Questions tagged [authenticated-encryption]
Combination of encryption and authentication in a way that ensures confidentiality and integrity.
75
questions with no upvoted or accepted answers
8
votes
0
answers
959
views
Key size, performance, and security tradeoffs for AES GCM / CCM
AES can be used with 128, 192 or 256 bit keys and each one appears to have a performance vs security trade-off (What is the effect of the different AES key lengths?, What are the practical differences ...
6
votes
0
answers
331
views
Are there any test vectors for the CMS content type AuthEnvelopedData (for AES-GCM)?
I am looking for CMS AuthEnvelopedData test vectors for AES-GCM mode. I haven’t seen any ready-to-use test vectors for it. There are test vectors for AES-GCM mode but not for its CMS support.
I even ...
4
votes
0
answers
365
views
Is AES-GCM-SIV with fixed IV deterministic authenticated encryption?
Is there any functional or strong security difference beyond speed between
AES-GCM-SIV with implicit fixed public IV and no additional data
AES-CTR (or AES-OFB) with 128-bit IV computed per HMAC-SHA-...
4
votes
0
answers
184
views
Does length prepending fix the key reuse problems with CBC and CBC-MAC?
As I hope everybody is well-aware, re-using the key for CBC-MAC and CBC is a really bad idea.
Now, there's also the paradigm to prepend the message length to the CBC-MAC (as "associated data") to ...
4
votes
0
answers
490
views
Can convergent encryption be turned into deterministic authenticated encryption with HMAC?
If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic ...
3
votes
0
answers
106
views
How to fix the issue with Gimli full permutation distinguisher?
A new paper "New results on Gimli: full-permutation distinguishers and improved collisions" has been published stating a full 24-round permutation distinguisher with a cost of $2^{64}$ and ...
3
votes
0
answers
200
views
How to implement security - authenticity/confidentiality/integrity for 6/14 bits radio messages?
I just took over two radio systems (using 433Mhz) - one communicates with 6 bit messages, one with 14 bit messages. Both have a lots of transmitters and one receiver (and, yes bits not bytes).
For ...
3
votes
0
answers
139
views
Extending IGE to provide authentication
I was playing around with the idea of modifying infinite garble extension (IGE) mode to provide authentication in one pass. I was also doing some Google searches today to see if there were any ...
3
votes
0
answers
288
views
Add authenticated encryption additional data (AEAD) to data encryption key (DEK)?
When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and ...
3
votes
0
answers
176
views
What is the "correct" way to authenticate hybrid encryption?
In hybrid encryption we use an asymmetric encryption scheme and the recipients public key to encrypt a symmetric encryption key $K$. I will denote the resulting ciphertext $C_A$. We then use a ...
3
votes
0
answers
190
views
Can XTS + checksum be used for authenticated encryption?
Is it possible to use XTS + a checksum for authenticated encryption? Specifically, it seems like a good $n$ bit checksum applied before encryption should ensure that any change to the ciphertext will ...
3
votes
0
answers
168
views
Authenticated encryption with Enc-Sign-Mac
I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
0
answers
243
views
Can we use the sponge construct to efficiently authenticate any cipher?
The sponge construct facilitates authenticated encryption independently of the
function used to mix its state. Could we use any strong cipher (i.e. AES-256) as the
mixing function in a sponge to ...
2
votes
0
answers
36
views
Are side-channels a concern for AEAD key commitment fixes?
I'm currently debating whether to revert to a non-committing AEAD (ChaCha20-Poly1305) instead of a committing AEAD based on Encrypt-then-MAC (XChaCha20-BLAKE2b) for stream encryption. Borg backup made ...
2
votes
1
answer
148
views
Key Encryption: Does it need to be Authenticated?
Alice wants to store files $m_i$ on Bob's untrusted cloud storage platform, with the additional restriction that she can only store one master key $k$ herself.
She encrypts the files with keys $k_i$ ...
2
votes
0
answers
142
views
Is the following derived MAC where the output is XOR'ed with the key secure?
Hey I'm wondering if the following scheme is secure or not , I tried reductions and some tries to prove that it not must be secure but I feel completely stuck .
More details:
It's just any reduction ...
2
votes
0
answers
148
views
GPG should you double sign?
This is not a question about whether I should encrypt or sign first, as I've read here.
