The Side Channel

Maarten Bodewes

00:00

As long as it has nothing to do with Crypto++, that API is just a bit too weird to me.

Too easy to create sink holes :P

kelalaka

I wonder why the designer did not consider this problem?
no just old joke

Maarten Bodewes

@kelalaka It is worse: they did consider, then argued that they needed to validate the ciphertext first.

However, API's should be flexible in the sense that they should cover all use cases.

kelalaka

Why. did they think that people will ignore the tag?

Maarten Bodewes

Yep.

kelalaka

puff

Maarten Bodewes

00:02

And they tried to make sure that it was a drop in replacement. Which I think is stupid too, personally.

kelalaka

While there are other modes that are faster who would use AES-GCM without the tag!

Maarten Bodewes

I mean: the idea that you can switch from CBC mode to GCM mode and not make any changes is stopid.

The tag is included in the ciphertext according to the Java API.

(or I didn't get that last comment)

Stopid? Sheesh, I'm really having a bad spell :P

kelalaka

As you already mentioned in a recent answer in SO, give the power to the designer.

prepend and append, sandwich.

Maarten Bodewes

I don't have an android runtime. Just for fun, I'm going to test Java 11, but I'm not sure it matters much.

(to see if Cipher behaves)

Darn, wrong Eclipse again.

kelalaka

Encrypt a DVD ISO and you will see.

Maarten Bodewes

00:07

Is that one of these things that spin?

Nah, I'll keep to a few blocks.

Stupid laptop doesn't have a drive. But worse, I forgot to check that it had a NW connection when I bought it. Didn't occur to me that they would sell these things without one.

Then again, the SSD is an OEM Samsung thingy :)

kelalaka

NW stands for?

After 10 years my first laptop that has a drive. I'm going back...

Maarten Bodewes

Network.

You know, RJ45 connector to UTP...

The Lenovo USB-3 NW connector is working fine, fortunately.

kelalaka

ok, ok

Maarten Bodewes

But still; sheesh.

Got one of those Lenovo Yoga laptops. Got a sweet deal, but I should probably have gone for the thinkpad range.

This one however has an i7 and plenty of cooling, which the pro was missing.

I'm missing my thinkpad keyboard though; these things are gold.

kelalaka

toshiba portege 3440ct

That was my best

Maarten Bodewes

00:20

I had a SL300 thinkpad. Only cost me 500 euro :)

Removed the DVD drive in favor of a caddy with Intel SSD. Startup time < 3s. Wheee :)

G2 drive, when they made their own.

Very bad screen though, that was the only sucky thing about it.

kelalaka

I've don't have 3440ct with me. Was belong to goverment...

Maarten Bodewes

Toshiba doesn't sell here anymore, possibly some specialist equipment, but that's it.

Shame. Good stuff, but they went too much for the cheap market.

kelalaka

Well, the global market kills all.

Maarten Bodewes

I liked the MacBook pro hardware as well. I also got a Dell Xeon laptop with 32 GB of memory and two drives with the last job. Unfortunately, calling that a laptop was a stretch at best.

Besides, having two laptops was crap.

3 if you count my own.

(one SSD, one harddrive)

I called it "the beast" :)

kelalaka

I always said MS must produce hardware, too. Look at Apple...
Why having more than 1 is crap?

Maarten Bodewes

00:29

Double software, switching between one IDE on one laptop and the other. Forgetting which project is on which computer etc.

Having a few VM's running on them didn't help either.

kelalaka

Can be very helpful for different lives (projects) :)

Maarten Bodewes

Possibly, but not my life, it was one of the reasons why I quit that last job within a year.

kelalaka

I tried VM years ago, It works only testing, nothing more for me..

Maarten Bodewes

We had engineers at my first to last job do all the development on a local service with RDC.

I told them that it would not work, but did they listen?

Most of my former colleagues would not listen only once, thankfully :)

kelalaka

You can't argue with them. Do they also use RDC :)

Maarten Bodewes

00:34

Sorry, on a local, single server, was what I meant.

kelalaka

When you decide a bounty for another question, let me do it :)

Maarten Bodewes

Why? I'm finally starting to be able to award a few ;)

Darn, Cipher is fucked up as well, as I expected.

