Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality and integrity.
448
questions
0
votes
1answer
32 views
Case Scenarios where Identity Based identification (IBI) Scheme can be employed
I was reading about identity based Identification scheme today. There are lot of articles and research paper on it. There is active research being done in this are of IBI schemes.
My question is ...
1
vote
0answers
65 views
getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now…so not secure
I was going through this question of nested encryption:
Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
0
votes
0answers
35 views
Not getting idea how to formally chose chosen cipher attack so adversay wins with non-negligible probability
I was going through this question and intuition came that same message can be used to break security but I an not able formalize it well...can someone help how to create chosen ciphertext attack ...
0
votes
1answer
34 views
IND-CCA insecurity of modified CBC encrypt + MAC scheme
I've been puzzling over the following proof for the past couple of days.
Since a block cipher in CBC mode can be used to build both an IND-CPA secure
encryption scheme and a EUF-CMA secure block, a ...
30
votes
9answers
7k views
Is it possible to create a “digital seal” to tell if a document has been opened?
So, in real life we have a handful of ways to leave a physical mark on a packet to know if it has been opened without authorization (eg. you can use 'opened' security tapes, or you can put a signature ...
1
vote
1answer
64 views
Encrypting h(k) for defeating partition oracle attacks
Is encrypting $h(k)$ (or even just $k$) and verifying it before checking the MAC enough to defeat partition oracle attacks and thus make the whole scheme robust/committing (without depending on ...
1
vote
2answers
51 views
Is nonce-less Encrypt-then-HMAC as secure as poly1305
While reading https://crypto.stackexchange.com/a/88732/87450 I noticed that it suggests encrypt-then-HMAC as a defense for partition attacks. However as far as I know unlike poly1305, HMAC does not ...
0
votes
0answers
36 views
Synchronous Sponges
The paper The sponge construction as a source of secure
cryptographic primitives (see Figure 6) mentions a synchronous sponge mode (working like CTR or OFB modes). So, this type of sponge is a non-...
1
vote
1answer
44 views
Ignoring the TAG of the AEAD-SIV encryption
I am working with personal data that contain Identifying attributes such as a player ID and i need to prepare the data for analysis purposes, therefore i need to pseudoanonymize the data beforehand. ...
0
votes
0answers
26 views
How Mac-then-encrypt provide security in nonce-misuse setting?
From this, it is clear that Encrypt-then-Mac provides more complete security than Mac-then-Encrypt but some schemes use Mac-then-encrypt to provide nonce-misuse resistance such as SIV (AES-GCM-SIV, ...
4
votes
1answer
96 views
How does GHASH used in GCM behave as a universal hashing function?
As per my understanding, a Universal Hash Function isn't a cryptographic hash function & it's output isn't uniformly distributed. However, this is still secure because it's actually a family of ...
0
votes
0answers
46 views
How secure is Encrypt-And-MAC?
From this popular Crypto.SE thread, the general feeling is that Encrypt-Then-MAC is the most secure. From the first answer, the poster says that Encrypt-And-MAC provides integrity of the plaintext. If ...
3
votes
1answer
63 views
What are the implications of allowing a zero-length GCM nonce?
NIST SP800-38D section 5.2.1.1 is clear that empty nonces are not allowed with GCM, but without explaining the reasoning. My assumption was this is simply because the probability of error (encrypting ...
1
vote
1answer
147 views
Using authenticated encryption along with signing
I know of a project that implemented e2e encryption using both authenticated encryption and public key signing. So the ciphertext produced for a message would be:
...
4
votes
1answer
144 views
Key Committing AEADs
There are multi-key attacks against some AEADs. In other words, multiple keys can be used to decrypt a message since multiple keys can be valid for an authentication tag. How would one go about adding ...
2
votes
2answers
94 views
Can I use ChaCha20-Poly1305 as my KDF?
I have two devices that use a PSK. One is embedded and extremely resource confined. I'm already using ChaCha20-Poly1305 so it would be "free" to reuse this. There is no transport encryption ...
