Skip to main content

Questions tagged [authenticated-encryption]

Combination of encryption and authentication in a way that ensures confidentiality, integrity and authentication

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

CMPv2 Design and Implementation

did anyone tried to configure CMPv2 protocol before and what is the tool did you used to configure it ?
Nagy's user avatar
  • 1
2 votes
0 answers
62 views

Can the Threefish tweak block cipher have its fixed 128 bit tweak size extended to match the block size (256/512/1024)

The Threefish tweak block cipher has a fixed size tweak (128 bits) and three different possible key/block sizes (256/512/1024 bits). The MCOE on-line authenticated encryption mode presents three ...
cookiecipher's user avatar
0 votes
1 answer
38 views

Length of SK_ei and SK_er in IKEv2 when using AEAD

I'm currently using strongSwan as a peer for the IKEv2 protocol. I've configured it to use HMAC SHA-256 for its pseudorandom function, and AES-256-GCM-16 for its encryption and integrity algorithm. ...
skeguest's user avatar
1 vote
1 answer
48 views

Sankey Diagram for Wireless sensor network, accurate?

I've designed a Sankey diagram to depict security in Wireless Body Area Networks for my thesis. It's the first time I see such a diagram used for security. I need your help. Could you check its ...
Moh Kashani's user avatar
0 votes
0 answers
45 views

Peer-to-Peer message verification

I have a chat application that uses AES and RSA encryption to establish a peer-to-peer connection between two clients. Although the messages pass through a server, they are encrypted using a single ...
Higgs's user avatar
  • 1
0 votes
1 answer
44 views

HMAC on a public key verfied data: how secure it is?

I wonder how secure the HMAC is going to be if I use a public key verified data. HMAC suggests its key must be secret. I want to authenticate a set of blocks to be certain that each of them isn't ...
Mikhail Sobolev's user avatar
2 votes
2 answers
106 views

Can you use ChaCha20 as one-time pad?

My knowledge of cryptography nothing beyond basic so I am by no means an expert, but I do know a bit of undergraduate mathematics including number theory. I know that stream ciphers like ChaCha20 is ...
cryptobro's user avatar
0 votes
0 answers
28 views

Obfuscation scheme wanted

I'd like to know if there's any cryptographic scheme that implements something similar to what I'm summarizing here below. Thanks a lot for reading and for any hint or question. Intro-Scenery: There's ...
Lorenzo's user avatar
  • 101
5 votes
1 answer
246 views

What best to put in unused nonce bytes when using AES-GCM-SIV

I want to use AES-GCM-SIV for authenticated encryption of messages in my protocol. Since it is a wireless protocol I want to transmit as few bytes as possible. For successful decryption I need to ...
Karsten's user avatar
  • 151
0 votes
0 answers
83 views

What should be passed as the authentication tag when creating a SealedBox? And can it be made public?

When creating a SealedBox, one of the parameters which needs to be passed is an authentication tag: https://developer.apple.com/documentation/cryptokit/aes/gcm/...
sudoExclamationExclamation's user avatar
2 votes
1 answer
383 views

How does SMB authentication work?

When I learned about the inner workings of the TLS protocol and what exactly it protects a connection against, I was surprised to learn that even asymmetric encryption can be defeated by a MITM attack ...
TrisT's user avatar
  • 151
3 votes
1 answer
159 views

High volume encryption with AES-GCM: AWS KMS vs CloudHSM

In my current project we will have to encrypt a lot of S3 objects (a few billions) with AWS KMS. Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs ...
Florian's user avatar
  • 31
0 votes
1 answer
233 views

Encrypting large files using RSA and AES-256-CBC-HMAC-SHA256

I developed an application that stores large files. Those files are stored in plain text. Now the project owner wants those files be encrypted on storage, he wants confidentiality, integrity, and ...
Jesús López's user avatar
4 votes
0 answers
84 views

Cryptanalytic attacks ASCON MAC

I am researching ASCON. I can find cryptanalytic attacks ASCON authenticated encryption and ASCON HASH, But I am not finding anything ASCON MAC. Anyone knows of any attacks, any research on this?
Nicole Foster's user avatar
2 votes
2 answers
122 views

Using the MAC to verify if Cipher Only attack has succeeded

I am working on an experiment to compare the efficiency of brute-force attacking block ciphers like AES and DES with reduced key sizes for different programming languages and library implementations. ...
Matt's user avatar
  • 21
1 vote
1 answer
163 views

Does using multiple encryption algorithms with different keys on the same cipher text improve security?

I'm looking for maximum possible security. My current scheme is xChaCha20-Poly1305-xSalsa20-Poly1305-AES-CBC-HMACSHA-512. Does combining these algorithms increase security if implemented correctly? ...
bismofunyuns's user avatar
2 votes
1 answer
82 views

Oribatida masking question

Why Oribatida uses previous capacity $V_{a+m-1}$ instead of current capacity $V_{a+m}$ for rate masking? EDIT: I have asked this one of the authors (Arghya Bhattacharjee) and he replied: Let's say ...
LightBit's user avatar
  • 1,649
1 vote
1 answer
58 views

Can MCOE AEAD mode be modified to work with Threefish tweak block cipher and generate intermediate tags

The MCOE mode provides a really nice way to implement a nonce-misuse resistant AEAD and is based on an arbitrary tweak block cipher. A specific requirement of the tweak block cipher is that the data ...
cookiecipher's user avatar
0 votes
0 answers
109 views

What is the AEGIS design rationale for one way rounds and slow diffusion?

