[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: SHA-256/384/512
In message <NDBBIBHFGLMFGJLIBOBMKEJLCCAA.jharwood@vesta-corp.com>, "Joseph D. H
arwood" writes:
>A related question about AES counter mode for encryption with AES-MAC for
>authentication...
>
>The slides proposed AES counter mode so data blocks could be encrypted in
>parallel (unlike CBC, which requires the results from block N before
>beginning encryption of block N+1). If I remember correctly, MAC
>authentication would be encrypting every block via AES using some sort of
>feedback, and using the final ciphertext as the authentication data.
>Something like:
>
>Hash[n+1] = Block[n+1] ^ Encrypt(Data = Block[n+1],Key = Hash[n])
>AES-MAC == Hash[Last Block]
>
>This means AES-MAC for authentication would have a similar performance to
>AES-CBC for encryption, so there wouldn't be an overall performance
>advantage in using AES counter mode with parallel hardware for encryption.
>Is this correct?
Yes -- I raised precisely this objection to counter mode, both at the
IPsec wg meeting and at the NIST Modes of Operation workshop.
--Steve Bellovin, http://www.research.att.com/~smb
Follow-Ups: