Re: Blockcipher >256 bit (for hardware implementation)

Mike Amling <spamonly@xxxxxxxxxxx> wrote:
The OP's idea that somehow a
256-bit message and its 64-bit MAC should be encrypted by the
application of a cipher to a single 320-bit block is dubious.

Actually, I think it is perfectly sound. In fact, there's no need
for a MAC. If you have a 320 bit block cipher (f,g) and a 256 bit
message, I encrypt it as

c = f(k, m || 0^64) .

Do decrypt, I compute

m'||t = g(k, c)

and check that t = 0^64.

If the block cipher is secure (looks like a random permutation), the
forgery probability should be about 2^{-64}.

--
Kristian Gjøsteen
.

Relevant Pages

  • Re: SOBER-128 draft rfc
    ... because we extensively analysed the MAC ... function in combination with encryption. ... reason that plaintext was input to the MAC ... after all, we were designing a cipher, ...
    (sci.crypt)
  • Re: Encrypt and Authenticate (E&A)
    ... Stream cipher which XORs data with a pseudorandom pad ... example is a leaky MAC, ... let's define what an E&A scheme is. ... The attack in essence works by using the MAC ...
    (sci.crypt)
  • Re: Blockcipher >256 bit (for hardware implementation)
    ... Kristian Gjøsteen wrote: ... 256-bit message and its 64-bit MAC should be encrypted by the application of a cipher to a single 320-bit block is dubious. ... message, I encrypt it as ...
    (sci.crypt)
  • Re: CBC questions
    ... authentication, and not a very tricky one. ... either they're a fancy way of gluing an encryption scheme and a MAC ... Since CBC mode is weak without authentication, ... cipher E_Kand use hXOR E_Kinstead of the above construction. ...
    (sci.crypt)
  • Re: thoughts about CBC mode
    ... because the IV is derived from some value that some other part of the cipher ... I've had an MAC for a very long time. ... piecing together things about CBC, stream ciphers, multiple keys, etc. ... There is no coherent terminology. ...
    (sci.crypt)