2

Is SIV mode variant equally secure, if you replace CTR mode encryption with full-block CFB mode encryption?

CFB seems to be safe with predictable IV: Is using a predictable IV with CFB mode safe or not?

But is it safe with Encrypt-and-MAC like construction as SIV?

LightBit
  • 1,649
  • 13
  • 27
  • I don't know if it matters much, but do you have a specific MAC(-like) construction in mind? By itself CFB doesn't produce an authentication tag that can double as synthetic IV. – Maarten Bodewes Jul 10 '21 at 17:18
  • 1
    SIV usualy has CMAC. – LightBit Jul 10 '21 at 18:09
  • SIV usually also uses two separate keys (although they define those as one key, yuk). In that case the synthetic IV / tag would be fully differentiated from the cipher. This is why I'm asking, as otherwise we may have to assume MAC's that use the same keyed permutation and may possibly interfere with the security of CFB. – Maarten Bodewes Jul 10 '21 at 20:39
  • Yes, keys must be different for MAC and encryption. Problem is I don't know why SIV is secure while other Encrypt-and-MAC usually aren't. Maybe it is because IV is unprotected by MAC and you can change IV, which does not work in SIV because it is MAC at the same time. Am I right? – LightBit Jul 10 '21 at 22:03
  • 1
    You can see the 4 points about encrypt-and-MAC here. CFB is a stream mode so there shouldn't be any errors during decryption (e.g. padding oracle attacks should not be possible). Of course you should not use the plaintext without verifying but that's always the case. Completely repeated messages would of course show up, but that's an expected outcome. Otherwise I think it should be similar to CTR except that you cannot parallelize encryption. – Maarten Bodewes Jul 10 '21 at 22:19

1 Answers1

0

I have found this IETF expired draft.

It says:

E must be a length-preserving semantically-secure encryption scheme.

Also considering comments. I believe CFB or OFB can also be used in SIV.

ECB or CBC (without ciphertext stealing) would not be secure, because of padding which can cause errors while decrypting (not length-preserving).

LightBit
  • 1,649
  • 13
  • 27