Subject: [lamps] MAC (or ICV) generation

From: "Erik Andersen" <[email-masked]>
Date: Thu, 30 Apr 2020 09:12:37 +0200

What is best when generating a MAC (also called Integrity Check Value or
ICV) over an PDU to be encrypted: Generating the ICV over the clear text or
over the encrypted text?

Best regards,

Erik

---

From: Russ Housley <[email-masked]>
Date: Thu, 30 Apr 2020 09:23:14 -0400

If you use an AEAD, the encryption and integrity check are one operations, but the authentication tag (a.k.a. ICV) needs to have a place to be carried in the PDU.

If you are using separate encryption and integrity algorithms, you will find HMAC, CMAC, KMAC, and GMAC in use in different contexts.  There are probably more.

Russ

> On Apr 30, 2020, at 3:12 AM, Erik Andersen <[email-masked]> wrote:
> 
> What is best when generating a MAC (also called Integrity Check Value or ICV) over an PDU to be encrypted: Generating the ICV over the clear text or over the encrypted text?
>  
> Best regards,
>  
> Erik

---

From: "Erik Andersen" <[email-masked]>
Date: Thu, 30 Apr 2020 16:39:49 +0200

Hi Russ,

Thanks for the information. However, that was not my question.

Erik 

From: Russ Housley <[email-masked]> 
Sent: 30 April 2020 15:23
To: Erik Andersen <[email-masked]>
Cc: LAMPS <[email-masked]>
Subject: Re: [lamps] MAC (or ICV) generation

If you use an AEAD, the encryption and integrity check are one operations,
but the authentication tag (a.k.a. ICV) needs to have a place to be carried
in the PDU.

If you are using separate encryption and integrity algorithms, you will find
HMAC, CMAC, KMAC, and GMAC in use in different contexts.  There are probably
more.

Russ

On Apr 30, 2020, at 3:12 AM, Erik Andersen <[email-masked] <mailto:[email-masked]>
> wrote:

Best regards,

Erik

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 30 Apr 2020 14:45:31 +0000

https://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac

---

From: "Erik Andersen" <[email-masked]>
Date: Thu, 30 Apr 2020 17:37:40 +0200

Thanks Rich, just what I need.

Erik

From: Salz, Rich <[email-masked]> 
Sent: 30 April 2020 16:46
To: Erik Andersen <[email-masked]>; LAMPS <[email-masked]>
Subject: Re: [lamps] MAC (or ICV) generation