4 ms·

I have only recently started casually studying cryptography. I just yesterday learned about GCM mode, which provides similar features to CTR with GMAC. Is there

I have only recently started casually studying cryptography. I just yesterday learned about GCM mode, which provides similar features to CTR with GMAC. Is there any specific reason you chose to use CTR with HMAC in spiped rather than GCM? I ask because I have the impression that using GCM would further simplify/reduce the amount of code and because I'm interested in learning what goes into these decisions. BTW, I'm perfectly happy with an answer of "I can't even explain it because you don't know enough yet." if that's the case. [EDIT] Extra information for not-yet-crypto-nerds: The "modes" i'm referring to are cipher block modes. Cipher block modes allow repeated application of a block cipher to long messages (because a block cipher's input must be a fixed length - that's what makes it a "block" cipher rather than a "stream" cipher). Using a block cipher only gives you confidentiality; it does not verify the inegrity or the source of the message. For those, a message authentication code (MAC) is needed. There are several MAC algorithms. There are some block cipher modes (including GCM) that provide both authentication and encryption because they include a MAC algorithm. http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation http://en.wikipedia.org/wiki/Message_authentication_code http://en.wikipedia.org/wiki/Message_authentication_code

digitalsushi 14y ago
Oh my gosh buddy if you're going to say something that interesting, please explain it for the rest of us with a few extra sentences what you're asking. I'm sure the author will know instantly, but bring the rest of us up with an extra nugget because the tone of your question sounds fascinating and if you double it out, I bet it will be.
- alexchamberlain 14y ago
  I downvoted, and I'd like to explain why and with the disclaimer I also did not understand a lot of what was asked. This was a technical question on a subject that takes years to master properly. It's not fair on the questioner to have to try and explain that to the rest of us when Google will suffice, nor on the author that would understand the question as asked to have to waste time getting to the point of the question.
  - digitalsushi 14y ago
    That's fine. I took his question as obtusely academic and that he would have been the best person to easily append a few clarifying statements as to why the rest of us should have to process his question. And I understand that I am being downvoted by the people that either understand his question and sympathize, or by people that feel I should have devoted some time to understanding his question. I do not agree with this, and so my original decision to ask him for more. I find that I generally have to emulate a different persona than I really am in order to stay above the ice around here. I don't take your downvote personally. [This was written before the grandparent edited their post with lots of clarifying information]
cperciva 14y ago
I covered this in a blog post a few years ago -- probably best if I point you at it rather than trying to cover everything here: http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac.html http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac....
- planckscnst 14y ago
  Wow. That was more than I hoped for. I especially appreciated the closing paragraph. Thanks for taking the time to write it and to point it out here. However, one of the points you made as an argument against authenticated encryption modes is actually a point for it, unless I'm not getting something. The point I'm referring to is that people write bad code and that every line of code includes a potential security vulnerability. Every time someone uses CTR+MAC, they're writing code to glue those together, and there are opportunities for missteps. Furthermore, that code that is viewed by a small number of people. By using an authenitcated encrytion mode, one can reduce the lines of code you're writing because it the functionality is provided by the implementation, which will certainly have been looked at more times than one's own project. [Edit] Maybe this is what I was missing: "Encrypt-then-MAC is essentially impossible to get cryptologically wrong."

digitalsushi 14y ago

Oh my gosh buddy if you're going to say something that interesting, please explain it for the rest of us with a few extra sentences what you're asking. I'm sure the author will know instantly, but bring the rest of us up with an extra nugget because the tone of your question sounds fascinating and if you double it out, I bet it will be.

alexchamberlain 14y ago
I downvoted, and I'd like to explain why and with the disclaimer I also did not understand a lot of what was asked. This was a technical question on a subject that takes years to master properly. It's not fair on the questioner to have to try and explain that to the rest of us when Google will suffice, nor on the author that would understand the question as asked to have to waste time getting to the point of the question.
- digitalsushi 14y ago
  That's fine. I took his question as obtusely academic and that he would have been the best person to easily append a few clarifying statements as to why the rest of us should have to process his question. And I understand that I am being downvoted by the people that either understand his question and sympathize, or by people that feel I should have devoted some time to understanding his question. I do not agree with this, and so my original decision to ask him for more. I find that I generally have to emulate a different persona than I really am in order to stay above the ice around here. I don't take your downvote personally. [This was written before the grandparent edited their post with lots of clarifying information]

cperciva 14y ago

I covered this in a blog post a few years ago -- probably best if I point you at it rather than trying to cover everything here: http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac.html http://www.daemonology.net/blog/2009-06-24-encrypt-then-mac....

planckscnst 14y ago
Wow. That was more than I hoped for. I especially appreciated the closing paragraph. Thanks for taking the time to write it and to point it out here. However, one of the points you made as an argument against authenticated encryption modes is actually a point for it, unless I'm not getting something. The point I'm referring to is that people write bad code and that every line of code includes a potential security vulnerability. Every time someone uses CTR+MAC, they're writing code to glue those together, and there are opportunities for missteps. Furthermore, that code that is viewed by a small number of people. By using an authenitcated encrytion mode, one can reduce the lines of code you're writing because it the functionality is provided by the implementation, which will certainly have been looked at more times than one's own project. [Edit] Maybe this is what I was missing: "Encrypt-then-MAC is essentially impossible to get cryptologically wrong."