Problem - Kevin Tafuro

modes such as CWC and CCM are starting to appear, both of which perform
encryption and message integrity checking together, and they are still secure (such
modes are compared in Recipe 5.4, and CWC is discussed in Recipe 5.10). However,
if you’re not willing to use one of those encryption modes, follow these guidelines
to ensure security:
• Use two separate keys, one for encryption and one for MAC’ing.
• Encrypt first, then MAC the ciphertext.
We recommend encrypting, then MAC’ing the ciphertext (the encrypt-then-authenticate
paradigm; see Figure 6-4) because other approaches aren’t always secure.
Figure 6-4. The encrypt-then-authenticate paradigm
M
Encryption
C Tag
MAC
Output
For example, if you’re using a stream-based mode such as CTR (discussed in Recipe
5.9), or if you’re using CBC mode (Recipe 5.6), you will still have a good design if
you use a MAC to authenticate the plaintext, then encrypt both the plaintext and the
MAC tag (the authenticate-then-encrypt paradigm; see Figure 6-5). But if you fail to
encrypt the MAC tag (this is actually called the authenticate-and-encrypt paradigm,
because the two operations could happen in parallel with the same results; see
Figure 6-6), or if you use an encryption mode with bad security properties (such as
ECB mode), you might have something significant to worry about.
Another advantage of encrypting first is that if you’re careful, your servers can reject
bogus messages before decrypting them, which can help improve resistance to denial
of service attacks. We consider this of minor interest at best.
The one significant reason you might want to encrypt first is to give extra protection
for message authentication, assuming your MAC is cryptographically broken. The
hope is that if the privacy component isn’t broken, the MAC may still be secure,
which may or may not be the case, depending on the nature of the attack.
In practice, if you’re using a well-designed system—a dual-use scheme such as CWC
mode—the correct functioning of authentication and encryption both assume the
correct functioning of an underlying cipher such as AES. If this is broken, we consider
all bets to be off anyway!
Making Encryption and Message Integrity Work Together | 299
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.