Questions tagged [ccm]
The Counter with CBC Mac mode, an authenticated encryption mode of operation for a block cipher based on the CTR mode and the CBC-MAC algorithm. .
49 questions
0
votes
1
answer
502
views
Encrypting the nonce in AES-CCM
I'm working on a network where nodes communicate using AES-CCM encryption, within a context of tight bandwidth limitations, making every bit count. The setup uses a nonce that combines a 16-bit node ...
1
vote
1
answer
1k
views
How does AES-GCM and AES-CCM provide authenticity?
My lecture notes state that of the AES operating modes ECB, CBC, CTR, CCM (CTR+CBC MAC) and GCM, only CCM and GCM provide authenticity.
In CCM, as I understand it, the authenticity lies in the MAC, i....
- 21
1
vote
0
answers
38
views
CCM in the RUP setting reduced to CTR?
I have a question regarding the paper:
Andreeva, E. et al, Securely Release Unverified Plaintext in Authenticated Encryption , 2014
(DOI: 10.1007/978-3-662-45611-8_6)
AE schemes such as GCM [28] and ...
- 141
2
votes
2
answers
2k
views
What is the difference between AES-CCM8 mode and AES-CCM mode?
I know AES-GCM and AES-CCM but what is the difference between AES-CCM8 mode and AES-CCM mode ? Is it the length of the cipher?
- 19
2
votes
0
answers
109
views
What motivated CCM's monstrous design?
The formatting function in Appendix A of NIST-SP-800-38C is a monster enabling CCM to support variable-length nonce from 7-13 bytes, variable-length encoding of the length of the payload. Also, the ...
- 9,795
-1
votes
1
answer
116
views
what are the things that aes cbc-mac , aes cmac guarantees?
does aes-cbc-mac guarantees integrity, authenticity and confidentiality?
does aes-cmac guarantees integrity, authenticity and confidentiality?
because I only know that aes-ccm guarantees all i.e. ...
0
votes
0
answers
208
views
Security of CCM using 8 byte MAC within TLS
In the Dutch "IT Security Guidelines for Transport Layer Security (TLS)" the ciphersuites using AES-128-CCM_8 (i.e. CCM with a 64 bit authentication tag) are considered "insufficient&...
- 94.5k
2
votes
1
answer
81
views
Deviation from CCM specification - security impact?
The following question is about a specific protocol that uses a modified version of the CCM mode. Since I'm not a cryptographer, the protocol specification provides no reasoning for this change to CCM ...
- 45
0
votes
1
answer
644
views
How does AEAD guarantee authenticated encryption and plain AES does not?
This is a follow up to my earlier question. This is more out of curiosity in how AEAD (like CCM or GCM) works compared to encryption in other modes (like CBC or ECB).
Suppose you have AES-256-CBC ...
- 123
1
vote
1
answer
778
views
AES-CCM replay attack and nonce
My wireless sensor nodes and gateway application use timestamps as nonces and guarantee that different messages use different nonces so that security is not compromised.
If the gateway does not ...
- 11
5
votes
1
answer
2k
views
AES - CCM, why not use CMAC inside instead of CBC-MAC?
I was reading up on AES-CMAC when I learned that this basically is an improved and more robust version of CBC-MAC, with the ability to safely have variable-length messages.
Difference between CBC-...
- 95
1
vote
1
answer
247
views
Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM
Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...
- 255
18
votes
1
answer
6k
views
Why does TLS 1.3 support two CCM variants?
One of the important improvements introduced in TLS 1.3 is the pruning of the many previously available cipher suites to only five secure options (for symmetric ciphers), that are each supposed to ...
- 283
1
vote
1
answer
98
views
CCM authenticity bound
Can someone help me understanding the CCM authenticity bound by Phillip Rogaway?
i-e Success probability < $q_{\text{dec}}/2^\tau + \sigma/2^b$.
$\tau$ is tag length, where as $b$ is block length. ...
- 37
0
votes
1
answer
64
views
What is the probability of un-authenticated messages to go through CCM because of channel errors?
Consider having the worst possible communications channel, where bits are flipped with probability 0.5.
Is there any probability that channel errors make the change in a frame go un-detected through ...
- 37
2
votes
1
answer
1k
views
AES CCM Mode (CTR with CBC-MAC)
For CCM mode of AES can anyone explain what the difference is between $B_i$'s and $m$? Is the nonce value for $B_i$'s and $A_i$'s the same?
What is $l(a)$ and $L$? What is the minimum value of size ...
- 21
10
votes
1
answer
526
views
AES cache-timing attacks and nonce-based operation modes
As I understand it, AES cache-timing attacks exploit the execution time variations due to cache hits/misses, especially the ones depending on the SBox look-up tables which are key-related.
To mount ...