And it failed too on the buffer size, which is weird. I'll check if I miscalculated that.

No, that was my mistake indeed. Plaintext returned before tag verification: 0 bytes.

In that case updating the CipherInputStream is not going to help, at least not on the OpenJDK 11.

Do you have an Android runtime there?

I'm thinking of trying to get into the Oracle team that does Java security.

That might mean moving to the US though. Ugh.

And they are trying to get the community to do most of the work...

Maarten Bodewes

01:06

@kelalaka OK, I'm off to bed. Had a long day, gotta sleep.

G'nite, maybe I'll take you up on that offer for offering bounties - thanks for that...

@FutureSecurity TTYL :)

Future Security

Just caught up with the log. Talk to you latter.

@kelalaka I'm going to borrow the "sandwich" term in addition to "prepend" and "append"

I think I should write something like a blog post explaining things like RNGs, entropy, and hashing. And link to someone else to explain that "quantum" and consciousness have nothing to do with each other.

Future Security

01:31

I slammed my desk when I read that question. I misread input as output, so it seemed like they were needlessly loading an entire stream into memory before adding the tag.

During decryption, though, it's not needless. You can't start returning plaintext before getting every single byte without skipping authentication. (He used CBC with no MAC before.)

That's such a useless class if it doesn't handle message chunking for you. Edit: Nearly useless. Maybe for some reason all of your io streams are short.

Future Security

01:55

Funny that they didn't seem to think of that. The stream classes are meant to abstract away implementation specifics. Any InputStream should work as a drop in replacement for any other InputStream. (Should) That and, you know, be streaming.

I think of the 90's and early 2000's era of modern cryptography as being so primitive. I want to know how late that era lasted. Is it fair to use the date of Salsa20's publication as a landmark?

2007. Personally I'm extra cautious when I notice a paper or implementation has a 2005 date or earlier... I don't know what year I start taking proposed ideas more seriously. (Still cautious of course.)

I think I remember reading someone say that CTR mode was dangerous because a counter wasn't as random as typical plaintext. (Maybe Schneier) It apparently was also believed that lack of malleability in a mode was a decent alternative to authentication.

forest

02:15

@FutureSecurity I dunno, it seems like the 80s was the most primitive.

I'm going through reading all the submission papers for the AES contestants, and they don't seem nearly as primitive as ciphers from the 80s or early 90s.

Future Security

Well you can always get more primitive by going back in time.

I haven't look at old cipher design documents. I was kind of surprised by TwoFish. It looks like a bunch of things were mashed together. Sort of like SHA-1.

forest

Honestly Twofish looks like the most sane of all the ciphers.

Reading the paper, it gives a detailed description of each and every design decision, as well as alternate decisions that they decided against and rational.

Compare it to the Serpent paper which basically says "here are the primitives we use and here are the expected security properties". Twofish seems much better designed.

@FutureSecurity Like the one-bit rotates that turns the Feistel network into a modified Feistel network are explained in detail to break byte alignment, with the performance tradeoffs discussed and analysis of how the cipher would work without it or with a different rotation constant. Same with the PHT for diffusion, where they even discussed the loss of the MSB in one of the 32-bit lanes caused by the multiplication by two and explained the reason they don't go to lengths to preserve it.

Future Security

02:35

Is PHT reasonable? That's one choice that looked odd to me. (I did very little reading on it.)

forest

@FutureSecurity PHT provides excellent diffusion for very low cost, and most importantly can be accelerated with the LEA instruction with the subsequent added round key so both the PHT and round key addition can be done in a single instruction.

They gave a very detailed description of why they used the PHT.

Future Security

I'll add the TwoFish paper to my reading list then. How about how it uses s-boxes as part of a Feistel function? It seems like it would be less effective than an SPN. Less diffusion per round, you get the slowness of Feistel constructs.

forest

That's why they use the MDS matrix to maximize the diffusion.

And S-boxes are not uncommon in Feistel functions.

Future Security

I suppose they might result in less latency for hardware than using modular addition. TwoFish uses both.

forest

It was optimized for the P2 which can do addition extremely quickly.

@FutureSecurity The thing that made the paper interesting was how they quantified security. Every design decision that improved security but decreased performance was considered through the question of whether or not the number of rounds they'd have to reduce it by to keep the same cycles per byte would end up reducing the security. They decided against recovering the lost PHT bit because they'd have to reduce to 12 rounds from 16, but the security improvement per round would be negligible.

