59 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

Encrypt your document, and embed a web address (and login details) in the packaging from which a reader can get the decryption key. The website must be trusted. The website logs will tell you when ...
user avatar
52 votes

AES256-GCM - can someone explain how to use it securely (ruby)

Before answering your questions: GCM is an authenticated encryption mode of operation, it is composed of two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It ...
user avatar
  • 6,329
46 votes

Should we MAC-then-encrypt or encrypt-then-MAC?

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. ...
user avatar
40 votes

AES-GCM Disadvantage

AES-GCM has the following problems: In the case of nonce reuse both integrity and confidentiality properties are violated. If the same nonce is used twice, an adversary can create forged ciphertexts ...
user avatar
24 votes
Accepted

Encrypt-then-MAC: Do I need to authenticate the IV?

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples. In CTR mode, an attacker who fiddles with the IV ...
user avatar
  • 11.1k
22 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

With classical information, there is no way as you correctly surmise: someone could always duplicate the data. However with quantum information there is a no-cloning theorem. With quantum information ...
user avatar
  • 10.4k
18 votes
Accepted

Why does TLS 1.3 support two CCM variants?

The rationale goes this way: On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
user avatar
17 votes
Accepted

Where is the authentication tag stored in file encrypted using AES-GCM?

The authentication tag is defined as an output parameter in GCM (see section 7, step 7 of NIST SP 800-38D). In all the API's I've encountered it's appended to the ciphertext. Where it is actually ...
user avatar
  • 85.1k
17 votes

Is Encrypt(m||k2, k1) secure authenticated encryption?

Would it not be easier simply to send $E(m||s,k)$ where s is a salt shared across the system? Yes, that would be simpler; however, that would not (in general) be secure. The assumption you are ...
user avatar
  • 132k
16 votes
Accepted

Plain text size limits for AES-GCM mode just 64GB?

The source of the limitation lies in the fact that GCM has a fixed block counter using a 32-bit integer. Since the block size is $2^7$ bits, the total amount that can be encrypted with the CTR ...
user avatar
  • 12.7k
13 votes
Accepted

Do I really need to use the same private/public key pair in RSA?

I've been suggested to digitally sign it, thus, I have my private key, and I ship my application with a public key, and the application then uses the public key to check the QR code As long as you ...
user avatar
  • 132k
13 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

Not with a file, as you say in your question You can always take a bitwise copy of a file. Always. Even if some specific OS makes it inconvenient, you can change to an OS which does let you. This ...
user avatar
  • 255
12 votes
Accepted

Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

The definition of DAE security, as given in Rogaway and Shrimpton's original paper (which both defines the security notion and proves that SIV mode satisfies it), does effectively require that a DAE ...
user avatar
11 votes
Accepted

What is Deterministic Authenticated Encryption?

Deterministic authenticated encryption indeed provides authenticity and it doesn't require a nonce or IV. In that sense it doesn't provide CPA security as identical messages would result in identical ...
user avatar
  • 85.1k
11 votes
Accepted

Use Initialization Vector as Additional Authenticated Data

You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments. The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs ...
user avatar
  • 85.1k
10 votes
Accepted

Why is authenticated CFB mode insecure?

One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message. This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the ...
user avatar
  • 132k
9 votes

Should we MAC-then-encrypt or encrypt-then-MAC?

The really important thing is, not encrypt-and-mac. The other two, you can debate, but both are at least theoretically sound -- one might just practically be better than the other. Encrypt-and-MAC ...
user avatar
  • 231
9 votes
Accepted

Order of MACing and Encrypting in TLS

It depends on which cipher suites and extensions the client and the server implement, enable and negotiate. The default operation in TLS 1.2 and earlier, is MAC then Encrypt. This corresponds to ...
user avatar
8 votes

AES-GCM Disadvantage

I suppose one of the problems (they mention several after a short reading) with a mode like GCM is nonce misuse (e.g. reuse). When the key is the same and the nonce is reused, by misunderstanding the ...
user avatar
  • 768
8 votes

Can one make a secure AEAD from any secure cipher and any secure MAC?

The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, ...
user avatar
8 votes

Authentication impossible without pre-shared public key

You dont need the public key/certificate to be present in the browser. You just need to devise a method to ensure the public key/certificate which is presented by the peer is valid. In a Web Browser ...
user avatar
  • 636
8 votes
Accepted

Is including the key as AAD actually dangerous?

One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the ...
user avatar
  • 132k
8 votes
Accepted

Using checksum instead of hash for authenticating ciphers

If we were to use CTR, what would you think of using a checksum on plain text then encrypt whole. That's a really bad idea (from a security perspective). Here are the reasons for this: Depending ...
user avatar
  • 44.6k
8 votes
Accepted

Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

When can I consider a ciphersuite an Authenticated Encryption? To cite from Wikipedia: Authenticated Encryption: Authenticated encryption ... is a form of encryption which simultaneously provides ...
user avatar
8 votes

What do NM-CPA and NM-CCA mean?

A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
user avatar
8 votes

What is the security concept in printer cartridge?

A company can make more money if the printers it sells only work with the cartridges they sell, which does not work if there is competition. It's cheaper to force a vendor lock-in than it is to ...
user avatar
  • 13.3k
8 votes
Accepted

Do all AEAD implementations use symmetric key ciphers in practice?

When people say "AEAD", they have symmetric schemes in mind. But conceptually, authenticated encryption is not restricted to symmetric keys. It is just the case that public key variants have ...
user avatar
8 votes

Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?

From the security perspective, they should require 128-security. Why? NIST has a requirement for a minimum security strength of 112 bits for all things cryptographic, at least for the present. You ...
user avatar
  • 1,900
8 votes

Is it possible to create a "digital seal" to tell if a document has been opened?

Slightly tongue-in-cheek answer, but why not put the document on a usb key, then put the usb key in a box and wrap it with the tamper evident physical seals you pictured. That way the document is ...
user avatar
  • 181
7 votes

Authenticated encryption without padding

If the data to protect has no built-in redundancy at all (for example, has each of its bit determined by fair coin toss), there is no way to protect integrity without expansion (Proof sketch: there ...
user avatar
  • 124k

Only top scored, non community-wiki answers of a minimum length are eligible