The AEGIS reference document doesn't specify why the authors chose a slow diffusion process and a one way round transformation. As you can see the previous state is XORed with AES applied to itself ...
LightTunnelEnd's user avatar
0 votes
0 answers
80 views

Full-Block Cipher Feedback Mode as a complete AEAD with a free MAC?

Full-State Keyed Sponge (aka Donkey Sponge) appears to cross over into block cipher mode territory such as Full Block Cipher Feedback Mode: Full State Keyed Sponge (FKS) construction: FKS has been ...
LightTunnelEnd's user avatar
1 vote
0 answers
139 views

Can a Full-State Keyed Sponge be used as AEAD by using XEX?

Full-State Keyed Sponge (aka Donkey Sponge) is when a message is absorbed into the full state of the sponge. Such an approach to MAC construction is considered secure. 1 However for an AEAD or a ...
LightTunnelEnd's user avatar
3 votes
2 answers
338 views

Are sponges inherently inefficient when compared to other constructions?

A sponge has by definition 'wasted' operations (the part of the state which always remains private but goes through all the ops of the permutation). In return for that waste you get a MAC at the end - ...
LightTunnelEnd's user avatar
0 votes
1 answer
90 views

Nonce reuse in GMAC without ciphertext (only AAD)

As we all know, nonce reuse in AES/GCM can easily be catastrophic. However, I'm wondering if the same risks are present if an adversary has access to: Ciphertext and corresponding MAC of one message ...
Julian Durchholz's user avatar
4 votes
1 answer
140 views

How is the Full-State Keyed duplex useful?

In the Full-State Keyed duplex (sponge construction AEAD), plaintext is absorbed into the entire state of the sponge permutation but only a portion of the output can be used else the scheme breaks (...
LightTunnelEnd's user avatar
4 votes
2 answers
572 views

Key commitment in GCM (or AEAD in general)

Many of the presentations at The Third NIST Workshop on Block Cipher Modes of Operation 2023 complain about the lack of key commitment in AES-GCM. But isn't that one application of "associated ...
yoyo's user avatar
  • 420
2 votes
1 answer
184 views

IND-CPA/CCA security of AEAD schemes

I was reading the Hybrid Public Key Encryption (HPKE) RFC and I came across this sentence in section 9.4 "All AEADs MUST be IND-CCA2-secure, as is currently true for all AEADs listed in Section 7....
honzaik's user avatar
  • 452
1 vote
2 answers
99 views

Efficiently detect that a ciphertext is meant for Alice

Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
user avatar
0 votes
0 answers
32 views

How IV value shapes the State Matrix of PHOTON AEAD?

In PHOTON-Beetle Authenticated Encryption algorithm, the state consists of 64 4-bit elements, which is represented as a (8 × 8) matrix. The Initial Value which consists of Key and Nonce from the ...
Mohammadsadeq Borjiyan's user avatar
1 vote
0 answers
26 views

Tag Management Problem in Authenticated Disk Encryption

1) For authenticated disk encryption, there are extra data such as IV or tag that need to be stored for all the alternative mods that are placed in Table 1. For these data, it will be necessary to use ...
NB_1907's user avatar
  • 640
0 votes
0 answers
23 views

Identity authentication in anonymous public key encryption

In a similar anonymous PKE based on D-H key exchange, in a many-to-one (one-to-many) case, is there any way to implement authentication without revealing the identity of the sender (receiver)? Could ...
Ping Ping's user avatar
3 votes
2 answers
967 views

Encrypting arbitrary large files in AEAD chunks - how to protect against chunk reordering?

I would like to encrypt big files using an authenticated cipher. I am convinced to use approach where file is divided into smaller manageable chunks that fit easily in memory (e.g. 1-10MB size) which ...
Tom Raganowicz's user avatar
1 vote
1 answer
760 views

How does AES-GCM and AES-CCM provide authenticity?

My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity. In CCM, as I understand it, the authenticity lies in the MAC, i....
user946822's user avatar
3 votes
1 answer
218 views

Does HMAC provide anything that AES GCM does not?

I would like to let the receiver has the ability to check the sender's authenticity when he gets the message. Also, I want to protect the message's confidentiality and integrity. Should I use ...
yaoxin jing's user avatar
1 vote
1 answer
71 views

Is it undesirable for authentication to require decrypting a ciphertext?