Same with the one-bit rotations which would not impact performance enough to require that they remove even a single round, but improved security significantly.

Future Security

02:58

I don't get the lost bit thing. The transform is reversible.

forest

The MSB of b' doesn't depend on the MSB of b.

So "lost bit" just means imperfect diffusion.

> The two outputs of the $g$ functions ($T_0$ and $T_1$) are then combined using a PHT so that both of them will affect both 32-bit Feistel XOR quantities. The half of the PHT involving the quantity $T_0 + 2T_1$ will lose the most significant bit of $T_1$ due to the multiply by two.

> This bit could be regained using some extra operations, but the software performance would be significantly decreased, with very little apparent cryptographic benefit. In general, the most significant byte of this PHT output will still have a non-zero output difference with probability $254/255$ over all 1-bit input differences.

From section 7.8 of the paper.

7

Q: Pseudo-Hadamard transform, most significant bit

For clarification: The Pseudo-Hadamard transformation is a reversible transformation of a bit string that provides cryptographic diffusion. Splitting a bit string (with bit length of $2n$) into two equally large bit strings $a$ and $b$ with size $n$: \begin{align} a' &= a + b & \pmod{2^n}\\ b' &...

Future Security

I get the operation. I don't get why the adjective would be "lost" and not "moved" from b to a'.

forest

I guess it'd be better to say diffusion from that bit is lost.

The bit itself is not lost in that the information is still preserved, of course.

Future Security

In hindsight and with knowledge of ARX it seems like such an insignificant detail. It's more like a bit of diffusion not gained than losing one bit.

One other thing is that it's not much diffusion and it's diffusion that only goes leftward.

forest

03:19

What do you mean? It diffuses through both a and b.

Future Security

The nth bit of input for either operand of mod pow two addition has no effect on the (n-1)th bit of output.

forest

Oh I get what you mean. That's not necessary since the only goal is to ensure that both the first and second 32-bit chunks of the right side of the input are mixed together so that, come next round, they can be mixed more thoroughly in the MDS.

I think the alternative was to use 64-bit operations and boost the number of rounds but keep the 128-bit block size which would not be ideal on the P2 or on smartcards.

It's necessarily highly linear diffusion.

Future Security

I'll need to read the details to know if it's efficient. I see the purpose, I just think an alternative using sboxs, addition, and either a rotate or right shift by 16 probably has better performance. It probably comes down to whether or not MDS is fast. I don't know how that parts implemented. I need to look. Maybe it can be combined with s-box lookup tables.

forest

MDS is implemented as a Reed-Solomon matrix.

But you're right, there are other faster alternatives of course.

Twofish was far from the fastest of the candidate ciphers.

Future Security

03:39

So both the reference code and document are on my reading list. As for my writing list... I've noticed people that don't understand ideas related to randomness, hashing, entropy seem to go way off course very early then learn more and more wrong stuff that builds on top of that.

forest

It's even worse with people who try to write their own homebrew ciphers.

Did you ever see the old mailing list post with the "Crystalline cipher"?

Future Security

Oh. No. That must have been an amazing read.

forest

@FutureSecurity mailarchive.ietf.org/arch/browse/cfrg/…

> Crystalline adopts a unique (as far as I know) approach to encryption. Rather than apply complex formulas to plaintext, Crystalline moves the location of bits and bytes based upon values from a TRNG (such as atmospheric noise). The recommended minimum key/salt length is 16KB, providing an effective key strength of 131072 bits. The key/salt size is arbitrary and can be extended to Gigabytes or a continuous random stream if necessary.

> In each round, Crystalline first swaps every bit in the file based upon values drawn from the key and salt. Before a bit is swapped, it is XOR'ed with the bit value 1. Then Crystalline erases that history by swapping every byte in the file, based upon values, drawn from the key and salt.

The whole thread is freaking hilarious.

He defines the cipher as "an information theoretically secure symmetric cipher".

