# Tag Info

7

All listed modes are vulnerable to manipulation attacks in one way or another. And all modes require specific prerequisites to be secure. This could be a maximum message size or having an unpredictable IV in the case of CBC. Only authenticated modes can achieve message integrity / authenticity. Others are all vulnerable because changes to the ciphertext ...

5

Think about 2 special cases when using AEAD: Some confidential data but blank associated data Some associated data, but blank confidential data In first case what you get when using AEAD cipher (e.g. AES-GCM) is just Authenticated Encryption, as there is no associated data. In second case what you get when using AEAD cipher (again, e.g. AES-GCM) is ...

5

RFC 8734 defines how to use Brainpool curves within TLS 1.3, including how they can be used in ECDSA signatures (section 4) . Hence, yes, there is an official way to negotiate Brainpool curves for use in the SERVER KEY EXCHANGE.

3

Your question almost answers itself, in my opinion: Is there any benefit using an AEAD as a MAC (edit: specifically as a building block in constructs that expects one that behaves like a PRF such as HMAC) other than "it reduces code/circuit size"? No, doesn't seem to be. And what is (or was) NIST thinking when they acknowledge(d) using AEAD as ...

3

I would like to know whether a specific PRNG satisfy the next-bit test or not. That requires analyzing the design of the PRNG. Will satisfying all of NIST statistical tests on PRNG guarantees passing the next-bit test? No. The NIST statistical tests are intended to test an implementation of a RNG. They are next to useless to tell if a PRNG is good or ...

2

The source of confusion may be the following. Theoretically, since the work of Andrew Yao, it has been known that the next bit test is equivalent to pseudorandomness. Informally, a sequence generator is pseudorandom if and only if no polynomial time probabilistic algorithm can predict its next bit with probability strictly greater than $1/2.$ See the notes ...

2

A partial answer is that the 2012 version of SP 800-90A included a fourth DRBG construction, Dual_EC_DRBG (§10.3.1.2), for which the security_strength parameter was required. Since one DRBG flavor required this parameter, to have a common interface, all DRBG flavors had to take this parameter. In Dual_EC_DRBG, security_strength is used only for one thing: to ...

2

Test vectors, as well as the requirements for validation testing, are currently available here: https://csrc.nist.gov/Projects/cryptographic-algorithm-validation-program/CAVP-TESTING-BLOCK-CIPHER-MODES By the way, this was literally the first result for a google search of "XTS-AES test vectors"

2

The various nist tests look for patterns which should not be present in random data. For any such pattern, e.g imbalance, repetition etc. you can ask youself what is he likelyhood of this strength imbalance or worse occuring in random data. this is the pValue. If we toss a coin multiple times we can count heads and tails. The closer they are to even the ...

1

Efficiency Efficiency is one reason why e.g. GCM as a MAC would be nice. GCM uses GMAC, which can be a relatively fast operation with hardware support. Modern (AMD 64 compatible) processors have an Intel defined multiplication instruction called PCLMULQDQ to support it (Intel hosted PDF). Commonly GCM is said to have 1.5 passes instead of the actual two to ...

1

Clearly the installation of health tests must come after the development of the entropy source. As part of that development, you'd need to assess the min.entropy of your new system under whatever sampling methodology you choose. And Min Entropy H comes out of that assessment. It is "the min-entropy of the samples from a (digitized) noise source or of the ...

1

440 and 888 are the maximal values of seed length, that, when concatenated with 1 octet, yields a input to SHA256 and SHA512 respectively, requiring only 1 invocation of the compression function. These values are fixed in such way that, it precludes the use of other hash functions, even ones approved as SHA3. However, if one wants, the above rule can be ...

1

As David Wong commented, NIST has proposed CTR-DRBG as the secure way to do it. Here is a link to an implementation in Python using CTR-AES-128. However, it should be noted that quite recently (2019-11) a side-channel attack was published (by Lauren De Meyer, COSICS) to recover the key and a nonce using only 256 power traces of CTR-AES. Thus, one should be ...

Only top voted, non community-wiki answers of a minimum length are eligible