Rather, it's about whether I should sign, then encrypt, then sign again.
Because as far as I know, there is no ...
2
votes
0
answers
22
views
Can we say that password authentication contains registration phase, authentication phase and authenticated key exchange phase?
Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the ...
2
votes
0
answers
90
views
Do AEAD algorithms and encrypt-then-MAC mitigate external decryption oracles?
I'm curious about a possible attack scenario that I'm not sure exists. If it is possible, I'd like to know if and how AEAD algorithms and encrypt-then-MAC implementations protect against it.
The ...
2
votes
0
answers
25
views
What happens in the MonkeyWrap-Algorithm of KetjeV2 if the input is a single block?
I am currently implementing KetjeV2 in VHDL. I have a question concerning the MonkeyWrap-Algorithm that is used in KetjeV2.
The function $wrap(A, B, l)$ is supposed to work as shown below, where $A$ ...
2
votes
0
answers
116
views
Dedicated authenticated encryption
Authenticated encryption is said to be achievable with either of these three things:
Use a separate algorithm that ensures authentications such as HMAC.
Use one of the several block cipher modes of ...
2
votes
0
answers
34
views
Maximum strength of an authenticated encryption scheme like this
Assume that we have a authentication-capable block cipher with key size $k$ and block size $n$ where $n = 2 \times m$. The function used to encrypt blocks takes the block index $i$ as an additional ...
2
votes
0
answers
161
views
Combining AES-SIV and a password-derived key
I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$:
$$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$
where
$AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
2
votes
0
answers
114
views
Given a public-key encryption and signature scheme, define a new primitive
I'm new to cryptography and am currently working on the following question:
Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $\...
2
votes
0
answers
474
views
Is OCB the state of the art in authenticated encryption modes of operation for block ciphers?
OCB mode seems to represent the state of the art in authenticated encryption modes, largely due to its speed – it is faster than GCM even when GCM has hardware support. Its only drawbacks seem ...
2
votes
0
answers
500
views
StoredKey in Salted Challenge Response Mechanism (SCRAM)
In SCRAM (RFC5802, page 8) the client generates ClientKey to server, which is a derivation of the original password. This is communicated to the server in a secure ...
2
votes
0
answers
45
views
Is there a system where I can securely store a secret value and compare a semi-ambiguous input to it?
I have an idea for a new kind of mobile phone lock screen. When you first create your pattern, you put together a series of colors and compass directions from the following choices: Red, Blue, Yellow, ...
2
votes
0
answers
56
views
How can I read the AE figures?
This question is rather simple.
I've recently read the paper
"Automated Analysis and Synthesis of
Authenticated Encryption Schemes".
On page 17 of this paper the authors provide three figures of ...
1
vote
0
answers
76
views
Can I use content-derived deterministic encryption key with hybrid encryption?
My use case, making public-key encrypted backups, requires deterministic public-key authenticated encryption. I favour NaCl box, but the way it is generally used is probabilistic and it yields ...
1
vote
0
answers
34
views
Generalizing randomized permutation functions
The paper on the "SNEIKEN and SNEIKHA" AE and HASH sponge-based algorithms, respectively, presents a 512-bit permutation function "SNEIK512" that, unlike other permutations (ie: ...
1
vote
0
answers
74
views
How to compose (H)KDF, Encryption and (H)MAC
For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC.
A typical task is to transfer data from one node to ...
1
vote
0
answers
96
views
xChaCha20 Block Keys for Poly1305
So xChaCha20 has a nonce size large enough to safely use a random nonce with the same key. Poly1305 generally uses the first block of the cipher's output to generate its nonce. For xChaCha20 it would ...
1
vote
0
answers
57
views
Impact of partitioning oracle attacks on file encryption?
I've just learned about partitioning oracle attacks recently, and I would like to clarify some things that are a little foggy to me right now.
According to this thread,
The aim is the recovery of a ...
1
vote
0
answers
49
views
What are the differences between the various Authenticated Encryption schemes using Keccak?
Keccak - as used in SHA-3 / SHAKE amongst others - can also be used for authenticated encryption.
However, there already seem multiple schemes defined for it, including their own implementations:
...