Future Security

FFT. Sure. Why not? Obviously that tells you everything you need to know.

forest

> I will say one thing though, Crystalline does not make use of one-time pads that are the length of the plaintext. They can be much smaller, the reference implementation is using 16KB files but they can be any size you want. Reuse is not really an issue because the ciphertext lacks any references from which to make comparisons. That is, reusing the same key/salt in a different plaintext will not generate the same ciphertext or similar detectable patterns in the output.

From a post later in this remarkable thread.

I'm actually surprised at how much patience the (real) cryptographers there have.

Future Security

03:53

lol

forest

Like this reply mailarchive.ietf.org/arch/msg/cfrg/e-jEGddvSbManBMppC8XAc5i8GY

> I did investigate your scheme, and I'm afraid to say it's obviously broken.
It appears to be an implementation of a Knuth Shuffle with a few added
bells and whistles.

And the nice and random output of the cipher:

Even an LCG puts that to shame!

Future Security

Wow!

forest

And the cipher designer explains that it's only an issue if you don't compress the plaintext first, because compression is apparently necessary for its security!

Future Security

Remember that guy who wanted to make an encryption algorithm from 2D images of 3D rendering of chaotic attractors? How the encryption algorithm works doesn't matter guys. Just give me the answer!

forest

Wasn't that some sort of password hashing thing he wanted to make?

Ella Rose

03:57

You got me to start reading this. "Wow" doesn't do it justice!

forest

> I'm not claiming that anyone is suppressing anything, as we both know it doesn't take a genius to make an unbreakable cipher. It does, however, take some skill to develop one that is practical. But 'practical' means different things to different people and I would like to understand why the list has become dedicated to the likes of AES and Eliptic curve cryptography. Coincidently, the same techniques and ciphers being pushed by the NSA.

:D

This comparison is also remarkable mailarchive.ietf.org/arch/msg/cfrg/WQrO1cS81f-CmF1W6P5b5b_h4S8

Future Security

There are so many consistent patterns coming from people who think they've invented something entirely novel and unbreakable. Almost as if they're not as original as they think they are.

forest

> To understand the principles behind Crystalline, I would recommend brushing up on Lorenz and Enigma. Specifically, not just how they were broken, but explore the fundamental reason why, from an information theory perspective, a break can occur in the first place.

I will give everyone a clue, its has something to do with the following factors: detecting information, relating detected information and possessing enough information to begin computation.

I love that last sentence.

> I will give bonus points to anyone who can answer these set of questions: in computational/mathematical theory.

1. Given any algebraic formula, what must be induced before computation can begin or an equation solved?
2. Why?
3. What is the relationship to physics?

It's the kind of phraseology I'd imagine a "professional psychic" to use.

Biases in Crystalline:

Biases in RC4:

Future Security

It's similar to cults/religions too. I have this deep understanding of something but my understanding is something that only someone as exceptional as myself can obtain. If you follow me and dedicate your life to being worthy of learning the secret then I will till you.

forest

> It is like throwing a hand grenade at the data. There is no mathematical relationship between the location of the bits, so no formula, however complex, can be applied to recover the data. The only practical approach is to seek patterns that can identify the key. [...] In certain plaintexts such as a file filled with 0x00 you can observe some patterns when presented in images, but this as an echo of a signal that has degraded beyond the point of recovery.

@FutureSecurity Btw, if you've never seen it before: sebpearce.com/bullshit

Ella Rose

04:11

It's funny how they keep asserting "no mathematical relation", but (evidently) have no knowledge of math

forest

Yep, and just how fervently they defend their claims.

Future Security

That's new to me. I have heard about the site that they link to, wisdomofchopra

I read once (without looking into it) that computer generated poetry was the first algorithmically generated text to "pass the Turing test". Sounded plausible...

By the way, high school English teacher, the answer to "What was the author thinking about when he wrote this" is "Better finish soon. Rent's almost due."

forest

hah

My first response to people with a "new" cipher is to ask them to encrypt a gigabyte of zeros with the smallest possible null key and run statistical tests on the output.

If the output passes as randomness, toggle one bit of the key and re-encrypt and compare the difference between that output and the previous output.

99.9999% of custom amateur ciphers regardless of construction fail badly at this point and linear or differential cryptanalysis need not even be performed.

Future Security

Some of the PQC submissions don't stand up to that.

