Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The Counter with CBC Mac mode, an authenticated encryption mode of operation for a block cipher based on the CTR mode and the CBC-MAC algorithm. .

3
votes
0answers
51 views

Why does TLS 1.3 support two CCM variants?

One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
1
vote
1answer
43 views

CCM authenticity bound

Can someone help me understanding the CCM authenticity bound by Phillip Rogaway? i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$. $\tau$ is tag length, where as $b$ is block length. ...
0
votes
1answer
40 views

What is the probability of un-authenticated messages to go through CCM because of channel errors?

Consider having the worst possible communications channel, where bits are flipped with probability 0.5. Is there any probability that channel errors make the change in a frame go un-detected through ...
3
votes
1answer
175 views

AES CCM Mode (CTR with CBC-MAC)

For CCM mode of AES can anyone explain what the difference is between $B_i$'s and $m$? Is the nonce value for $B_i$'s and $A_i$'s the same? What is $l(a)$ and $L$? What is the minimum value of size ...
10
votes
1answer
162 views

AES cache-timing attacks and nonce-based operation modes

As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related. To mount ...
0
votes
1answer
68 views

CBC-MAC 8 octet ICV compatable with 16 octet block size?

I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8 I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
0
votes
1answer
156 views

nonce generation on AES CCM* [closed]

I want to encrypt with AES CCM* and i dont understand the nonce generation. the toolkit i'm using has a function to generate the nonce for CCM but it needs the following params: param src_addr ...
1
vote
1answer
163 views

Near in place encryption with BouncyCastle CCM, How large must IV and MAC be?

I need to encrypt 20 bytes of data and the encrypted nonce + data + mac cannot exceed 30 bytes in size. I have an implementation but i'm not sure if i'm cutting too many corners and compromising ...
2
votes
1answer
114 views

How does CCM handle variable-length messages?

Since CBC-MAC is insecure for variable-length messages if nothing is done to handle them, I'm wondering how it can be used with variable-length messages. Rogaway's critique of CCM indicates that it ...
0
votes
1answer
182 views

Can Java Decrypt a 4-byte MIC? [closed]

I am using AES/CCM/NoPadding in Java, and it produces a 8-byte MAC when encrypting data. However, the data I receive, produced by a Bluetooth module, produces a 4-byte MIC. Both the Bluetooth module ...
1
vote
1answer
222 views

Java - What are the additional 8 bytes of output generated by AES/CCM/NoPadding? [closed]

What are the additional 8 bytes of output used for in Java's (Bouncycastle) AES/CCM/NoPadding? I do not believe this is padding as I am requesting "NoPadding," and ...
-2
votes
2answers
378 views

Java - AES with 20 byte packet

I have 20 bytes of data that I need to encrypt and send to a bluetooth node. The main issue being that the receiving node only accepts 20 byte packets. Further, I cannot send multiple packets, one ...
0
votes
1answer
76 views

For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?

Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
6
votes
1answer
312 views

Are tags longer than 128 bit possible for AES-256-CCM and AES-256-GCM?

I have an existing application that uses AES-256-CBC for encrypting data blocks, and HMAC-SHA-256 on the plaintext for eliminating duplicate data blocks. For performance reasons, I would like to move ...
0
votes
0answers
94 views

Protection of Nonce in CCM Block Cipher Mode of Operation?

CCM mode of operation combines CBC (for integrity and authentication) and CTR mode (for data confidentiality) The inputs to the CCM are A Valid Nonce N which is used in CTR mode Valid Payload P ...
1
vote
1answer
179 views

Use of Same Key for CTR and CBC-MAC in CCM Mode of Operation?

