Cryptography · Cluster
Modes and Authentication
AEAD, nonces, and misuse resistance.
- 01 What a Block Cipher Mode Adds to a Block Cipher How chaining turns a single-block permutation into a construction for arbitrary-length data, why the initialization vector must be unpredictable rather than merely unique, and what error propagation costs.
- 02 How a Padding Check Becomes a Decryption Oracle Byte-at-a-time plaintext recovery against CBC from a single bit of observable padding validity, the arithmetic that makes it work, and why constant-time unpadding does not close the hole.
- 03 Counter Block Layout and the Nonce Budget in CTR Mode How CTR turns a block cipher into a stream cipher, why the counter block must never repeat across messages under one key, and how the split between nonce and counter fixes the maximum message length.
- 04 Recovering the GCM Authentication Key from a Repeated Nonce Two messages encrypted under the same GCM nonce turn the tag difference into a polynomial in the hash subkey, whose roots yield the key and permit arbitrary forgery.
- 05 GHASH and the Structure of a GCM Tag Why the authenticator is a polynomial evaluation in a binary field rather than a chained MAC, how the length block prevents padding ambiguity, and what tag truncation costs in forgery probability.
- 06 SIV and the Two-Pass Design of a Misuse-Resistant AEAD How deriving the nonce from the plaintext with a keyed hash removes the catastrophic failure of nonce reuse, at the cost of a second pass and the loss of streaming encryption.
- 07 CCM: Combining a MAC and a Counter Inside One Mode How CCM derives a CTR nonce, a CBC-MAC IV, and a length-encoded authentication header to authenticate before encrypting, and what the two passes and the 16-byte block size cost.
- 08 The Release of Unverified Plaintext Problem in AEAD APIs Why a decryption function that returns plaintext before the tag is checked reintroduces chosen-ciphertext attacks, and how streaming interfaces force the verification decision into the caller.
- 09 Key Commitment and Why an AEAD Can Decrypt Under Two Keys AEAD schemes are not committing by default, so a ciphertext forged to verify under two different keys splits the receiver into two views of the same message, with consequences for key rotation and message franking.
- 10 Tweakable Encryption with XTS and the Limits of Length-Preserving Disk Encryption How sector encryption binds ciphertext to its disk location without expanding it, why XTS carries no integrity and what that permits an attacker with write access, and how tweak and key layout are fixed by the standard.