Questions tagged [eax]
An authenticated encryption mode of operation for a block cipher, based on the CTR mode and the OMAC/CMAC MAC algorithm.
18 questions
12
votes
0
answers
236
views
Do CCM and EAX provide key commitment?
In an interesting paper called "Partitioning Oracle Attacks" by Julia Len, Paul Grubbs & Thomas Ristenpart an attack is presented on 1.5 pass AEAD schemes that utilize GMAC (GCM, AES-GCM,...
- 94.5k
1
vote
1
answer
446
views
EAX vs CTR vs XTS + cascade ciphers in disk encryption hell
Often when I stumble across something interesting, I lose myself in the most overkill ways of implementing it. Today it was full disk encryption: I'm about to move to QubesOS, and I want to secure my ...
- 113
1
vote
1
answer
652
views
How used nonce in CTR Mode of AES-EAX Encryption?
I want to encrypt a message with AES-EAX manually. Then, i confused how ctr mode in AES-EAX processing the nonce which came from omac process. How the counter be concatenate with the nonce in their ...
- 31
4
votes
1
answer
325
views
Why is EAX not a generic composition?
In the document http://web.cs.ucdavis.edu/~rogaway/papers/eax.pdf (p. 7) Rogaway et. al. state that EAX is not a generic composition of an encryption and an authentication method.
The EAX algorithm ...
- 175
0
votes
1
answer
119
views
OMAC 0 in EAX cipher
I am reading Rogaway's original paper on EAC, page 7, where the MAC function is an OMAC with a 0.
Iwata´s web page only refers to versions 1 and 2 of the OMAC cipher. So which algorithm is used for ...
- 13
4
votes
1
answer
1k
views
Authenticated Encryption with smallest Overhead (Input and Output)
I'm searching for the authenticated encryption algorithm that produces/requires the least overhead in total. This includes the authentication tag that it produces and the additional input that has to ...
- 435
8
votes
2
answers
2k
views
Does EAX require padding to be secure?
I have been seeing code using "AES/EAX/NoPadding" but I'm also aware that padding schemes are supported for AES-EAX. I would like to know if choosing NoPadding as a padding scheme has security ...
- 83
4
votes
1
answer
876
views
Using scrypt to generate key + IV/nonce together
Is there any security issue in using scrypt for Key + IV/nonce generation? In other words, can I safely use only a salt for scrypt and derive the nonce along with the key?
For example:
I have data I ...
- 173
5
votes
1
answer
1k
views
EAX cipher mode with nonce equal header
I am using EAX AEAD with an 8-byte message header which carries a 32-bit sequence number, a message length, and some other bits that I don't mind exposing. Assuming the sequence number never repeats ...
- 167
4
votes
1
answer
167
views
Authenticating Very Short (Sub-Block) Data
If I'm encrypting very short/small data - like an int or a long (32 or 64 bits), does it make any sense to authenticate the ciphertext, when using an "online" mode of operation (like EAX)?
...
- 647
2
votes
1
answer
2k
views
EAX: OMAC and CMAC
OMAC is specified as the underlying algorithm to provide authentication within the EAX authenticated encryption (with associated data). Would that be OMAC1 or OMAC2?
If it is OMAC1, does that mean it ...
- 94.5k
2
votes
1
answer
160
views
Is this EAX extension weakening the (provable) security of EAX?
I would like to insert a key deriving function into EAX mode, in order to hamper brute-force attacks for a key-size restricted cipher (56 bits). The modification inserts an identical multi-block ...
- 21
4
votes
2
answers
134
views
Is it possible to insert a key derivation function when using EAX?
I am currently investigating use of EAX mode for a dedicated application and following useful clarifications received from my previous post , to consider according to my applicable input security ...
- 653
4
votes
1
answer
410
views
Does EAX use the same keys for encryption and authentication?
I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
- 653
7
votes
2
answers
1k
views
Is using EAX mode with a 64-bit block cipher a bad idea?
EAX mode produces an authentication tag no longer than the length of the underlying cipher's blocksize. So in the case of using Blowfish (a 64-bit block cipher) in EAX mode, the resulting tag would ...
- 4,007
10
votes
1
answer
8k
views
How to use GCM mode and associated-data properly
I'm currently migrating a project to use the bouncy castle GCM mode. I understand that using an authenticated mode removes the need for a HMAC, however I want to be sure that I'm using this mode ...
- 4,007
2
votes
1
answer
378
views
How is the EAX-mode used in EAP-PSK (RFC 4764)?
According to the specification of RFC 4764, contents in EAP's third message and fourth message are required to be encrypted by AES-128 in EAX mode (also called protected channel).
In RFC 4764, the ...
- 21
4
votes
1
answer
575
views
What "Tag Length" should be used for the EAX MAC?
Since EAX is very flexible with regard to the length of the calculated MAC (what they call "tag" is the MAC value right?), and the EAX paper as well as other documentations carefully avoid suggesting ...
- 647