Cryptography

Questions tagged [authenticated-encryption]

Ask Question

Combination of encryption and authentication in a way that ensures confidentiality and integrity.

386 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
2
votes
1answer
72 views

Which is the best algorithm for large scale file encryption other than AES?

I've been looking for a fast, powerful and robust algorithm for encrypting large files with authentication . I would like to implement the algorithm on my own without using third party software. I've ...
1
vote
1answer
33 views

Are the signcryption and the authenticated encryption same?

The signcryption and the authenticated encryption are both the combine of encryption and authentication with three natural composition (i.e., EtS, StE, E&S). I am not sure that if they are the ...
1
vote
1answer
59 views

Using AES-GCM (or AEAD ciphers in general) as a pure MAC without encryption

What's the opinion on using an AEAD cipher such as AES-GCM for example as a pure message authentication code (MAC) when only message authentication but not encryption is required. does it bring any ...
0
votes
0answers
79 views

Interactive ECDHE Authentication With Numeric Code

Trying to simplify my question, keeping only core concepts. Proposed solution: Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret. Device that requests ...
3
votes
1answer
204 views

Relying on a private public key for authentication

I'm Alice, and I generate a public/private key pair. I securely & confidentially share my public key with Bob and Carol, who securely & confidentially share it with various other benevolent ...
2
votes
0answers
105 views

What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?

I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices. There are many forms ...
0
votes
0answers
42 views

If we have chunk encryption for AES-Rijndael-CBC, should we hash Authenticate/tag each single chunk with a hash vs whole file?

was frustrated by which one to pick and my brain could not guess which one is better Authenticate the whole file as one with a hash vs authenticating each ciphered text. So very quickly: i have super ...
2
votes
1answer
49 views

one-pass deterministic authenticated encryption

suppose there is a router with limited storage but good network connection; it could be a good worker for deterministic authenticated encryption on streams; that means it receives data from another ...
1
vote
2answers
61 views

Any standards for canonical ordering of HMAC or additional data in AEAD ciphers?

According to RFC 5116... If the AD input is constructed out of multiple data elements, then it is essential that it be unambiguously parseable into its constituent elements, without the use of any ...
0
votes
0answers
49 views

Where are labels of a Labeled data used in homomorphic message authenticator stored?

In a fully homomorphic message authenticator, Alice can authenticate some large data $D$ using her secret key $s$k. She chooses a label $\tau$ for it, and the authentication algorithm authenticates ...
0
votes
1answer
44 views

difference between function f in eval and dec of homomorphic authenticated encryption

In the homomorphic authenticated encryption, as described 1, there are Eval and Dec PPT algorithms: In Eval, f is the function to be performed on the encrypted data. However, I need to know why it ...
1
vote
2answers
110 views

Difference between Tag and Signature

Is there a technical difference between tag such as tag generated by authenticated encryption, and signature such as the signature generated by a functional signature scheme or homomorphic signature ...
0
votes
2answers
91 views

Does HMAC provide anything that AEAD does not?

Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available) Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF....
0
votes
0answers
24 views

AEGIS/MORUS as a general purpose hash function

Can AEGIS/MORUS, ignoring its output except the tag and with a fixed key and IV, be used as a general purpose cryptographic hash function?
1
vote
1answer
101 views

are there more efficient methods than HMAC to achieve convergent encryption?

I’m thinking about the convergent encryption system described in the top answer to this question. However, it seems like preferred modern HMAC algorithms like HMAC-SHA256 (as used in step 2 to create ...
1
vote
1answer
43 views

Commitment based on authencticated encryption

Let $(E,D)$ be the encryption/decryption of an authenticated encryption scheme. Consider the following commitment scheme. Generate a random key $k$. Commit to $m$ by sending $c=E_k(m)$. Reveal $m$ by ...
5
votes
1answer
247 views

Should we use the new CAESAR competition ciphers?