Pretty sure they would give up trying to figure out what a null key was. Or they would use one test which passed, then do no more testing because they think that one test and one test result is sufficient.

forest

04:26

Asymmetric crypto is totally different and has different requirements.

No one would criticize a key exchange algorithm that doesn't have a flat keyspace.

But I get what you mean wrt really bad test cases and C implementations in PQC.

Future Security

True. I got that from

Ever since David Wagner flipped random key bits in Hasty Pudding and found equivalent keys, I've never neglected to try this seemingly stupid test. And yet again, it yields results in.. NIST Post-Quantum Candidate KEMs called AKCN and OKCN. https://groups.google.com/a/list.nist.gov/d/msg/pqc-forum/5Lh6RteWKpY/fEQf2eEoAQAJ

Tweeted by mjos_crypto on May 26, 2018 at 7:57 PM

Not quite the same. Also

"Useful checks #1: If I encrypt that do I get the same message back"

forest

To be fair, these guys are cryptographers, not programmers.

I've seen code from papers on security where the code is designed to enable some innovative mitigation for some class of security bugs, and the code has multiple obvious security vulnerabilities (like a kernel module creating a character file that causes a NULL pointer dereference if you open it and close it without writing anything).

And, of course, code that doesn't even compile.

So unlike the equivalent keys for HPC which were a flaw in the algorithm itself, I think the PQC failures are a result of bugs in the reference implementations, not the math.

Future Security

True. I'm okay with that for asymmetric crypto. Shame a cryptographer's implementation of a symmetric algorithm. Or a design that doesn't consider performance, efficiency, or side channels.

forest

Exactly. All the mathematicians need to do is show that their algorithm's security claims are correct, and design it with operations that are efficient on hardware.

It's up to later papers to find the most clever optimizations.

Of course, a cryptographer who also knows hardware is a godsend.

Future Security

If this goes for another three weeks, we’ll have forgotten how AES works and DJB will be in charge of US encryption policy.

Tweeted by matthew_d_green on January 12, 2019 at 10:25 PM in reply to matthew_d_green

forest

04:42

Monoculture isn't ideal, but I do like DJB.

Future Security

That was while the NIST website was down due to gov shutdown.

forest

Isn't the shutdown temporarily suspended or something?

Future Security

It will be a problem again in a few weeks. Don't remember the exact date.

forest

The funny thing about the idea of a wall is just how useless it'd be.

I mean, you're severely damaging an ecosystem and harming trade between adjacent communities to put up something that can be defeated with a ladder.

Future Security

Or a saw. Or a shovel.

forest

04:46

Even without a ladder, just fly over in a Cessna.

Well to be fair, digging more than a few feet for a tunnel is difficult.

I think Trump said something along the lines of "obviously you can't fly over it".

Future Security

Contractors wouldn't dig that deep themselves to build it.

forest

Which makes absolutely no sense to me. Does he think the only aircraft in the world are run by major companies? Does he think general aviation is not a thing?

How in the world can people "obviously not fly over"?

Is it going to be taller than the flight ceiling of all but commercial jets?

I'd love to see a 25,000 foot-tall wall.

Future Security

A couple years ago there was a leak of a dozen or so wall design proposals. One was two parallel walls with a deep trench in the middle. The trench was to be filled with nuclear waste. That's how you know it's not really about "national security". (Yes, even next to river/ocean.)

forest

That's the dumbest thing I've ever heard.

Future Security

I'll be going to bed soon. Another day I want to chat about what kind of material would help with people so entrenched in misunderstandings about randomness. I think that mersenne twister guy was trying to learn and was asking genuine questions, but there was just too much he'd need to unlearn that it couldn't be addressed well in a single answer.

I know people struggle with even the very basics. I think I short circuited someone after talking about RNGs consisting of a seeding method, a state update function, and an output function.

forest

05:02

hah

Future Security

Someone on security SE today said that collisions in any hash function (not just MD5 or SHA-1) make ordinary hash functions insecure for hashing extremely strong passwords. I think the logic was that there are basically an infinite number of passwords that could each result in the same output. Since there are so many then it must be fairly easy to find one of those passwords.

It seemed like a combination of misunderstanding how hash functions work, what happens when you hash information, and a bit of the gambler's fallacy.

forest

It's not even an infinite number.

Future Security

Well they didn't actually claim that. Just that the number was huge.

