3

Suppose I have x = <64 bits of data>. I build a 128 bit block $P = x || x$, and transmit a message $M = AES(K, P)$. The receiver has the same $K$.

The receiver can then decrypt the message, split the decrypted block in two 64 bits parts, and comparing them for equality. What kind of guarantee would the equality check provide? Would they be able to securely authenticate the message?


Edit: as stated in a couple answers, the $x||x$ concatenation is a red herring. The scheme looks equivalent to padding x to 128 bits with all zeroes, then checking the decrypted block for the same sequence.

Davide R.
  • 131
  • 2

2 Answers2

1

Concatenating two copies of your message is unnecessary and is equivalent to padding out your 64 bit message to the full 128 bits with zeros from a security standpoint (which happens automatically in the encryption process).

Would they be able to securely authenticate the message?

I assume you mean Authenticated Encryption. The simple answer is no. AES on its own only provides provides confidentiality, not Authenticated Encryption (which is defined as confidentiality, integrity, and authenticity). To get true Authenticated Encryption you would need to use some sort of hash function to create and append a mac, which is validated during the decryption process.

More information on Authenticated Encryption can be found here.

EDIT: Sorry I was making a few assumptions about other concepts outside the scope of this question. The reason why simply encrypting one block of AES doesn't give you integrity or authenticity is because it is susceptible to modification by an active attacker. One way this would work is actually pretty simple, but it assumes you would also use an Initialization Vector (IV). While not specifically stated in your question, this would be required to make the message resistant to Replay Attacks and is the only way a block cipher is CPA secure.

Assuming CBC mode, the IV is XOR'd over the plain text before encryption. If you were to XOR what you think is in the plain text (a guess), then XOR what you want to be in the plain text, it will be XOR'd into the plain text before it is encrypted, thus modifying it to whatever the attacker wants. Other modes could be venerable to attacks like this also.

You could also use this method and the fact that the first 64 bits of the message should match the second 64 bits as a oracle where by you could test one character at a time and watch what response a server gives back to actually decode the message.

DuneWalker
  • 29
  • 3
-1

Sorry for not being specific (as I don't know that much about AES itself) but you should go with RSA for messages, generally asymmetric encryption is great, but slow. The best solution is to encrypt AES password with RSA (pgp for example) and then use this password to encrypt messages. This way you can share passwords in safe way.

And pgp allows source verification, that makes best solution for you.

Chlorek
  • 9
  • 1