Re: Newbie question about AES encryption

Peter van Liesdonk <peter@xxxxxxxxxxx> wrote:
As already mentioned, the correct way to find out about it is to
include a MAC.

.... in a careful way.

Either send the MAC of the original message as a
separate block with the cipher text,

No, no, no, no, no, no, no. For many (maybe even most) MACs, this is
insecure. The MAC tag leaks information about which message is sent.

or concatenate it to the plain
text before encryption.

This can supposedly fail in subtle ways.

The canonical way to use a cipher together with a MAC is to encrypt,
then run the ciphertext through the MAC function.

The even better way is to use an encryption mode with confidentiality
_and_ integrity.

--
Kristian Gjøsteen
.

Relevant Pages

  • Authenticating encrypted messages?
    ... I'm working on implementing a symmetric encryption program that needs ... to ensure that cipher text has not been tampered with while in transit ... what if we need to encrypt both the message and MAC before ... Encrypt I in the CBC mode with the block cipher to produce C ...
    (sci.crypt)
  • Re: SOBER-128 draft rfc
    ... because we extensively analysed the MAC ... function in combination with encryption. ... reason that plaintext was input to the MAC ... after all, we were designing a cipher, ...
    (sci.crypt)
  • Re: CBC questions
    ... authentication, and not a very tricky one. ... either they're a fancy way of gluing an encryption scheme and a MAC ... Since CBC mode is weak without authentication, ... cipher E_Kand use hXOR E_Kinstead of the above construction. ...
    (sci.crypt)
  • Re: thoughts about CBC mode
    ... because the IV is derived from some value that some other part of the cipher ... I've had an MAC for a very long time. ... piecing together things about CBC, stream ciphers, multiple keys, etc. ... There is no coherent terminology. ...
    (sci.crypt)
  • Re: Countering chosen-plaintext attacks
    ... > resist chosen plaintext attacks. ... > the cipher for providing such resistance. ... > PRPs] can be used to create hash, mac and stream ciphers. ...
    (sci.crypt)