I think he was using logic something like that. It's hard to get into people's heads. If those algorithms did have an infinite domain then I wonder how many tries someone would have to make to find a random pre-image password.

It sounded like similar logic to how people explain UFO sightings. The universe is so big that there must be life on other planets. Therefore aliens visit us every day.

forest

Which totally ignores things like the universe's expansion. :P

Future Security

05:20

Even if the universe was eternal and not expanding it would be a problem. We can say with near certainty that other life exists, because space is so big and life has a non-zero chance of existing. The probability that such another planet exists in the neighborhood of our star is close to zero, because life is so rare and there are so few planets within a few light-years of us.

Well maybe the visible ones are only like 1% invisible, so it's really tough to see them.

forest

:p

Future Security

There's a bit of physics overlap on the subject. People that talk about "fine tuning" of physical constants being too improbable to happen by chance. Issues: The sample size is one, the chance that our universe exists if we are able to ask that question is 100%, and people think "it wouldn't be the same if the difference in these constants was one part per billion" means I guess that our universe would only be a one in a billion chance.

forest

There's a great quote about that, but I can't find it.

It's related to the anthropic principle.

Future Security

@ me if you think of it later

Then there is Neil Degrasse Tyson's popularization of "simulation theory". (There are probably more simulated universes than real universes. There are more simulated beings than real beings. It's therefore more likely that we're simulated than that we aren't.)

forest

See also the problem of the Boltzmann brain.

Future Security

05:33

That's true. Or gravity could be fake and every person except me is part of an elaborate hoax to trick me into thinking that gravity is real. And that Earth isn't flat.

forest

One idea I had when stoned is that we're really just a dream and we're in another reality dreaming of ourselves. And when we fall asleep in this reality and dream, we actually wake up in the real reality with infinitely increased complexity. When we go to sleep in that real universe we "wake up" in this one and barely remember what happened (through incorrect memories manifest as dreams).

And when I go to sleep tonight I'll wake up in actual reality and laugh at how I thought I was awake talking online on the internet (what a silly concept, using primitive machines to communicate by touching buttons!). Then when I go to sleep I wake up here and laugh at how silly my dream was. :D

Future Security

Once on the right combination of stress and medication I had a dream that something bad was happening. Then I woke up realizing it was a dream. I go about my day and the same thing starts happening later. Then I wake up thinking I had dreamed dreaming. The process repeated itself nine levels deep before I woke up to this reality.

forest

That kind of thing has happened to me before.

The worst is when I'm extremely thirsty so I get up and get a drink, but no matter how cool the water is, it never quenches my thirst. Then I wake up in a panic with a bone dry mouth and go get a drink... same thing happens. Repeat until I wake up for real because swallowing hurts too much.

Hasn't been that bad since I was on a medication that caused dry mouth.

Future Security

Panspermia: The idea that life is too improbable to have started by itself on this planet. Therefore it didn't come from this planet. Therefore it started on another planet. (Even though most planets are a lot less habitable than our own.) Therefore it's probable that life started on some other planet, hitched a ride on an asteroid, survived the journey, hit our planet, and survived in our planet's environment which wasn't fit for any type of life we see now besides extremophiles.

forest

At least that's a falsifiable scientific theory.

Unlike supernatural creation, it's a valid argument (even if likely not sound).

Future Security

05:51

And it just looks like we have a cohesive explanation for the variety of life that fits predictions and passes any test we can think of. Because bad people want to deceive us?

forest

Well to be fair, panspermia attempts to explain abiogenesis, which is something we don't yet have any extremely solid theories for.

kelalaka

14:49

@MaartenBodewes I've Android development medium. You can sent men...

Maarten Bodewes

15:16

@kelalaka This is a tiny badlyprogrammed test. If it returns anything other than 0 before crashing then the Cipher at least doesn't crash for that version of Android

kelalaka

It can be longer no worries. Do you want it run on real or emulator?

Maarten Bodewes

Real is better, emulator suffices.

Or is it simulator?

I always manage to confuse the two ;)

Probably something in between.

Uh, cannot send files this way.

