A Critique of CCM.

IACR Cryptology ePrint ArchivePublished 1 January 2003

Phillip Rogaway, David Wagner

Citations28

TL;DR

This note points out a number of limitations of CCM, and a related note provides an alternative to CCM.

Abstract

CCM is a conventional authenticated-encryption scheme obtained from a 128-bit block cipher. The mechanism has been adopted as the mandatory encryption algorithm in an IEEE 802.11 draft standard [15], and its use has been proposed more broadly [16, 17]. In this note we point out a number of limitations of CCM. A related note provides an alternative to CCM [5].

Keywords

Computer Science

Journal of CryptologyAuthenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm

641 Citations2008Mihir Bellare, Chanathip Namprempre

This work considers two possible notions of authenticity for authenticated encryption schemes, namely integrity of plaintexts and integrity of ciphertexts, and relates them to the standard notions of privacy IND-CCA and NM-CPA by presenting implications and separations between all notions considered.

View PDF

Journal of Computer and System SciencesThe Security of the Cipher Block Chaining Message Authentication Code

600 Citations2000Mihir Bellare, Joe Kilian +1 more

A technical lemma of independent interest is bounding the success probability of a computationally unbounded adversary in distinguishing between a random ml-bit to l-bit function and the CBC MAC of a random l- bit to l -bit function.

Authenticated-encryption with associated-data

434 Citations2002Phillip Rogaway

This paper formalizes and investigates the authenticated-encryption with associated-data (AEAD) problem, and studies two simple ways to turn an authenticated-Encryption scheme that does not support associated- data into one that does: nonce stealing and ciphertext translation.

Lecture notes in computer scienceThe Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?)

388 Citations2001Hugo Krawczyk

It is shown that any secure channels protocol designed to work with any combination of secure encryption (against chosen plaintext attacks) and secure MAC must use the encrypt-then-authenticate method.

View PDF

OCB

362 Citations2001Phillip Rogaway, Mihir Bellare +2 more

It is proved OCB secure, quantifying the adversary's ability to violate the mode's privacy or authenticity in terms of the quality of its block cipher as a pseudorandom permutation (PRP) or as a strong PRP, respectively.

Counter with CBC-MAC (CCM)

327 Citations2003Doug Whiting, R. Housley +1 more

Counter with CBC-MAC (CCM) is a generic authenticated encryption block cipher mode for use with 128-bit block ciphers, such as the Advanced Encryption Standard (AES).

Lecture notes in computer scienceEncode-Then-Encipher Encryption: How to Exploit Nonces or Redundancy in Plaintexts for Efficient Cryptography

190 Citations2000Mihir Bellare, Phillip Rogaway

This work investigates the following approach to symmetric encryption: first encode the message via some keyless transform, and then encipher the encoded message, meaning apply a permutation FK based on a shared key K.

Lecture notes in computer scienceCBC MACs for Arbitrary-Length Messages: The Three-Key Constructions

188 Citations2000John Black, Phillip Rogaway

View PDF

Journal of CryptologyCBC MAC for Real-Time Data Sources

144 Citations2000Erez Petrank, Charles Rackoff

A rigorous proof that the basic CBC MAC is secure when applied to a prefix-free message space is argued, which is virtually as simple and as efficient as computing the standard CBC MAC on the message.

View PDF

Authenticated encryption in SSH

110 Citations2002Mihir Bellare, Tadayoshi Kohno +1 more

This paper proposes several fixes to the SSH protocol and, using techniques from modern cryptography, proves that their modified versions of SSH meet strong new chosen-ciphertext privacy and integrity requirements.