Lecture 5 Flashcards
What are some key qualities of nonce-based CBC?
nonce is unique, and you use two keys (one to encrypt the nonce to create a unique IV and one to do the rest of the encryption)
Why do you need extra encryption of nonce with independent key for nonce based cbc?
To prevent CPA attack..predictable IV will leak plaintext information
When is CBC padding needed?
When the message doesn’t fit the multiple of the block cipher block length
What is the problem with cbc padding?
You will need to pad an extra block after filling in the padding so that during decryption, message doesn’t get confused with padding (dummy block is major overhead)
Randomized CTR mode
Requires passing IV to the PRF when generating the pseudorandom pad for increased randomization (also no padding needed since no fixed block length)
Nonce CTR-mode
IV in this case is made up of nonce+counter. Tradeoff: constrained by how many counters
CTR vs CBC
CTR allows for parallel processing and doesn’t need padding and the error term is smaller so we have to change the key less often
Recap: examples of many-time key
Randomized cbc and Randomized ctr mode
One-time key examples
stream ciphers and deterministic CTR-mode
Message authentication code (MAC)
Has a signing and verification algorithm (create and verify the tag)
If you verify a tag with the same key you signed with, it should return true
How is MAC secure against CPA?
If Eve can’t produce a valid tag for a new message or a new tag for the same message
How can MAC be used for protecting system files?
If system gets hacked, you can recompute tags to make sure files are not modified. To make sure file order hasn’t been swapped, you can include filename in the tags.
Examples of MAC stemming from prf vs MACs from compression functions
CBC-MAC, NMAC, PMAC VS HMAC
What makes a MAC insecure?
If the tag is too short then Eve can guess it easily. Output of PRF needs to be large
NMAC
a key + first block of message produces ciphertext and we feed that to the next step as a key
Cascade NMAC
Insecure version of NMAC where extension attack can happen (you need to pad the last output and apply a diff key to for the finally tag encryption)
Encrypted CBC Mac (ECBC)
XOR function chains
NMAC vs ECBC MAC
NMAC is not used with AES or 3DES because key changes on EVERY block which means you have to recompute key expansion every time
ECBC-MAC commonly used as an AES-based MAC
CMAC
uses a randomized padding function so you can avoid having to add a dummy block (XOR final step with k1 if you have padding and k2 if you don’t have padding)
PMAC (parallel mac)
Parallel processing of message blocks to produce tag
What are cryptographic hash functions?
One way functions with three properties: pre-image resistance (given h=H(x) it is difficult to determine x) , second pre-image resistance (given x can’t find y where H(x) = H(y)) , collision resistance (difficult to find two different messages x,y such that H(x) = H(y))
MAC security for collision resistance
If small mac is secure, large mac will be secure
What is the birthday paradox?
In a group of 23 people, 50% that two share a bday (OR if you sample a certain number of hashes, you’ll have a 50% chance of finding a collision)
(means that a generic algorithm to find a collision is O(2^n/2) and going through the algo twice can result in collision because of birthday paradox
