Re: counter mode and data integrity

From: Michael Amling (nospam_at_nospam.com)
Date: 10/31/03 

Date: Fri, 31 Oct 2003 15:02:36 GMT

Joerg Platte wrote:
> John E. Hadstate wrote:
>
>>If I understand your proposal, you want to use part of a hash of the block
>>data concatenated with a block address as the counter in CTR mode. You
>>would then encipher the block data using the CTR-mode ciphertext.
>>
>>My question is, how do you decipher the data? You need the plaintext to
>>compute the hash that makes-up part of your counter. If you don't have
>>the plaintext available, with what do you feed the counter?
>
>
> The counter (hash value) can be stored with the corresponding block. There
> is no need to encrypt or protect the counter value. So it's possible to
> decipher the block with this counter and the secret AES key.

   If you're storing a hash-derived counter value, you may as well store
a sequence-derived counter value.
   Your goal was "But I don't want to store the counter value for every
block to save some bytes."

--Mike Amling

Relevant Pages

  • Re: counter mode and data integrity
    ... > would then encipher the block data using the CTR-mode ciphertext. ... > the plaintext available, with what do you feed the counter? ... The counter (hash value) can be stored with the corresponding block. ... decipher the block with this counter and the secret AES key. ...
    (sci.crypt)
  • Re: Reducing the chance of collisions in known encryption systems
    ... > Isn't it that in your scheme one hash gives one ... collision string = a plaintext string of characters that would result ... The idea is to use a predefined ruleset (such as the ascii values of ...
    (sci.crypt)
  • Re: Does OTP need authentication?
    ... > I am assuming that the original sender would calculate the hash of the ... > plaintext, append that hash to the plaintext, and encrypt the lot with ... > the OTP. ... I'm never sure about Mallory.) ...
    (sci.crypt)
  • Re: Combined Signature and Encryption Schemes.
    ... A block cipher on the Plaintext, this gives me the CipherText ... A Mac on the Ciphertext ... digitally signing the MAC value would remove the need for a hash pass ...
    (sci.crypt)
  • RE: On passwords, securtiy and real -sweat, blook and tears- life
    ... it's rarely sent as plaintext anymore. ... In some cases the password is "hashed" locally and the hash, ... I.e.,, take all permutations of allowed password characters and then ... Unfortunately most passwords are dictionary words, ...
    (Fedora)