4 ms·
> A keyed hash, GHASH, is then computed over the additional data and the cipher text. That hash is encrypted with AES too, and you get an authentication tag. W
by jetrink 8y ago
> A keyed hash, GHASH, is then computed over the additional data and the cipher text. That hash is encrypted with AES too, and you get an authentication tag.
What is the purpose of encrypting the keyed hash? I'm assuming there's something clever that an attacker could do with it if it were not encrypted, but I can't figure out what that might be.
- lvh 8y agoThis is playing a little fast and loose but just to get an idea: the keyed hash is fast but only secure once. By encrypting it, you get most of the perf benefit (the tag is much smaller than the entire message), and you get multi-message security. FWIW, Poly1305 in e.g. secretbox works the same way: it's really Poly1305-AES. The Poly1305 is equivalent to GHASH here; AES encrypts in both cases.
- colmmacc 8y agoThe later iterations of Poly1305 removed the need for AES by using a synthetic Salsa20 derived key that is unique per key-nonce input pair.
- lvh 8y agoWhoops; you're right of course, but same idea with fewer primitives -- either way, obscure the output of the polynomial MAC with the output of a cipher, so you get the fast MAC that you can reuse multiple times.
- colmmacc 8y agoA naked GHASH is not a secure MAC; the key can be reverse engineered from the value. So it's encrypted to make the tag.