[Cfrg] Possible RFC: Data integrity combined with encryption

[[e-mail] (Terry Hayes)]

The current discussion on this list about the security of OpenPGP is covering an interesting set of topics relating to protocols that try to provide both encryption and integrity.  I think this group could provide valuable information to IETF by creating an RFC that describes the best current practices in this area.

Right now it is difficult for designers to get good information on how to build protocols that provide both encryption and integrity.  In fact, some of the best known sources of information about cryptographic algorithms seem to provide methods that are now believed to be incorrect.  For example, Handbook of Applied Cryptography (Menezes, van Oorschot and Vanstone) contains a section in Chapter 9 called "Data integrity using encryption and an MDC".  This section essentially describes the method proposed in OpenPGP.  While it does include remarks about the dangers of using this method with stream ciphers in situations where there is known plaintext, the overall impression is that it is always good method when used with block ciphers in CBC mode. The RFC might describe what steps should to be taken to use this method in a protocol (if it is possible at all).

The following section in HAC describes including a MAC to provide integrity.  However it describes the method of including the MAC inside the encrypted data, computed on the plaintext.  Hugo Krawczyk's work on the order of encryption and authentication shows that reversing these might be better.  The RFC might describe the preferred method (encrypt then authenticate) and indicate when it would be safe or more appropriate to do something else (if ever).

I have quite often heard the mantra "sign and then encrypt".  Applying this rule leads to designs like authenticate-then-encrypt.  The RFC might describe situations where signing first is important, and distinguish them from the cases where encrypt-then-authenticate is the preferred thing to do.

Finally, there are new modes under consideration (such as OCB and CCM) that provide both encryption and integrity.  The RFC might mention these new modes, and possibly recommend one that should be used.

I would find an RFC that covers these issues very useful.  What do others think?

Terry Hayes
[e-mail]
_______________________________________________ Cfrg mailing list [e-mail] https://www1.ietf.org/mailman/listinfo/cfrg