4 ms·
>Most new crypto software doesn't even attempt to authenticate ciphertext; cryptographic software developers share a pervasive misapprehension that encryption p
by unimpressive 13y ago
>Most new crypto software doesn't even attempt to authenticate ciphertext; cryptographic software developers share a pervasive misapprehension that encryption provides a form of authentication (because tampering with the ciphertext irretrievably garbles the output).
Can you elaborate on this? What is the most common scenario where somebody gets this wrong?
- ww520 13y agoI think like using ECB, CBC, OFB, CFB, CTR, and XTS modes when encrypting with AES. Theses block cipher modes ensure confidentiality but they do not protect against malicious tampering. Someone can delete part of the encrypted message and it would still decrypt ok, giving the false impression that it's the original message. If I send you an encrypted message, "sell all IBM shares when price hits 120," and it's truncated to "sell all IBM shares," that would be disastrous. Adding HMAC/CMAC/GMAC authentication code helps to mitigate tampering. Newer block cipher modes like CCM, GCM, OCB, and others roll both confidentiality and authentication into one, making it much easier to use AES correctly.
- jacques_chester 13y agoDo the new cipher modes allow you to specify different keys for each operation?
- ww520 13y agoI am not sure about different keys. The AES key usage is always the same for encrypting individual blocks. AES is nothing but about encrypting a single 16-byte block of data. The cipher block modes build on top of AES to span encryption over multiple blocks. Some cipher modes can take in additional parameters to customize its usage. E.g. CCM can take in 64-bit to 128-bit authentication codes.