A couple years ago, I devised some primitives for block ciphers and block cipher modes of operation; I was partly inspired by CAESAR. What these designs all had in common is that the encryption/...
Melab's user avatar
  • 3,655
5 votes
2 answers
205 views

Authenticated encryption scheme for one-way radio telemetry

I'm designing an authenticated encryption scheme for a noninteractive one-way radio telemetry system. A number of devices in the field send back telemetry to a base station periodically, but no ...
Polynomial's user avatar
  • 3,527
2 votes
1 answer
1k views

When using AES-256 in combination with HMAC-SHA, should we use SHA-256 or SHA-512?

When using AES-256 (cipher mode CBC and padding mode PKCS7) in combination with HMAC-SHA for authenticated encryption (assuming alternatives like TLS and AES-GCM cannot be used), should we use SHA-...
SeekingAnswers's user avatar
1 vote
0 answers
34 views

Secure ciphersuite from security-wise sub-optimal unkeyed permutation?

Hypothetically, IF we were to create a SSL/TLS or QUIC ciphersuite from a single (unkeyed) permutation operating in sponge mode to provide hashing and duplex mode to provide AEAD cipher, AND IF the ...
DannyNiu's user avatar
  • 9,421
3 votes
1 answer
159 views

Error-correcting as part of an encryption scheme?

If we do not encrypt a message, we can use a checksum to check data integrity. For authenticated encryption, we no longer need the checksum because we use the authentication tag to verify data ...
Ma Joad's user avatar
  • 163
3 votes
1 answer
104 views

Example situation where an authentication tag can prevent an attack?

In Authenticated Encryption, we use an authentication tag to make sure the message is not tampered. The authentication tag can prevent any random bytes sent by the attacker being decrypted by the ...
Ma Joad's user avatar
  • 163
2 votes
1 answer
70 views

Can you make an OCB type AEAD using a stream cipher?

This is a hypothetical question. Is it possible to use a stream cipher instead of a block cipher for an OCB type single pass AEAD? The xor of the plaintext blocks for the authentication tag can't work ...
Nigel's user avatar
  • 21
3 votes
1 answer
205 views

Why in authenticated encryptions do we need separate keys for cipher and MAC?

As asked, I suppose this must have been answered before, even if not in the form asked here. The most notable AEAD schemes GCM-AES and ChaCha20-Poly1305 do this. Also, even outside AEAD, ad-hoc ...
DannyNiu's user avatar
  • 9,421
3 votes
1 answer
128 views

What kind of hashing is GF multiplication in GCM cipher mode and GMAC?

In GCM, GMAC, the additional associated data (AAD) (as well as outputs of subsequent blocks) is multiplied by a polynomial H in GF(2^128). This appears to be doing some secure hashing. Is that what's ...
zzazzles's user avatar
  • 117
3 votes
0 answers
54 views

CX vs padding fix for AEAD key commitment

The padding fix by Albertini et al. for AEAD key commitment (pp. 3292 and 3301-3302) involves prepending a block or two of zeros to the plaintext before encrypting. After decryption, these bytes are ...
samuel-lucas6's user avatar
7 votes
1 answer
181 views

Why did Yubico changed U2F Key Derivation method on YubiKey?

Previous: https://web.archive.org/web/20160102181336/developers.yubico.com/U2F/Protocol_details/Key_generation.html https://www.yubico.com/blog/yubicos-u2f-key-wrapping/ $$ PrivateKey = \operatorname{...
youfu's user avatar
  • 253
3 votes
1 answer
159 views

Does authenticating fake Carter Wegman protected OTP messages consume key material at the receiving node?

Assume a message protocol whereby one time pad messages are authenticated with a Carter Wegman type hash on the ciphertext, or some similar construct utilizing a unique authentication key per message. ...
Paul Uszak's user avatar
  • 15.5k
1 vote
0 answers
61 views

Authenticated Encryption with Length Expansion for Storage Devices

Recently, I've been working on disk encryption. I started with the AES-XTS mode which is the standard for this purpose and tried to understand the concept of disk encryption in general. I know that ...
NB_1907's user avatar
  • 640
5 votes
1 answer
367 views

For password-based authenticated encryption is it OK to derive the auth key from the crypt key with 1 iteration?

That is, in the case where the iterations value is a large number, since iterations are costly is there a difference in security of doing something like this, where two separate derivations are ...
wabo's user avatar
  • 153
4 votes
1 answer
114 views

Which ciphers have been defined that use the Keccak sponge?

There seem to have been defined multiple ciphers using the Keccak sponge as building block / primitive. These seem to have escaped public attention, possibly because they have not been standardized ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote
0 answers
37 views

CCM in the RUP setting reduced to CTR?

I have a question regarding the paper: Andreeva, E. et al, Securely Release Unverified Plaintext in Authenticated Encryption , 2014 (DOI: 10.1007/978-3-662-45611-8_6) AE schemes such as GCM [28] and ...
kaiya's user avatar
  • 143
4 votes
2 answers
3k views

OpenSSL AES-GCM says 'bad decrypt', other block modes work fine?

If I do a simple encrypt and decrypt test like so: ...
RocketNuts's user avatar
  • 1,387

1
2 3 4 5
12