At the beginning of this year, the CAESAR competition published the final portfolio for authenticated encryption algorithms. I'm not a cryptographer and when I look at other applications, almost ...
1
vote
1answer
130 views

Authenticated Encryption mode & AEAD

I'm studying Authenticated encryption with Associated Data (AEAD). My questions are About AE - I heard that when it comes to Encrypt-then-MAC, if an attacker forges the ciphertext then he gets the ...
1
vote
1answer
71 views

Is using HMAC signature as a long-term password secure?

I'm considering implementing an authentication service without storing users' passwords/hash. I want to use a key derivation function with a corresponding username...
0
votes
4answers
940 views

Why do one-time pads not provide message authentication?

It is often said that one-time pads do not provide message authentication. But, if you and I have a one-time symmetric key, and I send you a message, and it is not complete gibberish, is that itself ...
0
votes
1answer
81 views

Which HMAC scheme more secure?

Which HMAC scheme is more secure? Or are they of the same level of security? Scheme One Compute a HMAC on the data to encrypt (cleartext/plaintext) Encrypt the data with AES_CTR_256, and append ...
0
votes
1answer
104 views

Is using the same MAC twice insecure?

I was thinking last night about whether or not a HMAC-Encrypt-HMAC would be secure if you used the same HMAC key. Here is the full recipe: Compute a HMAC on the data to encrypt, and append it to the ...
0
votes
1answer
43 views

Can I use a fixed IV with AES-GCM if I only encrypt unique plaintext values? [duplicate]

My use case guarantees that all plaintext values are unique. In this case, is it safe to use a fixed IV with AES-GCM to carry our encryption/decryption?
4
votes
2answers
447 views

Is using different public keys for different peers safer than reusing the public key, beyond forward secrecy?

In X25519 (ECDH over Curve25519) Peer A and B exchange their Public Keys ...
5
votes
1answer
121 views

AEAD (for AES128-GCM): is it necessary to add a zero-length AAD?

In an implementation of AEAD_AES_128_GCM, if the AAD is defined as a "zero-length octet sequence", is it necessary to call the encryption code that adds an AAD at all? In particular, does an OpenSSL/...
2
votes
1answer
70 views

Energy consumption by mobile or sensor node when executing xor / encryption / decryption [closed]

I try to estimate the energy consumption by a sensor node when executing an authentication algorithm witch contains operations (hashing, XOR, Encryption / decryption by public/private key, addition,......
2
votes
2answers
192 views

Any benefit to encrypting IV and MAC in a mode like AES-GCM or ChaChaPoly?

Would there be any benefit to symmetrically encrypting the IV and MAC in an AEAD mode of operation? More specifically would this prevent someone from exploiting the accidental use of a duplicate IV ...
1
vote
1answer
77 views

Decrypt authenticated cipher while still encrypting [duplicate]

Normal AES-GCM generates an authentication tag at the end of encryption. I want to decrypt it while it is still being encrypted. This would be useful to send, encrypt, receive and decrypt a large file ...
1
vote
1answer
98 views

What is the difference between an anonymous-encryption scheme and an authenticated-encryption scheme?

I was going through Indy-SDK when these two schemes were referenced. I want to know the precise differences between the two. Indy-SDK links for reference to: authenticated-encryption scheme ...
1
vote
1answer
87 views

AEAD without explicit authentication tag

I'm trying to understand the purpose of tag in AEAD. As far as I can understand, the resulting ciphertext will be slightly longer than the plaintext due to the authentication tag. Will it reduce the ...
1
vote
2answers
143 views

Plain text size limits for AES-GCM mode at 2GB with Sun JCE implementation?

The Sun JCE implementation of GCM is hard coded to refuse to encode more than 2 Gb, through the function GaloisCounterMode.checkDataLength() that returns an error message : "SunJCE provider only ...
3
votes
2answers
193 views

Robust authentication and integrity for short OTP message

Using any of the wonders of modern cryptographic technology, how is it possible to package a tweet-sized plaintext, which is to be encrypted with a proper one-time pad, to ensure its integrity and ...
5
votes
2answers
130 views

