Proper MAC usage?

From: John M. Dlugosz (john_at_dlugosz.com)
Date: 09/10/03 

Date: 10 Sep 2003 07:44:20 -0700

Suppose I have some encrypted data. The data is also authenticated
using a MAC, and furthermore all data that affects its meaning but is
not part of the actual encrypted data (e.g. "headers" or "meta-data")
is subject to the MAC. I understand that.

But there is one piece of meta-data in particular that has me
wondering. What about a key-definition record? A simple
key-definition might contain a prompt string, "Enter password one",
and parameters specifying how to convert the string to a binary key.

Does this key-definition record get a MAC? "Why not?" one may ask.
Well, the only thing it can be authenticated with is the very key it
accesses, and this provides a quick way to brute-force a key search.
So perhaps it is actually a bad idea to include a MAC for this! Is
it?

If someone changed the prompt to "Enter password two", then someone
who follows the directions will not authenticate the message, which is
exactly what would happen if the key-definition was MAC'ed. Putting a
MAC on the key definition seems to be a way to validate keys without
doing much work.

But it bugs me that someone could indeed tamper with the prompt and go
undetected. Here is one way to exploit that: if nobody notices, then
the attacker knows that password one and password two are actually the
same.

I wonder if there is some algorithm other than a typical MAC (e.g.
keyed hash over the body of the record) that can be used to detect
tampering without making it simple to test keys. For example, iterate
the hash 2-to-the-n times like with key strengthening.

--John

Relevant Pages

  • Re: Question on proper MAC usage; or, How does the Horton Principle apply to key-definition records?
    ... > is subject to the MAC. ... What about a key-definition record? ... > who follows the directions will not authenticate the message, ... > But it bugs me that someone could indeed tamper with the prompt and go ...
    (sci.crypt)
  • Question on proper MAC usage; or, How does the Horton Principle apply to key-definition records?
    ... Suppose I have some encrypted data. ... is subject to the MAC. ... Does this key-definition record get a MAC? ... who follows the directions will not authenticate the message, ...
    (sci.crypt)
  • Re: COMPUSEC
    ... > encrypted data and the data will be incorrectly decrypted. ... > Is there on the Earth a disk encryptor that works will Tom's MAC? ... I mean there are a lot of bad video games out there. ... properly doesn't mean "proper" doesn't exist. ...
    (sci.crypt)
  • Re: COMPUSEC
    ... I've verified Drivecrypt v3.03a too, there is no MAC, you can modified the ... encrypted data and the data will be incorrectly decrypted. ... Is there on the Earth a disk encryptor that works will Tom's MAC? ...
    (sci.crypt)
  • Re: COMPUSEC
    ... > Tom St Denis said Compusec was not good because there is no MAC. ... > You can modified the encrypted data, they will be incorrectly decrypted but ...
    (sci.crypt)
Quantcast