125
@Ninefingers answers the question quite well; I just want to add a few details.
Encrypt-then-MAC is the mode which is recommended by most researchers. Mostly, it makes it easier to prove the security of the encryption part (because thanks to the MAC, a decryption engine cannot be fed with invalid ciphertexts; this yields automatic protection against chosen ...
80
Assuming you are asking about public-key signatures + public-key encryption:
Short answer: I recommend sign-then-encrypt, but prepend the recipient's name to the message first.
Long answer: When Alice wants to send an authenticated message to Bob, she should sign and encrypt the message. In particular, she prepends Bob's name to the message, signs this ...
61
Actually, that wikipedia article you mention in your question already answers your question:
It is moderately common for companies and sometimes even standards bodies as in the case of the CSS encryption on DVDs – to keep the inner workings of a system secret. Some argue this "security by obscurity" makes the product safer and less vulnerable to attack. ...
55
Combining is what SSL/TLS does with MD5 and SHA-1, in its definition of its internal "PRF" (which is actually a Key Derivation Function). For a given hash function, TLS defines a KDF which relies on HMAC which relies on the hash function. Then the KDF is invoked twice, once with MD5 and once with SHA-1, and the results are XORed together. The idea was to ...
54
This is known in the cryptographic literature as "traitor tracing". See, e.g., the following seminal paper:
An efficient public key traitor tracing scheme. Dan Boneh and Matt Franklin. CRYPTO 1999.
They show a public-key encryption scheme where each possible recipient has their own private decryption key. If an authorized recipient discloses their ...
49
Hugo Krawczyk has a paper titled The Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?).
It identifies 3 types of combining authentication (MAC) with encryption:
Encrypt then Authenticate (EtA) used in IPsec;
Authenticate then Encrypt (AtE) used in SSL;
Encrypt and Authenticate (E&A) used in SSH.
It proves ...
39
Although there are already many answers here, I wanted to strongly advocate AGAINST MAC-then-encrypt. I fully agree with Thomas' first half of the answer, but completely disagree with the second half. The ciphertext is the ENTIRE ciphertext (including IV etc.), and this is what must be MACed. This is granted.
However, if you MAC-then-encrypt in the ...
33
Alright, I'll bite.
First, let me propose bounding the discussion to just the core of the protocol.
In particular, let's not get hung up on:
Social engineering attacks
How broadly the end-to-end encryption is applied (i.e. are all conversations in the app encrypted?)
The backgrounds of the inventors and reasoning for inventing the protocol
Metadata ...
30
You were right with your ideas in the the original question. If what you want to protect against is pre-images then chaining hash functions produces a function at least as strong as the strongest of its two components:
$$H_{\circ}(x) = H_0(H_1(x))$$
If what you want to protect against is collisions, then concatenation is at least as strong as the strongest ...
30
$\operatorname{Encrypt}(m\|H(m))$ is not an operating mode providing authentication; forgeries are possible in some very real scenarios. Depending on the encryption used, that can be assuming only known plaintext.
Here is a simple example with $\operatorname{Encrypt}$ a stream cipher, including any block cipher in CTR or OFB mode. Mallory wants to forge an ...
29
This is a classical example.
Here is the proof system…
Bob gives two gloves to Alice so that she is holding one in each hand. Bob can see the gloves at this point, but Bob doesn't tell Alice which is which. Alice then puts both hands behind her back. Next, she either switches the gloves between her hands, or leaves them be, with probability $1/2$ each. ...
25
Cascading cipher gives a sense of security; and one that is technically justified with respect to the possibility that a weakness in one of the cipher would allow recovering the encrypted data. That's Bruce Schneier's argument, and it made sense in an era where DES, the then leading cipher, was a closed design, clearly deliberately weakened by a small key, ...
23
Prevent double-spending with decentralized digital currencies without all transactions being public?
For such a scheme to work, if I have some currency, I have to be able to give it to Abel and I have to be able to give it to Beth, but I have to be unable to give it to both Abel and Beth. This means that giving the currency to Abel has to somehow make me unable to give the currency to Beth even though I previously could do that.
There are three mechanisms ...
21
Generate a file of cryptographically strong random data at least as long as the message to be sent. This will allow communicating the secret using the random data as a one-time-pad. I.e., produce the ciphertext by using a bit-by-bit combining function such as XOR.