You're not on the DMZ right?

public class GCMChunkTest {
public static void main(String[] args) throws Exception
{
int tagSize = 128;
GCMParameterSpec params = new GCMParameterSpec(tagSize, new byte[12]);

Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
c.init(Cipher.DECRYPT_MODE, new SecretKeySpec(new byte[16], "AES"), params);
int updates = 10;
int chunkSize = 1024;
byte[] emptyCT = new byte[updates * chunkSize + tagSize / Byte.SIZE];
byte[] emptyPT = new byte[updates * chunkSize];
int ptOffset = 0;
for (int i = 0; i < updates; i++)

Uh, then the cipher doesn't at least buffer everything, I meant to say. BTW, I've to do a lot of different things, I'm off for now.

To anybody reading this here: please don't downvote newbe's on our site too soon. Just closing dupes is enough really, questions can be hard enough to find.

kelalaka

I'll create a simple application, and it will display the result in a textview if possible :)

Maarten Bodewes

15:31

These mod powers are handy now and then.

kelalaka

No, actually that means you are not really a mod, you are semi-mod. The real mods are the SO persons :P

Maarten Bodewes

Well, with regard to having actual power, yes. WRT to their actions now and then I sometimes wonder. But I have to be nice, as they are just about to send me some swag.

kelalaka

I've seen an example swag e-sushi's tweet.

Maarten Bodewes

Just a cap and other t-shirt this time. My other one is a bit worn. Do you have a crypto t-shirt or is that before your time?

kelalaka

I've one sometime ago from a conference but never worn it gave to someone AFAIK.

Maarten Bodewes

15:38

Ah, no, I meant for this crypto site. I'll check what I'll get. If I get any dupes I'll let you know.

Sorry, I need to do a whole lot of stuff. My family will kill me if I don't get a move on right this minute.

TTYL

kelalaka

Send me when you have time,

Maarten Bodewes

PS I'll be at the kayak club this evening, no need to hurry that Android experiment.

Oh, I'll send the file right now. No problems there.

kelalaka

Fine..

Future Security

17:09

Huh. I wonder how many applications break if Cipher is used to decrypt and authenticate. I can see someone assume that update always writes/returns the same number of bytes as requested if that number is always a multiple of the block size and they were using unauthenticated modes before. @kelalaka @MaartenBodewes

And if they think that's true then they would probably ignore the return of doFinal too.

> Upon finishing, [doFinal] resets this cipher object to the state it was in when previously initialized via a call to init. That is, the object is reset and available to encrypt or decrypt (depending on the operation mode that was specified in the call to init) more data.

So in decrypt mode does that mean replay attacks are possible? And in encrypt does that mean IV reuse if it's specified manually? API design...

Maarten Bodewes

Yeah, and reinit means you have to deliver the key as well, which could trigger either a key compare or a subkey derivation. The JCA isn't all bad, but there are certainly design issues in this age old API. Actually, I've got a list of pro's and con's already.

I've designed the Java Card API for AEAD by the way. Unfortunately even there I had to work with a Cipher object though.

Future Security

17:24

Is there a standard encrypt-then-mac mode that forces someone to do mac-then-decrypt? Like if you don't have the correct tag you cannot get the right plaintext.

SIV maybe. I forget how it works. But preferably one that one encryption/decryption pass and one mac pass.

Maarten Bodewes

Don't know, would be a perfect question for the site, actually.

Of course, it would need to be a full 2 pass offline protocol in all probability.

Uh, I meant "the opposite of real time" where I wrote "offline"

Shouldn't be too hard to design, you create a MAC where one calculation leads to a counter and the other leads to the authentication tag.

Or some kind of nonce or tweak anyway, counter is possibly a problem with regards to collisions.

Future Security

I was thinking of using HMAC. One for ciphertext authentication and one used to encrypt the IV. Probably XEX encryption of the IV. But that doesn't authenticate the encryption IV.

Maarten Bodewes

Hmm. Simply extending GCM would work. You extend GMAC, first generate a nonce, then do an additional calculation to generate the tag :)

If you first generate the nonce then continue the calculation then the nonce is probably automatically authnenticated.

You can always reinsert the IV after calculating it.

in the MAC. Gotta run, later!

Future Security

Later

Maarten Bodewes

Pretty please with sugar on top, post this question!

After checking for dupes of course (sorry, I'm mod now :) )

Maarten Bodewes