59 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

Encrypt your document, and embed a web address (and login details) in the packaging from which a reader can get the decryption key. The website must be trusted. The website logs will tell you when ...
Nullius in Verba's user avatar
22 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

With classical information, there is no way as you correctly surmise: someone could always duplicate the data. However with quantum information there is a no-cloning theorem. With quantum information ...
Daniel S's user avatar
  • 23.9k
20 votes
Accepted

Why does TLS 1.3 support two CCM variants?

The rationale goes this way: On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
Thomas Pornin's user avatar
17 votes

Is Encrypt(m||k2, k1) secure authenticated encryption?

Would it not be easier simply to send $E(m||s,k)$ where s is a salt shared across the system? Yes, that would be simpler; however, that would not (in general) be secure. The assumption you are ...
poncho's user avatar
  • 147k
16 votes

How much security is gained from hiding the nonce?

Nonces (and initialization vectors) are generally public. Assuming a sensible implementation (using a hash of the message as the nonce is not sensible), then no meaningful security is gained by making ...
hunter's user avatar
  • 3,965
15 votes
Accepted

Do I really need to use the same private/public key pair in RSA?

I've been suggested to digitally sign it, thus, I have my private key, and I ship my application with a public key, and the application then uses the public key to check the QR code As long as you ...
poncho's user avatar
  • 147k
15 votes
Accepted

Is constant-time compare really required for AEAD ciphers?

Let the vulnerable comparison compare byte-by-byte and break out of the loop after the first mismatch. If we neglect noise, this leaks how many bytes (prefix) of the MAC are correct via timing. Then ...
CodesInChaos's user avatar
  • 24.9k
14 votes
Accepted

How much security is gained from hiding the nonce?

Hiding the nonce provides no tangible benefit. In the case of ChaCha where the input block is the concatenation of a constant, the key, a nonce, and a counter, using a random and secret nonce could be ...
forest's user avatar
  • 15.3k
13 votes
Accepted

Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

The definition of DAE security, as given in Rogaway and Shrimpton's original paper (which both defines the security notion and proves that SIV mode satisfies it), does effectively require that a DAE ...
Ilmari Karonen's user avatar
13 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

Not with a file, as you say in your question You can always take a bitwise copy of a file. Always. Even if some specific OS makes it inconvenient, you can change to an OS which does let you. This ...
Graham's user avatar
  • 255
11 votes
Accepted

What is Deterministic Authenticated Encryption?

Deterministic authenticated encryption indeed provides authenticity and it doesn't require a nonce or IV. In that sense it doesn't provide CPA security as identical messages would result in identical ...
Maarten Bodewes's user avatar
  • 92.6k
11 votes
Accepted

Use Initialization Vector as Additional Authenticated Data

You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments. The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs ...
Maarten Bodewes's user avatar
  • 92.6k
11 votes

What do NM-CPA and NM-CCA mean?

A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
Squeamish Ossifrage's user avatar
11 votes
Accepted

Is 'authenticated' in AEAD actually authentication? Or is it message integrity?

The notion of authentication stated in the question seems to be more compatible with what is sometimes talked to as entity authentication. In short, "you know who you are talking to." ...
Marc Ilunga's user avatar
  • 3,188
9 votes
Accepted

Is including the key as AAD actually dangerous?

One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the ...
poncho's user avatar
  • 147k
9 votes
Accepted

What is a safe maximum message size limit when encrypting files to disk with AES-GCM before the need to re-generate the key or NONCE

Security analysis of AES-GCM for maximum key use Note: I am not a cryptographer. As such there are probably mistakes in my analysis. Please help me fix my mistakes and built on top of this answer so ...
Stan Ivanov's user avatar
8 votes

Can one make a secure AEAD from any secure cipher and any secure MAC?

The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, ...
Yehuda Lindell's user avatar
8 votes

Authentication impossible without pre-shared public key

You dont need the public key/certificate to be present in the browser. You just need to devise a method to ensure the public key/certificate which is presented by the peer is valid. In a Web Browser ...
eckes's user avatar
  • 646
8 votes

Authentication impossible without pre-shared public key

Correct me if I am wrong, digital certificates require the user to have the public key for the certificate in their web browser, right? You are wrong, but in a way you're indirectly right. You're ...
Luis Casillas's user avatar
8 votes
Accepted

Using checksum instead of hash for authenticating ciphers

If we were to use CTR, what would you think of using a checksum on plain text then encrypt whole. That's a really bad idea (from a security perspective). Here are the reasons for this: Depending ...
SEJPM's user avatar
  • 46k
8 votes
Accepted

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

When can I consider a ciphersuite an Authenticated Encryption? To cite from Wikipedia: Authenticated Encryption: Authenticated encryption ... is a form of encryption which simultaneously provides ...
Steffen Ullrich's user avatar
8 votes

What is the security concept in printer cartridge?

A company can make more money if the printers it sells only work with the cartridges they sell, which does not work if there is competition. It's cheaper to force a vendor lock-in than it is to ...
forest's user avatar
  • 15.3k
8 votes
Accepted

Should we use the new CAESAR competition ciphers?

The CAESAR competition took way too long, didn't go as well as expected, and other interesting constructions that would have been worth considering were designed after it started. Some of these (AES-...
Frank Denis's user avatar
  • 2,974
8 votes
Accepted

Do all AEAD implementations use symmetric key ciphers in practice?

When people say "AEAD", they have symmetric schemes in mind. But conceptually, authenticated encryption is not restricted to symmetric keys. It is just the case that public key variants have ...
real-or-random's user avatar
8 votes
Accepted

What is Associated Data in AEAD?

First of all, let us look at what AAD is; it is a string that must be presented both at encryption and decryption; if the decryptor presents the wrong string, the decryption fails. Why is this useful? ...
poncho's user avatar
  • 147k
8 votes

Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?

From the security perspective, they should require 128-security. Why? NIST has a requirement for a minimum security strength of 112 bits for all things cryptographic, at least for the present. You ...
Swashbuckler's user avatar
  • 2,053
8 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

Slightly tongue-in-cheek answer, but why not put the document on a usb key, then put the usb key in a box and wrap it with the tamper evident physical seals you pictured. That way the document is ...
Rob's user avatar
  • 181
8 votes

Is 'authenticated' in AEAD actually authentication? Or is it message integrity?

Personally, I don't find the term "integrity" to be very useful when discussing cryptography. Cryptography (almost always) enforces/restricts behavior based on who holds a secret key. ...
Mikero's user avatar
  • 13.2k
7 votes
Accepted

What are the constraints on using GCM with a tag size of 96 and 128 bits?

I don't understand where the formula $q^2 \ell^2 2^{-142} + q^2 \ell^3 2^{-147}$ came from. The power of $\ell$ seems too high; the fractions $2^{-142}$ and $2^{-147}$ seem awfully small; the ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

How to provide integrity even though using Authenticated Encryption?

There are several concepts of integrity. Authenticity can be thought of as integrity of the association between data and its creator/modifier/sender. There is also integrity of the internal structure ...
Mikko_K_123's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible