Questions tagged [authenticated-encryption]

Combination of encryption and authentication in a way that ensures confidentiality and integrity.

75 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8 votes
0 answers
959 views

Key size, performance, and security tradeoffs for AES GCM / CCM

AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
user avatar
  • 235
6 votes
0 answers
331 views

Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?

I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support. I even ...
user avatar
  • 770
4 votes
0 answers
365 views

Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?

Is there any functional or strong security difference beyond speed between AES-GCM-SIV with implicit fixed public IV and no additional data AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
user avatar
  • 125k
4 votes
0 answers
184 views

Does length prepending fix the key reuse problems with CBC and CBC-MAC?

As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea. Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
user avatar
  • 44.7k
4 votes
0 answers
490 views

Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
user avatar
  • 31.3k
3 votes
0 answers
106 views

How to fix the issue with Gimli full permutation distinguisher?

A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and ...
user avatar
  • 1,990
3 votes
0 answers
200 views

How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?

I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes). For ...
user avatar
3 votes
0 answers
139 views

Extending IGE to provide authentication

I was playing around with the idea of modifying infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any ...
user avatar
  • 3,407
3 votes
0 answers
288 views

Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?

When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
user avatar
  • 131
3 votes
0 answers
176 views

What is the "correct" way to authenticate hybrid encryption?

In hybrid encryption we use an asymmetric encryption scheme and the recipients public key to encrypt a symmetric encryption key $K$. I will denote the resulting ciphertext $C_A$. We then use a ...
user avatar
  • 2,857
3 votes
0 answers
190 views

Can XTS + checksum be used for authenticated encryption?

Is it possible to use XTS + a checksum for authenticated encryption? Specifically, it seems like a good $n$ bit checksum applied before encryption should ensure that any change to the ciphertext will ...
user avatar
  • 4,653
3 votes
0 answers
168 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
user avatar
3 votes
0 answers
243 views

Can we use the sponge construct to efficiently authenticate any cipher?

The sponge construct facilitates authenticated encryption independently of the function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the mixing function in a sponge to ...
user avatar
  • 19.2k
2 votes
0 answers
36 views

Are side-channels a concern for AEAD key commitment fixes?

I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
user avatar
2 votes
1 answer
148 views

Key Encryption: Does it need to be Authenticated?

Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself. She encrypts the files with keys $k_i$ ...
user avatar
2 votes
0 answers
142 views

Is the following derived MAC where the output is XOR'ed with the key secure?

Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck . More details: It's just any reduction ...
user avatar
2 votes
0 answers
148 views

GPG should you double sign?

This is not a question about whether I should encrypt or sign first, as I've read here. Rather, it's about whether I should sign, then encrypt, then sign again. Because as far as I know, there is no ...
user avatar
2 votes
0 answers
22 views

Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?

Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the ...
user avatar
  • 333
2 votes
0 answers
90 views

Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?

I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it. The ...
user avatar
2 votes
0 answers
25 views

What happens in the MonkeyWrap-Algorithm of KetjeV2 if the input is a single block?

I am currently implementing KetjeV2 in VHDL. I have a question concerning the MonkeyWrap-Algorithm that is used in KetjeV2. The function $wrap(A, B, l)$ is supposed to work as shown below, where $A$ ...
user avatar
  • 121
2 votes
0 answers
116 views

Dedicated authenticated encryption

Authenticated encryption is said to be achievable with either of these three things: Use a separate algorithm that ensures authentications such as HMAC. Use one of the several block cipher modes of ...
user avatar
  • 3,407
2 votes
0 answers
34 views

Maximum strength of an authenticated encryption scheme like this

Assume that we have a authentication-capable block cipher with key size $k$ and block size $n$ where $n = 2 \times m$. The function used to encrypt blocks takes the block index $i$ as an additional ...
user avatar
  • 3,407
2 votes
0 answers
161 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
user avatar
2 votes
0 answers
114 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $\...
user avatar
2 votes
0 answers
474 views

Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?

OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
user avatar
  • 4,653
2 votes
0 answers
500 views

StoredKey in Salted Challenge Response Mechanism (SCRAM)

In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure ...
user avatar
  • 121
2 votes
0 answers
45 views

Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?

I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
user avatar
2 votes
0 answers
56 views

How can I read the AE figures?

This question is rather simple. I've recently read the paper "Automated Analysis and Synthesis of Authenticated Encryption Schemes". On page 17 of this paper the authors provide three figures of ...
user avatar
  • 44.7k
1 vote
0 answers
76 views

Can I use content-derived deterministic encryption key with hybrid encryption?