1
vote
0
answers
38
views
Prove that secure authenticated encryption system composed with itself is secure
Suppose $(E,D)$ provides authenticated encryption with key space $K$. Define $(E',D')$ with key space $K^2$ as follows:
$$
E'((k_1,k_2),m) = E(k_2,E(k_1,m)) \\
D'((k_1,k_2),c) = \begin{cases}
D(k_1,E(...
1
vote
0
answers
155
views
Constructing an XChaCha20-Poly1305 Equivalent using FIPS-140 Primitives
I am playing around with the idea of modelling clustered data storage as a series of AEAD messages. XChaCha20-Poly1305 has nice properties for my intended design, as the ability to use random IVs ...
1
vote
0
answers
74
views
getting key $k_{2}$ somehow definitely compromise authentication scheme and attacker can see cipher text now...so not secure
I was going through this question of nested encryption:
Given $\Pi$ = $({Gen}, {Enc}, {Dec})$ is authentication encryption we have designed new scheme $\Pi^{'}$ = $({Gen^{'}}, {Enc{'}}, {Dec{'}})$ ...
1
vote
0
answers
63
views
Can Encrypt-then-MAC be used with session ticket resumption?
In TLS 1.2, say a session ticket is created for the current session (Session Tickets RFC 5077), and the current session uses the Encrypt-then-MAC extension RFC 7366 (I.E. both client and server ...
1
vote
0
answers
48
views
Is fingerprint authentication meaningless if the server/client is closed source?
I'm talking about when two chat users want to verify their identities via public key fingerprints.
If the Client app is closed source, and we cannot see what it is doing, isn't the Server able to play ...
1
vote
0
answers
137
views
is it possible to achieve authenticated key agreement without using PKI or pre-shared secret?
After reading different techniques to achieve authenticated key-agreement (X3DH, HMQV, Asynchronous Ratcheting tree, An efficient protocol for authenticated key agreement, I understood that all these ...
1
vote
0
answers
113
views
How does the offline authentication work?
In these slides, offline and online PUF-based authentication protocols are explained in minute 16:30 and 17:30, respectively. I understand the way the online protocol works. Basically, the server ...
1
vote
0
answers
247
views
XEX vs EME mode of operation
Two of the CAESAR finalists use XEX and EME mode of operations (COLM uses EME, OCB uses XEX).
I did literature to summarize the main advantages / disadvantages but I could not find much. My question ...
1
vote
0
answers
112
views
Security implications of plaintext-padding in an AEAD-scheme
Let's say I have a secure AEAD-scheme like ChaCha20/HMAC and my encrypted blobs need to match a fixed size:
Is it OK to apply some padding to my plaintext to match the block-size?
Can I use any ...
1
vote
0
answers
165
views
Encrypted comms between devices on LAN
I'm trying to encrypt a protocol that shares data between devices on a local area network (i.e.no connection to the internet). I don't want to use predefined keys because they're too easy to read from ...
1
vote
0
answers
41
views
Why does HS1-SIV allow forgeries when the SIV collides, even when the PMN does not collide?
The HS1-SIV authors claim that forgeries are possible if an SIV collision occurs.
However, I do not understand how this is possible unless the PMN collides too. Otherwise, the collision will be in ...
1
vote
0
answers
139
views
Designing an AES-based protocol for controlling and acessing ioT boards via RF
I'm designing an open ioT protocol to be used on ioT boards based on Texas Instruments RF-based MCUs. These MCUs have an AES module to easily encrypt and decrypt AES content, so that's why I choose a ...
1
vote
0
answers
258
views
Signatures with Hybrid Encryption
Typically, in public-key settings, sign-then-encrypt has been used to provide confidentiality and integrity. However, most public-key cryptosystems use hybrid encryption. I've been searching around ...
1
vote
0
answers
858
views
Mutual authentication with Public Key and session Key
I am trying to understand two protocols for mutual authentication and if they are secure or not.
$K$ is the session key, and it's calculated $k=H(TimeStamp)$.
Are the following both cases secure? ...
1
vote
0
answers
72
views
Smart card Strong authentication / Verification ( fingerprints)
I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working ...
1
vote
0
answers
223
views
Security of .net AES implementation and security of a hash MAC
My question rather splits into two sections:
Is AES correctly and security implemented in the .net Framework?
Are there any reviews of implementation mistakes that would weaken the security of AES (...