Append data to authenticated ciphertext encrypted using a stream cipher

Say we have xSalsa20 authenticated using Poly1305. If $ X $ is the ciphertext, $N$ is the nonce value, and $H$ is the authentication tag such that the final ciphertext is $ N || X || H $, then given ...
2
votes
0answers
44 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
1
vote
1answer
120 views

Encrypting more than ~64GiB with AES-GCM - Integrity

I'm looking for solution to encrypt more than acceptable limit ~64GiB under same key with AES-GCM. I know I'm obligated to exchange nonces for each next ~64GiB chunk, but there is one thing that is ...
3
votes
3answers
477 views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
0
votes
1answer
120 views

Entity authentication protocol by encryption

I'm not a cryptography expert, so excuse me if the question seems very trivial. I need to know if this protocol is secure against a MiTM attacks and ensure a safe entity authentication method. We ...
2
votes
2answers
139 views

Choice between appending or prepending nonces to ciphertexts

I understand that when using CTR mode it is usually secure to append or prepend the nonce to the resulting ciphertext, whether the nonce is before or after the ciphertext being unimportant. However, ...
4
votes
2answers
179 views

Where shall we use an authenticated encryption mode?

I learned from Wikipedia that authenticated encryption modes include OCB, CCM, EAX, GCM, and so on. Does this mean that when we want to use authenticated encryption we shall use these modes? But these ...
1
vote
0answers
51 views

How does the offline authentication work?

In these slides, offline and online PUF-based authentication protocols are explained in minute 16:30 and 17:30, respectively. I understand the way the online protocol works. Basically, the server ...
0
votes
1answer
117 views

What Are Secure Limits to Truncate the Authentication Tag (Mac) for Short Messages?

I have messages with the following fixed lengths: 4 byte 8 byte 16 byte I want to encrypted them and prevent modification by appending an authentication tag using a MAC algorithm of my choosing (e.g....
4
votes
2answers
160 views

What is the security concept in printer cartridge?

Based on this datasheet or this patent, one of the usage of PUF is printer cartridge identification and authentication. I was wondering why printer cartridge needs identification and authentication. ...
0
votes
2answers
53 views

Quick scan which data (hmac/fernet) can be decrypted with a key?

I am designing a secure vault, which stores tens of thousands of encrypted messages and authenticated with Fernet/HMAC, A user query the vault with a key, could I use some kind of index to tell if the ...
0
votes
1answer
78 views

silly possibly original AE construction

This idea is inspired by a recent question about sending 32 byte messages, encrypted, without a MAC but still achieving the equivalent protection of a MAC just by using a block cipher, extra ...
2
votes
3answers
179 views

Can I achieve data authentication with ChaCha20 without MAC?

My case is rather special. I need to send data in small chunks, each under 32bytes. ChaCha20 state is 64 bytes. Since I will be receiving data stream in chunks, id like to verify it on the fly (i.e. ...
1
vote
1answer
132 views

Cryptographic equivalent of family coat of arms

As a layman when it comes to cryptography, I have recently been asking myself if there was a cryptographic equivalent of a family code of arms. I'm thinking of something asymmetric, that is future ...
0
votes
0answers
69 views

Is it safe to use ECB mode this way, w/o duplicate blocks?

I wanna make my own "way" of encrypting separate messages. And I want it to have the least possible size overhead while being completely encrypted (hide msg counter). Here's my current idea: we ...
6
votes
1answer
195 views

Deterministic Authenticated Encryption with AES-OFB and HMAC

I have an encrypted column in a database that stores sensitive information. The existing encryption scheme is deterministic and a database index exists on the encrypted value to allow searching. I am ...
6
votes
2answers
314 views

What do NM-CPA, and NM-CCA mean?

When I've been researching authenticated encryption, the following terms keep showing up: NM-CPA NM-CCA ....without any definition as to what they mean. I've tried searching the web for their ...
2
votes
1answer
128 views

Guessing the key in AES256-GCM? [duplicate]

I assume that my case is weird but I've the following information: IV: 0x263e or 0x3e26 Auth tag: 0x25 AES256-GCM encrypted payload: 0x4eec96df534ade4c013a AES256-GCM decrypted payload: ...

1
2 3 4 5
…
8