My use case, making public-key encrypted backups, requires deterministic public-key authenticated encryption. I favour NaCl box, but the way it is generally used is probabilistic and it yields ...
user avatar
  • 11
1 vote
0 answers
34 views

Generalizing randomized permutation functions

The paper on the "SNEIKEN and SNEIKHA" AE and HASH sponge-based algorithms, respectively, presents a 512-bit permutation function "SNEIK512" that, unlike other permutations (ie: ...
user avatar
1 vote
0 answers
74 views

How to compose (H)KDF, Encryption and (H)MAC

For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC. A typical task is to transfer data from one node to ...
user avatar
1 vote
0 answers
96 views

xChaCha20 Block Keys for Poly1305

So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
user avatar
  • 111
1 vote
0 answers
57 views

Impact of partitioning oracle attacks on file encryption?

I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now. According to this thread, The aim is the recovery of a ...
user avatar
  • 421
1 vote
0 answers
49 views

What are the differences between the various Authenticated Encryption schemes using Keccak?

Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption. However, there already seem multiple schemes defined for it, including their own implementations: ...
user avatar
  • 85.9k
1 vote
0 answers
38 views

Prove that secure authenticated encryption system composed with itself is secure

Suppose $(E,D)$ provides authenticated encryption with key space $K$. Define $(E',D')$ with key space $K^2$ as follows: $$ E'((k_1,k_2),m) = E(k_2,E(k_1,m)) \\ D'((k_1,k_2),c) = \begin{cases} D(k_1,E(...
user avatar
  • 111
1 vote
0 answers
155 views

Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives

I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
user avatar
  • 111
1 vote
0 answers
74 views

getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure

I was going through this question of nested encryption: Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
user avatar
  • 49
1 vote
0 answers
63 views

Can Encrypt-then-MAC be used with session ticket resumption?

In TLS 1.2, say a session ticket is created for the current session (Session Tickets RFC 5077), and the current session uses the Encrypt-then-MAC extension RFC 7366 (I.E. both client and server ...
user avatar
1 vote
0 answers
48 views

Is fingerprint authentication meaningless if the server/client is closed source?

I'm talking about when two chat users want to verify their identities via public key fingerprints. If the Client app is closed source, and we cannot see what it is doing, isn't the Server able to play ...
user avatar
  • 73
1 vote
0 answers
137 views

is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?

After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
user avatar
  • 413
1 vote
0 answers
113 views

How does the offline authentication work?

In these slides, offline and online PUF-based authentication protocols are explained in minute 16:30 and 17:30, respectively. I understand the way the online protocol works. Basically, the server ...
user avatar
  • 263
1 vote
0 answers
247 views

XEX vs EME mode of operation

Two of the CAESAR finalists use XEX and EME mode of operations (COLM uses EME, OCB uses XEX). I did literature to summarize the main advantages / disadvantages but I could not find much. My question ...
user avatar
  • 1,990
1 vote
0 answers
112 views

Security implications of plaintext-padding in an AEAD-scheme

Let's say I have a secure AEAD-scheme like ChaCha20/HMAC and my encrypted blobs need to match a fixed size: Is it OK to apply some padding to my plaintext to match the block-size? Can I use any ...
user avatar
1 vote
0 answers
165 views

Encrypted comms between devices on LAN

I'm trying to encrypt a protocol that shares data between devices on a local area network (i.e.no connection to the internet). I don't want to use predefined keys because they're too easy to read from ...
user avatar
  • 119
1 vote
0 answers
41 views

Why does HS1-SIV allow forgeries when the SIV collides, even when the PMN does not collide?

The HS1-SIV authors claim that forgeries are possible if an SIV collision occurs. However, I do not understand how this is possible unless the PMN collides too. Otherwise, the collision will be in ...
user avatar
  • 4,653
1 vote
0 answers
139 views

Designing an AES-based protocol for controlling and acessing ioT boards via RF

I'm designing an open ioT protocol to be used on ioT boards based on Texas Instruments RF-based MCUs. These MCUs have an AES module to easily encrypt and decrypt AES content, so that's why I choose a ...
user avatar
1 vote
0 answers
258 views

Signatures with Hybrid Encryption

Typically, in public-key settings, sign-then-encrypt has been used to provide confidentiality and integrity. However, most public-key cryptosystems use hybrid encryption. I've been searching around ...
user avatar
  • 11
1 vote
0 answers
858 views

Mutual authentication with Public Key and session Key

I am trying to understand two protocols for mutual authentication and if they are secure or not. $K$ is the session key, and it's calculated $k=H(TimeStamp)$. Are the following both cases secure? ...
user avatar
1 vote
0 answers
72 views

Smart card Strong authentication / Verification ( fingerprints)

I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working ...
user avatar
1 vote
0 answers
223 views

Security of .net AES implementation and security of a hash MAC

My question rather splits into two sections: Is AES correctly and security implemented in the .net Framework? Are there any reviews of implementation mistakes that would weaken the security of AES (...
user avatar