Questions tagged [siv]

SIV (Synthetic Initialization Vector) is a two-pass AEAD block cipher mode of operation described in RFC 5297. It can be used either for key-wrap (nonce-less deterministic authenticated encryption) or, with a nonce, for conventional authenticated encryption with maximal tolerance of nonce reuse.

Filter by
Sorted by
Tagged with
0
votes
0answers
83 views

Can I Achieve Deterministic Encryption Using AES-GCM with Nonce = HMAC [ message ]

I would like to implement a deterministic encryption scheme within .NET. From the following post it is established using AES-SIV mode is appropriate. As AES-SIV mode is not implemented within the ...
4
votes
1answer
731 views

How to Implement Deterministic Encryption Safely in .NET

I am trying to implement a deterministic encryption scheme in .NET. This link suggests I use AES-SIV mode encryption. An alternative is to use AES-CTR [ k1, nonce, message] mode with HMAC[ k2, ...
2
votes
1answer
218 views

AES-PMAC-SIV AE algorithm

AES-SIV is a very robust and safe algorithm but performance isn't great. AES-PMAC-SIV, should provide a great parallelization, increasing performance and ensuring the same robustness. Indications of ...
3
votes
2answers
138 views

Are there any misuse-resistant asymmetric encryption schemes?

The notion of misuse-resistant authenticated encryption (MRAE) was defined in the symmetric setting by Rogaway and Shrimpton, along with the SIV mode that achieves it. The idea being that modern ...
4
votes
3answers
335 views

Why is SIV a thing if MAC-and-encrypt is not the most secure way to go?

The question that I am asking is exactly what I ask in the title.
0
votes
1answer
106 views

Is deterministic encryption appropriate for low entropy plaintext when CPA is not a concern?

We have a trusted application that observes sensitive identifiers, e.g. credit card numbers. We want to send data associated with these identifiers to an untrusted analytics service that will ...
10
votes
2answers
2k views

Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

I was just going over my (old) notes from Coursera's Cryptography I course, and I was puzzled by the description of SIV as providing deterministic authenticated encryption (DAE). The general SIV ...
2
votes
0answers
97 views

Combining AES-SIV and a password-derived key

I use the following scheme to encrypt and authenticate a 64-byte piece of data $P$: $$ C = \textrm{AES-SIV}(K, \textit{AAD}, P) $$ where $AAD$ is a string of 48 bytes, of which 21 bytes are a random ...
2
votes
1answer
110 views

Does SIV mode work for asymmetric encryption?

In ECIES and similar asymmetric schemes, is it possible to use a hash of the plaintext as the IV?
1
vote
1answer
183 views

SIV - Synthetic IV - S2V Construction? Benefits over a MAC or Hash?

Looking at the SIV construction in rfc-5297 - https://tools.ietf.org/html/rfc5297 With regards to the generation of the SIV, using S2V construction, I am struggling to find the benefits of the chosen ...
3
votes
1answer
456 views

Advantages of HS1-SIV over ChaCha20-Poly1305-SIV?

What advantages does HS1-SIV have over ChaCha20-Poly1305-SIV? I know that both use the ChaCha stream cipher, but I am trying to understand why HS1-Hash is a better MAC. Edit: To hide the Poly1305 ...
9
votes
1answer
605 views

Why is AES-SIV not used, but AESKW, AKW1?

I'm trying to investigate different key wrapping algorithms for my implementation. I've noticed that AES-SIV is very rarely implemented by most of open source libraries. Most of them implements key ...
1
vote
1answer
127 views

Is AES_CMAC specified to double ciphered zeroes during initialization?

Reading the SIV RFC https://tools.ietf.org/html/rfc5297#page-9, I found that the S2V function starts by calculating the MAC of a "zero" block, doubles it and then XORs further data to the result. Now ...
4
votes
1answer
186 views

What's the consequence of having a short IV? Is one mode better in that case?

I've read lots about null-length IVs being bad for most modes. In a scenario where passing a 128-bit IV along with each message isn't feasible, how would generating the IV from a smaller passed-along ...
7
votes
1answer
830 views

Security of this deterministic encryption scheme

I recently came across a library that promises to do deterministic encryption with the following scheme: AES with 256 bit key in CBC mode with PKCS7 padding and Synthetic Initialization vector ...
3
votes
1answer
376 views

Which gives better deterministic encryption SIV or Plain ECB mode?

Lets say , if we encrypt a plain text message $msg$ with key $key$ in below two ways. Which is the below would give better deterministic encryption and why ? AES-ECB($key$ , $msg$) SIV($key$, NIL , $...
7
votes
1answer
3k views

AES-SIV security

I am invesigating the AES-SIV (rfc 5297) based block cipher. The construction of the S2V is lying on the AES-CMAC and dbl and XOR operation. Given a AAD the size of L and in the 128bit block ...