Your colleague knew that Encrypt-and-Mac does not always yield a secure authenti- cated encryption scheme, even...

 

Transcribed Image Text:

Your colleague knew that Encrypt-and-Mac does not always yield a secure authenti- cated encryption scheme, even if the base encryption and MAC schemes are secure. For example, if a deterministic MAC is used, then two encryptions of equal messages will have equal parts. Therefore, he proposed to encrypt and MAC the message concatenated with a random string. Namely, a ciphertext is computed as EK. (MR) || TK.. (M || R) for a random R (picked at random for each message). We assume that the message spaces for encryption and MAC can easily accommodate extra strings. Verification is defined accordingly. Convince your manager that your colleague's generic composition proposal is not good security-wise. Your argument does not have to be formal, but it has to be convincing. Your colleague knew that Encrypt-and-Mac does not always yield a secure authenti- cated encryption scheme, even if the base encryption and MAC schemes are secure. For example, if a deterministic MAC is used, then two encryptions of equal messages will have equal parts. Therefore, he proposed to encrypt and MAC the message concatenated with a random string. Namely, a ciphertext is computed as EK. (MR) || TK.. (M || R) for a random R (picked at random for each message). We assume that the message spaces for encryption and MAC can easily accommodate extra strings. Verification is defined accordingly. Convince your manager that your colleague's generic composition proposal is not good security-wise. Your argument does not have to be formal, but it has to be convincing.

Answer rating: 100% (QA)

Answer Deterministic MAC Issue While its a valid attempt to enhance security simply concatenating a random string to the message before encryption and ... View the full answer