question is ...
1
vote
0answers
70 views
getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure
I was going through this question of nested encryption:
Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
0
votes
0answers
42 views
Not getting idea how to formally chose chosen cipher attack so adversay wins with non-negligible probability
I was going through this question and intuition came that same message can be used to break security but I an not able formalize it well...can someone help how to create chosen ciphertext attack ...
0
votes
1answer
137 views
IND-CCA insecurity of modified CBC encrypt + MAC scheme
I've been puzzling over the following proof for the past couple of days.
Since a block cipher in CBC mode can be used to build both an IND-CPA secure
encryption scheme and a EUF-CMA secure block, a ...
41
votes
12answers
12k views
Is it possible to create a "digital seal" to tell if a document has been opened?
So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature ...
1
vote
1answer
95 views
Encrypting h(k) for defeating partition oracle attacks
Is encrypting $h(k)$ (or even just $k$) and verifying it before checking the MAC enough to defeat partition oracle attacks and thus make the whole scheme robust/committing (without depending on ...
1
vote
2answers
81 views
Is nonce-less Encrypt-then-HMAC as secure as poly1305
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
0
votes
0answers
45 views
Synchronous Sponges
The paper The sponge construction as a source of secure
cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
1
vote
1answer
79 views
Ignoring the TAG of the AEAD-SIV encryption
I am working with personal data that contain Identifying attributes such as a player ID and i need to prepare the data for analysis purposes, therefore i need to pseudoanonymize the data beforehand. ...
0
votes
0answers
45 views
How Mac-then-encrypt provide security in nonce-misuse setting?
From this, it is clear that Encrypt-then-Mac provides more complete security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, ...
5
votes
1answer
171 views
How does GHASH used in GCM behave as a universal hashing function?
As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
0
votes
0answers
60 views
How secure is Encrypt-And-MAC?
From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
3
votes
1answer
72 views
What are the implications of allowing a zero-length GCM nonce?
NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
1
vote
1answer
196 views
Using authenticated encryption along with signing
I know of a project that implemented e2e encryption using both authenticated encryption and public key signing. So the ciphertext produced for a message would be:
...
4
votes
1answer
276 views
Key Committing AEADs
There are multi-key attacks against some AEADs. In other words, multiple keys can be used to decrypt a message since multiple keys can be valid for an authentication tag. How would one go about adding ...
2
votes
2answers
184 views
Can I use ChaCha20-Poly1305 as my KDF?
I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
1
vote
1answer
107 views
Identification Schemes and Internet of Things
I was reading an article titled "A Novel Method for Polar Form of Any Degree of
Multivariate Polynomials with Applications in IoT" (doi:10.3390/s19040903)
I read the following statement:
&...
2
votes
0answers
121 views
GPG should you double sign?
This is not a question about whether I should encrypt or sign first, as I've read here.
Rather, it's about whether I should sign, then encrypt, then sign again.
Because as far as I know, there is no ...
2
votes
1answer
78 views
Using crypto_sign then crypto_box_seal for anonymous messages
If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do?
...