Purchase a plane ticket for an international flight connecting through Sheremetyevo airport.
...
20
What happens if the sender is at another point in the sequence? ...
the key is pressed while out of range to the car.
In a rolling code (code hopping) system,
the keyfob transmitter maintains a synchronization counter C,
incremented every time a button is pushed.
The car receiver stores the most recent
validated synchronization counter it has received N.
...
19
Should we sign-then-encrypt, or encrypt-then-sign?
...
Do the same issues with (symmetric-key) MAC-then-encrypt apply to (public-key) sign-then-encrypt?
Yes. From a security engineering standpoint, you are consuming unauthenticated data during decryption if you mac-then-encrypt or sign-then-encrypt. A very relevant paper is Krawczyk's The Order of ...
18
The answer you posted is actually correct (more or less, see below): have each participant commit to their random number $r_i$ by publishing, e.g., $\mathcal{H}(r_i)$ in the first round. And then in the second round, each participant opens the commitment by publishing $r_i$ and everyone checks that it matches the committed value by hashing it. The final ...
17
Solutions to Yao's Millionaire's Problem should suffice for this computation. In that setup, there are two parties each with an input. The output reveals whose input is larger, and nothing else.
So Alice and Bob just run the protocol with their respective inputs A and B.
17
I heard of DRM but could not get a reliable implementation of DRM
There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money. Doing a cursory search for "why DRM doesn't work" yields an abundance of articles explaining the whats and whys.
To win at DRM, let's say you have some piece ...
16
There exists something which is one step further than your idea. Look up SRP: this is a Password-Authenticated Key Exchange protocol; the two parties (client and server) who run the protocol end up with a newly generated shared key (which can be used to derive encryption and integrity-check keys), with mutual authentication with regards to a shared ...
16
Moxie Marlinspike calls it in his article http://www.thoughtcrime.org/blog/the-cryptographic-doom-principle/ the doom principle:
if you have to perform any cryptographic operation before verifying
the MAC on a message you’ve received, it will somehow inevitably lead
to doom.
He also demonstrates two attacks which are possible because of trying to ...
16
This is one of the earliest questions that was asked in modern cryptography. There is a proof that you cannot achieve completely fair contract signing. However, there are some reasonable alternatives. There is one direction called "gradual release" which I personally do not like. A model that I think has a lot of promise is called the "optimistic model". In ...
15
If you look closely at the definition of authenticated encryption modes, you will see they all are, actually, the combination of symmetric encryption and a MAC.
Using traditional encryption and an independent MAC has a few tricky points, none of them being unsolvable:
The encryption mode will use a key, and the MAC will also use a key; using the same key ...
15
TLS 1.0 uses initialization vector (IV) to refer to two different processes. TLS 1.1 introduces a new type of IV that causes an entire block to be discarded and isn't directly comparable to the old series of IVs based on CBC residue. By simply changing an operation at the beginning of a record, the hope was apparently to make implementations easy to patch ...
15
If k is a constant, such as 3, it becomes possible to select a pair (N,g) such that the discrete log of k to the base g is known, which would enable the two-for-one guessing attack again.
14
This is actually to a great extent a question of terminology, and ultimately which security claims you are prepared to make, more than it is a practical question.
For short: You may draw the line between the key space and the algorithm any way you want, but the way you draw that line will have implications regarding which security claims you are able to ...
14
In general, you cannot prove lack of knowledge, because even if you did know something you shouldn't, you can always pretend that you don't know it and carry out the proof as if you didn't know it.
For your specific example, consider how the prover would know $x_0$. Did you tell them what it is? If so, that proves nothing, since they would then know $x_0$ ...
13
I think Encrypt-then-MAC does not deliver Plaintext integrity, but only ciphertext integrity. If the MAC over the ciphertext is OK but then we use the wrong key to decrypt (for whatever reason), then the recipient receives a plaintext that the sender did not send and did not vouch for. If this can happen, this is a violation of plaintext integrity.
So, ...
13
The overall idea is a sound migration strategy. The nice thing is that security for all users is upgraded in a one-shot operation, rather than at the hypothetic next login of each user. Of course, original salt and new_secure_salt shall be stored, or perhaps for some portion derivable exactly from material keyed-in by the user, e.g. user name lowercased.
...
Only top voted, non community-wiki answers of a minimum length are eligible
