4 ms·

>Without authentication, you can't even be sure you have confidentiality. Sure you can: a classic XOR one-time pad has no authentication and it's the definitio

>Without authentication, you can't even be sure you have confidentiality. Sure you can: a classic XOR one-time pad has no authentication and it's the definition of confidentiality-preserving. It's true that malleability makes it easier to attack certain protocols which can then result in a loss of the confidentiality property. Your padding oracle example is a case in point, and there's seldom a reason to avoid an authenticated encryption mode for a message that's sitting inside a TCP packet. On the other hand, sometimes malleability is a desirable property, and authentication is harmful. The APCO Project 25 radio standard, intended for use in the mobile radio world, has encryption as an option. The priority is to maintain confidentiality and to degrade gracefully in a hostile RF environment. Encryption is applied after error-correcting codes using OFB mode, and so effects of interference apply bitwise within the data stream on decryption. An authenticating mode would be a disaster as a single bit error would result in the loss of an entire transmission.

anamexis 6y ago
Don't you need authentication to get the one-time pad in the first place?
- tus88 6y ago
  No they are sent by snailmail.
  - kzrdude 6y ago
    Any offline method works. Transfer by handshake, travel with it in your bag from the main office, or injected as a chip under your skin since birth, any such method. :)
  - droffel 6y ago
    Don't you offload the authentication to the postal service in this case?
- NovemberWhiskey 6y ago
  Key material distribution is a completely separate problem from authentication of a message. Even if you use an authenticated encryption mode, you still have the problem of "how does this symmetric key get shared with only the intended parties?".
tptacek 6y ago
This is a little like saying unauthenticated CBC mode is fine as long as all you're doing is blitting out the raw ciphertext, padding (or otherwise) included, for a human being to read in a hexdump. Any step you take past that is a computer program that holds a secret key acting on ciphertext chosen by an attacker and thus revealing some kind of behavior to them. There have been surprising "oracles" found in a variety of constructions beyond CBC mode. Modern cryptography chooses to avoid this problem entirely.

anamexis 6y ago

Don't you need authentication to get the one-time pad in the first place?

tus88 6y ago
No they are sent by snailmail.
- kzrdude 6y ago
  Any offline method works. Transfer by handshake, travel with it in your bag from the main office, or injected as a chip under your skin since birth, any such method. :)
- droffel 6y ago
  Don't you offload the authentication to the postal service in this case?
NovemberWhiskey 6y ago
Key material distribution is a completely separate problem from authentication of a message. Even if you use an authenticated encryption mode, you still have the problem of "how does this symmetric key get shared with only the intended parties?".

tptacek 6y ago

This is a little like saying unauthenticated CBC mode is fine as long as all you're doing is blitting out the raw ciphertext, padding (or otherwise) included, for a human being to read in a hexdump. Any step you take past that is a computer program that holds a secret key acting on ciphertext chosen by an attacker and thus revealing some kind of behavior to them. There have been surprising "oracles" found in a variety of constructions beyond CBC mode. Modern cryptography chooses to avoid this problem entirely.