1
vote
1answer
96 views
Identification Schemes and Internet of Things
I was reading an article titled "A Novel Method for Polar Form of Any Degree of
Multivariate Polynomials with Applications in IoT" (doi:10.3390/s19040903)
I read the following statement:
&...
2
votes
0answers
52 views
GPG should you double sign?
This is not a question about whether I should encrypt or sign first, as I've read here.
Rather, it's about whether I should sign, then encrypt, then sign again.
Because as far as I know, there is no ...
2
votes
1answer
51 views
Using crypto_sign then crypto_box_seal for anonymous messages
If you have a message M and you want the sender (alice) to be anonymous to everyone but the recipient (bob), is it ok to do?
...
-1
votes
1answer
47 views
Encryption on one AES mode and decrypting on another, where both use HMAC
Let's say there are 2 ciphers, $enc$ and $dec$, where:
$enc$ will encrypt the data, and $dec$ will decrypt it.
Both $enc$ and $dec$ must be an AES cipher.
$enc$ and $dec$ will use the same key $k$ ...
1
vote
1answer
56 views
Not understanding deterministic authenticated encryption (DAE) security definition
I have a question regarding the security definition of deterministic authenticated encryption (DAE) as defined by Bellare and Shrimpton. Their definition is reproduced below, and my question pertains ...
4
votes
2answers
153 views
MAC-then-encrypt in SIGMA protocol for authenticated key exchange
The SIGMA protocol proposed in 2003 and used in TLS 1.3 and IKE stands for "SIGn-and-MAc" and can optionally protect identity using encryption.
The SIGMA-I variant illustrated below ...
8
votes
2answers
1k views
Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?
In NIST's Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process document it is stated that:
3.1 AEAD (Authenticated Encryption with Associated Data) ...
4
votes
2answers
125 views
Why does TinyJAMBU-128 claim only 112-bit security?
I am trying to understand the security level of TinyJAMBU-128.
As shown in Table 4.1 page 12 of this document, TinyJAMBU-128 claims 112-bit security. However, it has a 128-bit key. How have we lost 16 ...
0
votes
1answer
64 views
How to show Hash-Then-Encrypt is not AE-secure
(E,D) is a CPA-secure cipher defined over (K,M,C).H: C → T is collision resistant hash functions.
E(k,m):=E(k,m), H(c)), D=(k,c1,c2):=D(k,c1) if H(c1)==C2 otherwise Reject.
ps:the question is from the ...
1
vote
1answer
95 views
XSalsa20 + Poly1305 authentication wtihout tag
Do I understand correctly that XSalsa20 + Poly1305 provides authentication without a tag? If so, then how does that work?
I came to that conclusion by reading http://nacl.cr.yp.to/secretbox.html, &...
0
votes
1answer
80 views
CCA secure vs AE scheme
We already know that every authenticated encryption scheme is CCA secure, I was wondering about the converse.
I believe it is not true, and I am finding trouble to construct a scheme which is only CCA ...
5
votes
1answer
137 views
How to securely encrypt/decrypt data with a maximum chunk size?
I am aware of the different modes so that a "raw" block cipher such as AES (ECB) can be used to encrypt more than a single block of data (CBC, OFB, CTR, etc) and modes such as AES-GCM which ...
0
votes
0answers
38 views
Security Proof, Sequence of games and birthday paradox
The sequence of games security proof approach is very confusing. For example, I am trying to understand it in the following paper
https://www.dropbox.com/s/dhsgsognxviwacv/Provably%20Secure%...
1
vote
2answers
166 views
How can RSA be used to compactly sign and encrypt?
How can RSA be used for digital signature with message recovery and encryption, providing transmission of a small message with confidentiality and authentication simultaneously, small cryptogram size, ...
2
votes
1answer
72 views
In what paper was OCB2 introduced?
I've been working through "Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality" 1 from earlier this year. My knowledge of OCB2 is pretty shallow though, and so I'm keen to ...
1
vote
1answer
91 views
Using a nonce as a salt for key derivation
I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case ...
