New answers tagged mac
2
Just an additional point of information from the field. The NIST spec is strict in not allowing this, and it has good properties if an API does not do this. For example it protects against naive usage of the API which streams partial responses to some processing code which might execute commands or reveal timing information in side channels. However the ...
4
There are several reasons for an authenticated decryption (with AES-GCM or any other AE or AEAD mechanism) not to return any plaintext if the ciphertext is not authentic (i.e if the tag does not match).
One danger is if the calling code starts using the partially decrypted plaintext. Suppose the caller does something with the beginning of the plaintext, then ...
answered Apr 13 at 21:29
Gilles 'SO- stop being evil'
14.1k3 gold badges39 silver badges74 bronze badges
5
Is it acceptable to return the wrong plaintext if the tag is incorrect?
No. For one, it's against the spec quoted in question.
How bad is it to return the wrong plaintext anyway?
It's bad at least because if the AES-GCM API returned the wrong plaintext, then the software on top of the API might unwillingly use that wrong plaintext, just ignoring that it's ...
14
There is an article* that answers the question in the negative for GCM and CCM. The article introduces the first formalization of the Releasing Unverified Plaintext (RUP) setting. The related security notion is the Ind-RUP.
The security question is can an adversary forge messages with unverified messages? In this game, confidentiality is not relevant, since ...
10
how can we prevent the cipher from being returned in case the tag is wrong ? As far as I understand, to compute the tag the decryption process must be done entirely.
Actually, GCM decryption can be done in a two-step procedure:
Step 1: compute the expected GCM tag (which is a function of the ciphertext, AAD, teh secret H value, combined with the nonce and ...
0
Using your terminology, if a scheme is secure in the mac-forge game then it is also secure in the mac-forge* game. The formal proof is a bit fussy I can sketch the main idea.
First, without loss of generality, assume that in the mac-forge* game the adversary never queries the verification oracle on $(m,t)$ that was a result of a prior MAC query. This is ...
2
A MAC is a type of function, that returns an authenticator given a message and a secret.
The output length is a property of a function, not a constant for all MACs.
With constructions such as HMAC, the output length is directly dependent on the underlying hash function. Other constructions such as KMAC can produce an arbitrary long output.
And no matter what ...
Top 50 recent answers are included
