Example situation where an authentication tag can prevent an attack?

Ma Joad

4/9/24, 10:01 AM

In Authenticated Encryption, we use an authentication tag to make sure the message is not tampered. The authentication tag can prevent any random bytes sent by the attacker being decrypted by the receiver.

The question is: what sorts of attack (other than sending lots of meaningless random bytes) is the authentication going to prevent? If all the attacker does is to send random bytes, is it possible for the attacker to somehow get information about the key or the encryption scheme?

1 + 1

authenticated-encryption

DannyNiu

4/9/24, 11:23 AM

Have you seen [this Handwiki article section](https://handwiki.org/wiki/Security%20of%20Transport%20Layer%20Security#BEAST_attack)? Or do you prefer an equivalent link on Wikipedia?

Score:4

Crypto

bk2204

4/9/24, 5:22 PM

Let's pretend we were using TLS, but with AES-CTR (with no MAC) instead of AES-GCM. AES-CTR is essentially a stream cipher, such that there's a keystream, generated by encrypting an incrementing counter with AES, and a plaintext, which are XORed together to get the ciphertext.

In this design, as with most stream ciphers, the attacker can modify the plaintext in as many bits as they like by simply flipping the bits in the ciphertext. That means that if we know the user is sending a GET request, we can change that to a PUT request simply by XORing the ciphertext with the result of GET XOR PUT. In addition, if we know the amount of data being sent (or whether this is the first request being made), we may be able to guess which page the client was on, in which case we might be able to change the contents of the page to load malicious JavaScript instead of the intended JavaScript.

In addition, in some cases, one of the machines acts as an oracle for us. For example, if I connect to machine A to make a request and it makes a request to machine B, sometimes if I tamper with the data, I can get machine A to return an error message which might contain secret information (say, the invalid session ID that I tampered with). In such a case, I could determine a valid session ID by determining which bytes I tampered with and then make requests to machine B without actually being authorized to do so.

All of these attacks can be applied to almost all other non-AEAD stream ciphers, such as ChaCha20 and the obsolete RC4, as well. They are all practical attacks in many cases, and they are all defeated using an AEAD or a MAC. As mentioned by DannyNiu in the comments, there are also interesting attacks on AES-CBC, such as the BEAST attack.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Example situation where an authentication tag can prevent an attack?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.