The NIST Specification Document for CCM Mode of operation 800-38C states on Page 13 The same key, K, is used for both the CTR and CBC-MAC mechanisms within CCM. is it secure to use same key? or ...
2
votes
1answer
193 views

AES mode which verifies data integrity AFTER decryption

I wonder if there is an AES mode which would verify data integrity after decryption operation. Due to the reasons which does not matter here, there is a possibility that AES implementation I use may ...
2
votes
1answer
1k views

An example of CCM - AES Mode

I need to test if my AES-CCM implementation works correctly, but I don't find any example to test that. Could you please help me and provide test vectors / other value-inserted examples? In case ...
3
votes
0answers
84 views

Authenticated Encryption CCM encrypt MAC

Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC? In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks". But I can not ...
2
votes
1answer
880 views

What is CCM — Counter Mode Cipher Block Chaining Message Authentication Code Protocol

CCM puts together two different modes of operation (at least in the name). Does it mean data is encrypted using counter mode and then encrypted using CBC; kind of a double encryption?
2
votes
1answer
279 views

Birthday attack on AES-CCM with 32-bit Authentication Tag

I would like to use AES-CCM with a very small Authentication Tag length of 32 bits. Thus, I have a question about the vulnerability to birthday attacks. How vulnerable is CCM to birthday attacks? ...
6
votes
1answer
768 views

What is the purpose of the “Explicit Nonce” in TLS for AES-GCM and AES-CCM?

TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce. ...
2
votes
1answer
223 views

Authenticated Encryption with smallest Overhead (Input and Output)

I'm searching for the authenticated encryption algorithm that produces/requires the least overhead in total. This includes the authentication tag that it produces and the additional input that has to ...
-1
votes
2answers
217 views

What is the hash of this cipher: TLS_RSA_WITH_AES_128_CCM

In TLS 1.3 supported ciphersuite, I find the following ciphersuite: TLS_RSA_WITH_AES_128_CCM Can any one tell me what is the hash function used in this ciphersuite? how could you know that (...
2
votes
1answer
40 views

Attacks from releasing decrypted CCM payload before verifying tag

CCM specifies (Section 1.7) that no plaintext data should be released before the MAC is verified. Why is this recommendation given and what attacks are possible against CCM if data is treated like a ...
1
vote
0answers
366 views

Difference between AES-CCM and AES-CCM*

I'm trying to understand the different between AES-CCM and AES-CCM* (as defined in IEEE Std 802.15.4™‐2011, Annex B). I see that there are more restrictions on L and M and also M=0 is allowed: L = 2 ...
3
votes
1answer
217 views

Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?

I would like an answer that could be sustained by a mathematical proof. Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce. I know that when the nonce space ...
7
votes
2answers
1k views

Picking a nonce in the context of CCM (CTR with CBC-MAC) mode

After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says: A nonce N of 15-L octets. Within the ...
1
vote
1answer
823 views

MAC tag size in AES CCM, when using CTR + CBC-MAC (not CBC MAC only)

Assuming that AES CCM is used with respect of the NONCE unicity // the key life cycle, I wonder about the need of using the highest size for CBC-MAC authentication tag if CTR mode encrypts both ...
3
votes
1answer
527 views

Security of integrity protection with HMAC vs AEAD

I'd like to know how the security of the integrity protection compares between: HMAC-SHA-256 with an 32 byte tag or a truncated 16 byte tag AES-GCM with a 16 byte tag AES-CCM with a 16 byte tag or ...
1
vote
0answers
277 views

How does AES-CCM work in BitLocker?

I'm studying this white-paper: http://jessekornblum.com/publications/di09.pdf The author says that using AES-CCM with the external key (highlighted in green at page 9, figure 4) and with the nonce at ...
2
votes
1answer
889 views

Difference between plain AES CTR and “CCM-style” CTR

I am trying to adapt the following function from SJCL, which does "AES-CCM" style CTR encryption, to do "pure CTR" encryption. I am playing around with SIV and would rather use this well-reviewed ...
2
votes
0answers
106 views

Separate TLS Client Write and Server Write Keys in AES-CCM Mode

I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
7
votes
1answer
2k views

Security of authenticated encryption modes GCM & CCM

I have two questions for Clarification for AE mode choice criteria GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
2
votes
1answer
674 views

Attacking AES/CCM with random IV

A cryptosystem is using AES-128 in CCM mode with random IV. Suppose an attacker capable of: asking the cryptosystem to encrypt a single plaintext as many times as he wants; and asking the ...
17
votes
1answer
15k views

How to choose between AES-CCM and AES-GCM for storage volume encryption

We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
7
votes
0answers
219 views

Unique GCM/CCM initial counters without recipient side message counters

I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...