Re: David's authenticated encryption mode.

David Gothberg wrote:
Tom St Denis wrote:
It looks nice, but my concern is that an attacker can learn the
intermediate values of H[0], H[1], etc before the final output. Will
that affect the security of the MAC?
Tom

Thanks for thinking it looks nice. And yes, that the attacker can guess
some of the intermediate hashes probably is the main concern. I am no
cryptanalyst, but as far as I understand it should not be a problem for
several reasons:

Look at it a bit more carefully.

The key for the last encrypt is actually

Key xor 2 xor m1 xor E(m1) xor H0 xor Key xor 3

The keys cancel out and we know 2 xor 3 xor m1 xor H0 [since we know m1
and H0] So the unknown bit of the key for the last encrypt is merely
E(m1). I still think it's a bad idea to know the intermediate values of
the chained MAC.

Also the key xors outside the encrypt don't contribute anything since
they cancel out.

H0 = E_{key xor H-1}(m0) xor m0
H1 = E_{key xor H0}(m1) xor m1
etc...

Should be enough, at least for a hash.

Aside from all this keep in mind you are invoking the key schedule for
every block. Few ciphers are efficient in that model.

Tom

.

Relevant Pages

  • Re: More on caching and logging
    ... attention to the inner workings of the Mac. ... thought to getting an iPod. ... But the attacker never signed any agreement with apple, ... and far more of a security enhancement against this kind of thing. ...
    (comp.sys.mac.system)
  • Re: How to spoof/masquerade mac addresses?
    ... The MAC address on a card reveals the manufacturer of the NIC. ... attacker uses a NIC database that is commonly available from the ... discover information about your network. ... "Security through obscurity" does not work (see: ...
    (comp.unix.bsd.openbsd.misc)
  • Re: Encrypting database
    ... In short, they suggest storing, next to each value in the database, ... not a MAC. ... it's still vulnerable to dictionary attacks if the attacker has ... store the database in encrypted form _and also encrypt the indices_. ...
    (sci.crypt)
  • Re: Blocking by MAC Address -
    ... So don't tie your security to MAC addresses... ... >> Again an attacker could still bypass 802.1x with this configuration. ... >> Switch will only see one MAC. ...
    (microsoft.public.windows.server.networking)
  • Re: the exploit that wasnt
    ... The other Mac Book Pro? ... brought Microsoft into a security discussion about Mac OS X. ... The number of security patches, ... if you were to scan random machines on the internet for a week, ...
    (comp.sys.mac.advocacy)