Cryptology I (spring 2017) Problem 1: Macs and Encryption
نویسنده
چکیده
Consider the following symmetric encryption scheme (KG , E,D). KG chooses an AES key. E(k,m) := EAES (k,m)‖032. (032 stands for a string consisting of 32 zeros.) And the decryption D(k, c) does the following: Let c′‖p := c where p has length 32 bit and c′ is all but the last 32 bits of c. m := DAES (k, c′). If p = 032, then D(k, c) returns m. If p 6= 032 and kp = 0 (here kp is the p-th bit of the key k), then D(k, c) returns m. If p 6= 032 and kp = 1, then D(k, c) aborts.
منابع مشابه
Message-Recovery MACs and Verification-Unskippable AE
This paper explores a new type of MACs called messagerecovery MACs (MRMACs). MRMACs have an additional input R that gets recovered upon verification. Receivers must execute verification in order to recover R, making the verification process unskippable. Such a feature helps avoid mis-implementing verification algorithms. The syntax and security notions of MRMACs are rigorously formulated. In pa...
متن کاملBlockcipher-based MACs: Beyond the Birthday Bound without Message Length
We present blockcipher-based MACs (Message Authentication Codes) that have beyond the birthday bound security without message length in the sense of PRF (Pseudo-Random Function) security. Achieving such security is important in constructing MACs using blockciphers with short block sizes (e.g., 64 bit). Luykx et al. (FSE 2016) proposed LightMAC, the first blockcipher-based MAC with such security...
متن کاملSecurity of Symmetric Primitives under Incorrect Usage of Keys
We study the security of symmetric primitives under the incorrect usage of keys. Roughly speaking, a key-robust scheme does not output ciphertexts/tags that are valid with respect to distinct keys. Key-robustness is a notion that is often tacitly expected/assumed in protocol design — as is the case with anonymous auction, oblivious transfer, or public-key encryption. We formalize simple, yet st...
متن کاملThe Power of Verification Queries in Message Authentication and Authenticated Encryption
This paper points out that, contrary to popular belief, allowing a message authentication adversary multiple verification attempts towards forgery is not equivalent to allowing it a single one, so that the notion of security that most message authentication schemes are proven to meet does not guarantee their security in practice. We then show, however, that the equivalence does hold for strong ...
متن کاملFHPKE based on multivariate discrete logarithm problem
Previously I proposed fully homomorphic public-key encryption (FHPKE) based on discrete logarithm problem which is vulnerable to quantum computer attacks. In this paper I propose FHPKE based on multivariate discrete logarithm assumption. This encryption scheme is thought to withstand to quantum computer attacks. Though I can construct this scheme over many non-commutative rings, I will adopt th...
متن کامل