4
votes
0answers
140 views
Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?
Is there any functional or strong security difference beyond speed between
AES-GCM-SIV with implicit fixed public IV and no additional data
AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
0
votes
1answer
49 views
Is there any way to save Email encrypted in Database and used as normal later?
I have a senario like
" I want to save a email (like foo@bar.com) encrypted in Database (For example as 'asdjasjdna') ...
1
vote
0answers
45 views
Can Encrypt-then-MAC be used with session ticket resumption?
In TLS 1.2, say a session ticket is created for the current session (Session Tickets RFC 5077), and the current session uses the Encrypt-then-MAC extension RFC 7366 (I.E. both client and server ...
3
votes
1answer
102 views
AES-GCM ciphertext that deciphers under two keys
How can we exhibit an AES-GCM ciphertext, including IV and 128-bit authentication tag, and distinct keys $K_0$ and $K_1$, so that decryption succeeds for both keys?
What degree of control do we have ...
0
votes
1answer
104 views
Consequences of AES-GCM always encrypting the same plaintext
I am analysing an authentication protocol. In this protocol AES-GCM is used to encrypt part of the messages.
Regarding the authentication protocol, I made the following observations:
The plaintext ...
0
votes
2answers
97 views
How to prove that I am part of a list without revealing my identity?
Let's suppose and scenario like a secret voting scheme, at the ID verification step.
Considerations:
There is a public list of identities of people who are able to vote (ex, people who live in a ...
1
vote
1answer
211 views
What is Associated Data in AEAD?
I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of ...
1
vote
1answer
48 views
Number message limits of Galois/Counter Mode (GCM) per key
In
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
page 27,
it is said that
...the total number of blocks of plaintext and AAD that are protected by
invocations of the ...
0
votes
0answers
25 views
How does APE: Authenticated Permutation-Based Encryption work?
I am trying to understand the encryption and decryption process of the APE: APE: Authenticated Permutation-Based Encryption for Lightweight Cryptography
Full paper
The Encryption
what is exactly the <...
0
votes
0answers
34 views
Forge valid token with misuse of OTP key reuse
I'm new to OTP and received a challenge.
Challenge
Context: A server uses OTP to encrypt and decrypt authentication tokens.
Misuse: The server always uses the same key.
Objective: Forge a valid token ...
0
votes
1answer
92 views
Can I use the same key pair for authentication and Diffie-Hellman? [duplicate]
Assume Alice has a key pair $(A, a)$ and Bob has a key pair $(B, b)$, where $A = Ga$ and $B = Gb$. In general, the basic rule of crypto says that we should not use the same key for different ...
2
votes
1answer
82 views
What does the $e$ operation mean in cryptography research papers?
I read a cryptography scheme that it include the following operation:
$$c= H(e(g_1,g_n)^t)$$
where H is a hash function.
I need to know what the operation $e$ means.
2
votes
2answers
137 views
Forgery attack on Poly1305 when the key and nonce reused
Introduction: I've tried to find how reusing one-time key compromises itself but only found information that it breaks the encryption entirely, it is written everywhere. But since no methods to reuse ...
1
vote
0answers
44 views
Is fingerprint authentication meaningless if the server/client is closed source?
I'm talking about when two chat users want to verify their identities via public key fingerprints.
If the Client app is closed source, and we cannot see what it is doing, isn't the Server able to play ...
2
votes
3answers
588 views
Do all AEAD implementations use symmetric key ciphers in practice?
Everything I've seen so far in modern implementations (the Linux Kernel AEAD API, JVM crypto provider (AES-GCM), RFC 8439, libsodium, etc) seems to imply that only symmetric key block ciphers are used ...
0
votes
0answers
49 views
Security of CCM using 8 byte MAC within TLS
In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient&...
2
votes
0answers
19 views
Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?
Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the ...
0
votes
1answer
74 views
Using HMAC with AES modes that do NOT require padding [closed]
I'm trying to use HMAC with AES modes that do not require any sort of padding.
Although I am aware that modes like AES-GCM and ...
