Stream Cipher Message Authentication Tag Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for authenticating plaintext messages over insecure channels are inefficient and vulnerable to attacks, particularly in high-speed networks, as they require significant processor cycles and are not energy-efficient, and existing stream cipher-based techniques are difficult to provide message authentication codes (MACs) due to their vulnerability to differential attacks.
Innovation Solution
A method and system that prepend a random string to the plaintext message, generate a ciphertext using an encryption algorithm, and create an authentication tag from the compressed image of the message and the random string, allowing for efficient authentication and verification of message integrity and authenticity at both sender and receiver devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If block cipher based MAC algorithms (CBC-MAC, CMAC) are used to authenticate messages, then message integrity and authenticity are preserved, but the authentication process requires significant processor cycles and is not energy-efficient
Solution Approach 1:
The message is divided into multiple blocks for processing. The authentication tag is computed by processing each block sequentially through the stream cipher, accumulating the authentication value block by block. This segmentation allows the system to use a more efficient stream cipher approach rather than requiring full block cipher operations on the entire message.
Solution Approach 2:
The patent replaces block cipher based MAC computation with a stream cipher based approach. Instead of using computationally intensive block cipher operations (CBC-MAC, CMAC), the system uses stream cipher keystream generation and XOR operations, which are significantly faster and more energy-efficient while maintaining security through the use of a secure stream cipher.
2Productivity
If universal hash function families are used for MAC generation, then authentication speed is improved, but the secret hashing key is exposed and security is compromised
Solution Approach 1:
The patent introduces a stream cipher keystream as an intermediary between the secret key and the message authentication process. The keystream is generated using a secure stream cipher algorithm that protects the secret key, and this keystream is then used to compute the authentication tag through XOR operations on message blocks. This intermediary mechanism allows fast authentication while maintaining key security.
Solution Approach 2:
The patent changes the fundamental parameter of the authentication mechanism from using universal hash functions (which expose keys) to using stream cipher keystreams (which protect keys). This parameter change maintains authentication speed by using efficient stream cipher operations while resolving the security vulnerability of key exposure inherent in universal hash function approaches.
3Speed
If stream cipher based encryption is used to provide confidentiality, then high-speed operation and lightweight hardware implementation are achieved, but the technique is vulnerable to differential attacks and difficult to provide MAC function
Solution Approach 1:
The patent applies preliminary processing to the message blocks before the final authentication verification. Each message block is XORed with the corresponding keystream block during the authentication tag computation process. This preliminary action with the keystream creates a secure transformation that protects against differential attacks while maintaining the speed advantages of stream cipher operations.
Solution Approach 2:
The patent maintains continuous useful action by using the same stream cipher keystream for both confidentiality encryption and authentication tagging. The keystream generation continues throughout the message processing, and the authentication tag is computed as a continuous function of the message blocks and keystream, eliminating gaps in protection and maintaining high-speed operation throughout the entire message processing pipeline.
Data Source
AI summary
The invention provides a method and system for authenticating a plaintext message at a sender computing device and verifying the integrity and authenticity of the plaintext message at a receiver computing device. Firstly, the method includes prepending a random string to the plaintext message and then generating a ciphertext corresponding to the plaintext message by encrypting the plaintext message prepended with the random string using an encryption algorithm. The method also includes the step of generating a compressed image of the plaintext message and generates an authentication tag from the compressed image of the plaintext message and the random string. Thereafter, the method transmits both the ciphertext and the authentication tag generated at the sender computing device to the receiver computing device. The receiver computing device, on receiving the ciphertext and the authentication tag corresponding to the plaintext message, verifies the integrity and authenticity of the plaintext message.