New answers tagged

0

Imagine I have some serialization (example JSON) that can have 1-100 fields I’ll assemble into data to be get a MAC (my AD in AEAD). The receiving end has no idea which ones are coming, and the ordering of decode is not guaranteed. If the receiving end really has no idea which fields are coming as you say, then the only way it can possibly determine the ...


0

You need to make sure that individual properties are length-prefixed (to avoid the same output for a || bb and ab || b), and that the ordering of the properties is well defined, for example by ordering the keys. There is a standard for this: TupleHash, one of the SHA-3 derived constructions. It was designed for cSHAKE, but the input encoding can be used ...


0

Suppose Alice and Bob are having a conversation, and they share a secret key $k$. Alice can put an authentication tag on every message she sends, and Bob can verify the authentication tag, using the key $k$. This is good enough to convince Bob that the message came from Alice (or someone Alice authorized), because only Alice and Bob share the secret key $k$...


0

The key-word "authenticated" mean that Dec is has not just a decrypting functionality. It should also check the validity of the computation made. that's why it takes as input the function $f$. Read more in details the paragraph "4.4 Authenticity".


2

The authentication tag is the output parameter, like in AES-GCM, which is generated by the symmetric key to authenticate the message. $$(c,tag) = \operatorname{AES-GCM-Enc}(key,m,IV,AD)$$ Where $A$ is the Associated Data. The tag is verified by the same key, IV, and AD. $$(\{T,F\},m?) = \operatorname{AES-GCM-Dec}(key,c,IV,tag,AD)$$ The tag verification ...


0

Let's say you're talking about HMAC-SHA256, which is about the only reasonable use of HMAC other than HMAC-SHA512 these days. (For BLAKE2 or SHA-3, you don't need HMAC in the first place; there are native keyed versions.) How is HMAC-SHA256 different from AES-GMAC? (AES-GMAC is AES-GCM with an empty plaintext—the use case you're asking about, giving just ...


1

If I need to support AEAD sometimes, is it reasonable to just use AEAD all the time and skip HMAC entirely? Yes, and if you only need integrity / authenticity of the message then you can put all of the message in the Associated Data. HMAC should be faster, but how much? I’ll need to test this, but suspect the difference might not be huge. It won't be ...


1

The answer depends on how you define ‘convergent encryption’ and what threats you're hoping to defend against. Here are two broad options that you might mean: You're a storage service and you make lofty promises about encryption to your users, but you also do deduplication between unrelated parties. (Maybe you abuse the term ‘zero-knowledge’; it's trendy ...


4

is there a property that guarantees that $D_{k'}(c)$ fails to verify/decrypt? No, there is not; all the security guarantees that authenticated encryption provides is of the form "if you don't know the keys, then it is difficult to..."; it says nothing about the difficulty of anything if you do know the keys. And, it turns out that, with GCM, you can ...


Top 50 recent answers are included