# Tag Info

### Is it possible to create a "digital seal" to tell if a document has been opened?

Encrypt your document, and embed a web address (and login details) in the packaging from which a reader can get the decryption key. The website must be trusted. The website logs will tell you when ...

### AES256-GCM - can someone explain how to use it securely (ruby)

Before answering your questions: GCM is an authenticated encryption mode of operation, it is composed of two separate functions: one for encryption (AES-CTR) and one for authentication (GMAC). It ...
• 6,329

### Should we MAC-then-encrypt or encrypt-then-MAC?

Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. ...
• 26.9k

AES-GCM has the following problems: In the case of nonce reuse both integrity and confidentiality properties are violated. If the same nonce is used twice, an adversary can create forged ciphertexts ...
• 5,547
Accepted

### Encrypt-then-MAC: Do I need to authenticate the IV?

In short: You must authenticate the IV. Which particular attacks apply if you don't depends on the block cipher mode; I will give two common examples. In CTR mode, an attacker who fiddles with the IV ...
• 11.1k

### Is it possible to create a "digital seal" to tell if a document has been opened?

With classical information, there is no way as you correctly surmise: someone could always duplicate the data. However with quantum information there is a no-cloning theorem. With quantum information ...
• 10.4k
Accepted

### Why does TLS 1.3 support two CCM variants?

The rationale goes this way: On a "big" system like a PC or a smartphone, ChaCha20+Poly1305 or AES/GCM are very efficient; the latter is fast because the hardware provides dedicated opcodes that ...
• 84.6k
Accepted

### Where is the authentication tag stored in file encrypted using AES-GCM?

The authentication tag is defined as an output parameter in GCM (see section 7, step 7 of NIST SP 800-38D). In all the API's I've encountered it's appended to the ciphertext. Where it is actually ...
• 85.1k

### Is Encrypt(m||k2, k1) secure authenticated encryption?

Would it not be easier simply to send $E(m||s,k)$ where s is a salt shared across the system? Yes, that would be simpler; however, that would not (in general) be secure. The assumption you are ...
• 132k
Accepted

### Plain text size limits for AES-GCM mode just 64GB?

The source of the limitation lies in the fact that GCM has a fixed block counter using a 32-bit integer. Since the block size is $2^7$ bits, the total amount that can be encrypted with the CTR ...
• 12.7k
Accepted

### Do I really need to use the same private/public key pair in RSA?

I've been suggested to digitally sign it, thus, I have my private key, and I ship my application with a public key, and the application then uses the public key to check the QR code As long as you ...
• 132k

### Is it possible to create a "digital seal" to tell if a document has been opened?

Not with a file, as you say in your question You can always take a bitwise copy of a file. Always. Even if some specific OS makes it inconvenient, you can change to an OS which does let you. This ...
• 255
Accepted

### Why is synthetic IV (SIV) mode considered deterministic authenticated encryption (DAE)?

The definition of DAE security, as given in Rogaway and Shrimpton's original paper (which both defines the security notion and proves that SIV mode satisfies it), does effectively require that a DAE ...
• 44.4k
Accepted

### What is Deterministic Authenticated Encryption?

Deterministic authenticated encryption indeed provides authenticity and it doesn't require a nonce or IV. In that sense it doesn't provide CPA security as identical messages would result in identical ...
• 85.1k
Accepted

### Use Initialization Vector as Additional Authenticated Data

You don't need to put the IV in the AAD (Additional Authenticated Data) as already indicated in the comments. The GCM proposal as adopted by NIST (PDF) clearly specifies this in paragraph 2.1 Inputs ...
• 85.1k
Accepted

### Why is authenticated CFB mode insecure?

One obvious thing that it is vulnerable to a known plaintext attack that truncates the known message. This attack is quite simple; suppose the attacker knows a message $(P_1, P_2, ..., P_n)$ and the ...
• 132k

### Should we MAC-then-encrypt or encrypt-then-MAC?

The really important thing is, not encrypt-and-mac. The other two, you can debate, but both are at least theoretically sound -- one might just practically be better than the other. Encrypt-and-MAC ...
• 231
Accepted

### Order of MACing and Encrypting in TLS

It depends on which cipher suites and extensions the client and the server implement, enable and negotiate. The default operation in TLS 1.2 and earlier, is MAC then Encrypt. This corresponds to ...
• 10.2k

I suppose one of the problems (they mention several after a short reading) with a mode like GCM is nonce misuse (e.g. reuse). When the key is the same and the nonce is reused, by misunderstanding the ...
• 768

### Can one make a secure AEAD from any secure cipher and any secure MAC?

The encrypt-then-MAC paradigm works as long as the encryption is CPA secure and the MAC is secure under the standard definition. However, such a MAC must be secure for multiple messages. Therefore, ...
• 26.9k

### Authentication impossible without pre-shared public key

You dont need the public key/certificate to be present in the browser. You just need to devise a method to ensure the public key/certificate which is presented by the peer is valid. In a Web Browser ...
• 636
Accepted

### Is including the key as AAD actually dangerous?

One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the ...
• 132k
Accepted

### Using checksum instead of hash for authenticating ciphers

If we were to use CTR, what would you think of using a checksum on plain text then encrypt whole. That's a really bad idea (from a security perspective). Here are the reasons for this: Depending ...
• 44.6k
Accepted

### Are TLS 1.2 AES-CBC and AES-GCM Authenticated Encryption ciphersuites?

When can I consider a ciphersuite an Authenticated Encryption? To cite from Wikipedia: Authenticated Encryption: Authenticated encryption ... is a form of encryption which simultaneously provides ...
• 1,298

### What do NM-CPA and NM-CCA mean?

A cipher $E_k(m)$ is malleable if there is a nontrivial binary relation $\sim$ on messages such that given $c = E_k(m)$, it is easy to find $c' = E_k(m')$ with $m \sim m'$. For example, AES-CTR is ...
• 45.8k

### What is the security concept in printer cartridge?

A company can make more money if the printers it sells only work with the cartridges they sell, which does not work if there is competition. It's cheaper to force a vendor lock-in than it is to ...
• 13.3k
Accepted

### Do all AEAD implementations use symmetric key ciphers in practice?

When people say "AEAD", they have symmetric schemes in mind. But conceptually, authenticated encryption is not restricted to symmetric keys. It is just the case that public key variants have ...

### Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?

From the security perspective, they should require 128-security. Why? NIST has a requirement for a minimum security strength of 112 bits for all things cryptographic, at least for the present. You ...
• 1,900