- 2,903
0
votes
1
answer
349
views
CBC-MAC 8 octet ICV compatable with 16 octet block size?
I'm trying to use DTLS in Preshared key mode for CoAP which necessitates using CipherSuite TLS_PSK_WITH_AES_128_CCM_8
I'm trying to start with the CBC-MAC but I'm not sure how to get an 8 octet ICV ...
- 103
0
votes
1
answer
665
views
nonce generation on AES CCM* [closed]
I want to encrypt with AES CCM* and i dont understand the nonce generation.
the toolkit i'm using has a function to generate the nonce for CCM but it needs the following params:
param src_addr ...
- 45
2
votes
1
answer
706
views
Near in place encryption with BouncyCastle CCM, How large must IV and MAC be?
I need to encrypt 20 bytes of data and the encrypted nonce + data + mac cannot exceed 30 bytes in size. I have an implementation but i'm not sure if i'm cutting too many corners and compromising ...
- 123
2
votes
1
answer
520
views
How does CCM handle variable-length messages?
Since CBC-MAC is insecure for variable-length messages if nothing is done to handle them, I'm wondering how it can be used with variable-length messages.
Rogaway's critique of CCM indicates that it ...
- 3,705
0
votes
1
answer
458
views
Can Java Decrypt a 4-byte MIC? [closed]
I am using AES/CCM/NoPadding in Java, and it produces a 8-byte MAC when encrypting data. However, the data I receive, produced by a Bluetooth module, produces a 4-byte MIC.
Both the Bluetooth module ...
- 149
1
vote
1
answer
697
views
Java - What are the additional 8 bytes of output generated by AES/CCM/NoPadding? [closed]
What are the additional 8 bytes of output used for in Java's (Bouncycastle) AES/CCM/NoPadding? I do not believe this is padding as I am requesting "NoPadding," and ...
- 149
-2
votes
2
answers
1k
views
Java - AES with 20 byte packet
I have 20 bytes of data that I need to encrypt and send to a bluetooth node. The main issue being that the receiving node only accepts 20 byte packets. Further, I cannot send multiple packets, one ...
- 149
0
votes
1
answer
137
views
For TLS AES_CCM mode how does CBC_MAC work when the message length is not aligned to block size?
Even after goign through lot of specs I failed to understand how CBC-MAC works, specifically in case we have message not aligned to 16 bytes. Are there any padding bytes?
- 187
6
votes
2
answers
1k
views
Are tags longer than 128 bit possible for AES-256-CCM and AES-256-GCM?
I have an existing application that uses AES-256-CBC for encrypting data blocks, and HMAC-SHA-256 on the plaintext for eliminating duplicate data blocks.
For performance reasons, I would like to move ...
- 63
0
votes
0
answers
209
views
Protection of Nonce in CCM Block Cipher Mode of Operation?
CCM mode of operation combines CBC (for integrity and authentication) and CTR mode (for data confidentiality)
The inputs to the CCM are
A Valid Nonce N which is used in CTR mode
Valid Payload P
...
- 2,502
1
vote
1
answer
555
views
Use of Same Key for CTR and CBC-MAC in CCM Mode of Operation?
The NIST Specification Document for CCM Mode of operation 800-38C states on Page 13
The same key, K, is used for both the CTR and CBC-MAC mechanisms
within CCM.
is it secure to use same key? or ...
- 2,502
2
votes
1
answer
628
views
AES mode which verifies data integrity AFTER decryption
I wonder if there is an AES mode which would verify data integrity after decryption operation.
Due to the reasons which does not matter here, there is a possibility that AES implementation I use may ...
- 171
3
votes
1
answer
4k
views
An example of CCM - AES Mode
I need to test if my AES-CCM implementation works correctly, but I don't find any example to test that.
Could you please help me and provide test vectors / other value-inserted examples?
In case ...
- 183
2
votes
1
answer
210
views
Why does the authenticated cipher CCM encrypt the MAC too?
Suppose I have Encryption in CTR-Mode and a CBC-MAC. Why should I also encrypt the MAC?
In the documentation of NIST stands: "By encrypting T we avoid CBC-MAC collision attacks".
But I can not ...
2
votes
1
answer
3k
views
What is CCM -- Counter Mode Cipher Block Chaining Message Authentication Code Protocol
CCM puts together two different modes of operation (at least in the name). Does it mean data is encrypted using counter mode and then encrypted using CBC; kind of a double encryption?
- 1,100
3
votes
1
answer
909
views
Birthday attack on AES-CCM with 32-bit Authentication Tag
I would like to use AES-CCM with a very small Authentication Tag length of 32 bits. Thus, I have a question about the vulnerability to birthday attacks.
How vulnerable is CCM to birthday attacks?
...
- 435
6
votes
1
answer
1k
views
What is the purpose of the "Explicit Nonce" in TLS for AES-GCM and AES-CCM?
TLS uses an explicit (secret) 32-bit nonce in combination with the 64-bit sequence number to create the IV for AES-GCM and the nonce for AES-CCM. However, I wonder why TLS needs the explicit nonce.
In ...
- 435
4
votes
1
answer
1k
views
Authenticated Encryption with smallest Overhead (Input and Output)
I'm searching for the authenticated encryption algorithm that produces/requires the least overhead in total. This includes the authentication tag that it produces and the additional input that has to ...
- 435
0
votes
2
answers
732
views
What is the hash of this cipher: TLS_RSA_WITH_AES_128_CCM
In TLS 1.3 supported ciphersuite, I find the following ciphersuite:
TLS_RSA_WITH_AES_128_CCM
Can any one tell me what is the hash function used in this ciphersuite? how could you know that (...
- 211
2
votes
1
answer
53
views
Attacks from releasing decrypted CCM payload before verifying tag
CCM specifies (Section 1.7) that no plaintext data should be released before the MAC is verified.
Why is this recommendation given and what attacks are possible against CCM if data is treated like a ...
- 277
4
votes
1
answer
1k
views
Difference between AES-CCM and AES-CCM*
I'm trying to understand the different between AES-CCM and AES-CCM* (as defined in IEEE Std 802.15.4™‐2011, Annex B).
I see that there are more restrictions on L and M and also M=0 is allowed:
L = 2
...
- 171
3
votes
1
answer
549
views
Is there any benefit of changing the AES-CCM encryption key periodically even if the Nonce space is not exhausted yet?
I would like an answer that could be sustained by a mathematical proof.
Let's say I'm using AES-CCM to encrypt a lot of messages, and I always use a different nonce.
I know that when the nonce space ...
- 183
8
votes
2
answers
3k
views
Picking a nonce in the context of CCM (CTR with CBC-MAC) mode
After having read the RFC 3610: Counter with CBC-MAC (CCM) and the Wikipedia article on CTR mode, I'm not sure how a nonce should be picked. The RFC says:
A nonce N of 15-L octets. Within the scope ...
- 281
1
vote
1
answer
2k
views
MAC tag size in AES CCM, when using CTR + CBC-MAC (not CBC MAC only)
Assuming that AES CCM is used with respect of the NONCE unicity // the key life cycle, I wonder about the need of using the highest size for CBC-MAC authentication tag if CTR mode encrypts both ...
- 105
4
votes
1
answer
1k
views
Security of integrity protection with HMAC vs AEAD
I'd like to know how the security of the integrity protection compares between:
HMAC-SHA-256 with an 32 byte tag or a truncated 16 byte tag
AES-GCM with a 16 byte tag
AES-CCM with a 16 byte tag or ...
- 41
1
vote
0
answers
466
views
How does AES-CCM work in BitLocker?
I'm studying this white-paper: http://jessekornblum.com/publications/di09.pdf
The author says that using AES-CCM with the external key (highlighted in green at page 9, figure 4) and with the nonce at ...
- 119
3
votes
1
answer
2k
views
Difference between plain AES CTR and "CCM-style" CTR
I am trying to adapt the following function from SJCL, which does "AES-CCM" style CTR encryption, to do "pure CTR" encryption. I am playing around with SIV and would rather use this well-reviewed ...
- 523
2
votes
0
answers
147
views
Separate TLS Client Write and Server Write Keys in AES-CCM Mode
I am designing a system that uses TLS-like handshaking on a resource-constrained embedded system. I have settled on AES-CCM mode for symmetric session encryption and authentication, allowing ...
- 121
6
votes
1
answer
3k
views
Security of authenticated encryption modes GCM & CCM
I have two questions for Clarification for AE mode choice criteria
GCM : it appears to be actually the most popular and widely used AE mode of operation. however it is also well-known to be highly ...
- 653
3
votes
1
answer
1k
views
Attacking AES/CCM with random IV
A cryptosystem is using AES-128 in CCM mode with random IV.
Suppose an attacker capable of:
asking the cryptosystem to encrypt a single plaintext as many times as he wants; and
asking the ...
- 323
47
votes
2
answers
57k
views
How to choose between AES-CCM and AES-GCM for storage volume encryption
We are using the encryption built into Solaris 11 ZFS, which offers the choice between CCM (CBC counter mode) and GCM (Galois counter mode). What are the pros and cons of choosing each of these cipher ...
- 662
10
votes
1
answer
396
views
Unique GCM/CCM initial counters without recipient side message counters
I am implementing the encryption layer for a communication protocol. The bulk encryption method used is either AES-CCM or AES-GCM. Due to implementation details, encryption of packets is usually, but ...
- 10.5k