From 32137f612509ee577703d4316dc6a2ec937da709 Mon Sep 17 00:00:00 2001 From: cyfraeviolae Date: Tue, 23 Aug 2022 23:16:44 -0400 Subject: work --- index.html | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) (limited to 'index.html') diff --git a/index.html b/index.html index 7b4572b..1fd52b1 100644 --- a/index.html +++ b/index.html @@ -35,10 +35,10 @@ Choose one of the following missions.

- Nonce reuse. Due to rising entropy - prices, Roseacrucis has started to reuse nonces. You must perform the - Forbidden Attack in order to recover the authentication key and - forge arbitrary ciphertext. + Nonce + reuse. Due to rising entropy prices, Roseacrucis has + started to reuse nonces. You must perform the Forbidden Attack in order to + recover the authentication key and forge arbitrary ciphertext.

Nonce truncation. The sorcerer @@ -82,7 +82,7 @@ interpreted as the set of polynomials with coefficients in \(\mathbb{F}_2\) of degree less than \(128\). Multiplication is performed modulo \(m\). This field is of characteristic 2; - e.g., \((\alpha^5 + \alpha+1)+(\alpha^5 + \alpha+1) = 0\). + e.g., \((\alpha^5 + 1)+(\alpha^5 + 1) = 0\).

We interpret 16-byte blocks as elements in \(\mathbb{K}\) @@ -95,40 +95,40 @@ the block.

- 12-byte nonces are interpreted as 96-bit integers in big-endian byte order. -

+ 12-byte nonces are interpreted as 96-bit integers in big-endian + byte order. Let \(\operatorname{Byte} = [0, 2^8-1]\) and + \(x_i\) refer to the \(i\)th 16-byte chunk of the bytestring + \(x\). +

- Let \(\operatorname{Byte} = [0, 2^8-1]\). + \(\operatorname{encode_{big}}(x, n)\) encodes an integer \(x\) into \(n\) bytes in big-endian + byte order. \(\operatorname{pad_n}(x, p)\) pads the length of + the bytestring \(x\) to the nearest multiple of \(n\) with the + byte \(p\). \(\operatorname{AES}(k, x)\) refers to + the 128-bit AES block cipher.


\(\operatorname{GMAC}(h\in \mathbb{K}, s\in \mathbb{K}, aad\in \operatorname{Byte}^{y}, c\in \operatorname{Byte}^{z})\)

    -
  1. \( aad' = \operatorname{chunk}_{16}(aad, \operatorname{pad}=\mathtt{0x00}) \)
    2. -
  2. \( c' = \operatorname{chunk}_{16}(c, \operatorname{pad}=\mathtt{0x00}) \)
    3. -
  3. \( len = \operatorname{encode_{big}}(128\vert aad' \vert, 8) \mathbin\Vert \operatorname{encode_{big}}(128\vert c'\vert, 8) \)
    4. -
  4. \( blocks = aad' \mathbin\Vert c' \mathbin\Vert (len) \mathbin\Vert (s) \)
    5. -
  5. \( \operatorname{return} \sum\limits_{i=1}^{\vert blocks\vert} blocks_{\vert blocks \vert-i} h^{i-1}\)
    6. +
  6. \( len = \operatorname{encode_{big}}(8y, 8) \mathbin\Vert \operatorname{encode_{big}}(8z, 8) \)
    7. +
  7. \( blocks = \operatorname{pad}_{16}(aad, 0) \mathbin\Vert \operatorname{pad}_{16}(c, 0) \mathbin\Vert len \mathbin\Vert s \)
    8. +
  8. \( N = \frac{\vert blocks \vert}{16} \)
    9. +
  9. \( \operatorname{return} \sum\limits_{i=1}^{N} blocks_{N-i} h^{i-1}\)


-

\(\operatorname{GCM}(k\in \operatorname{Byte}^{16}, n\in \operatorname{Byte}^{12}, aad\in \operatorname{Byte}^{y}, m\in \operatorname{Byte}^{z})\)

+

\(\operatorname{AES-GCM}(k\in \operatorname{Byte}^{16}, n\in \operatorname{Byte}^{12}, aad\in \operatorname{Byte}^{y}, m\in \operatorname{Byte}^{z})\)

    -
  1. \( r = \mathop{\Vert}\limits_{n'=2^{32}n+2}^{2^{32}n+2^{32}-1} \operatorname{AES-ECB}(k, n') \)
    2. +
  2. \( r = \mathop{\Vert}\limits_{n'=2^{32}n+2}^{2^{32}n+2^{32}-1} \operatorname{AES}(k, n') \)
  3. \( c = r \oplus m \)
    4. -
  4. \( h = \operatorname{AES-ECB}(k, 0) \)
    5. -
  5. \( s = \operatorname{AES-ECB}(k, 2^{32}n + 1) \)
    6. +
  6. \( h = \operatorname{AES}(k, 0) \)
    7. +
  7. \( s = \operatorname{AES}(k, 2^{32}n + 1) \)
  8. \( \operatorname{return} c, \operatorname{GMAC}(h, s, aad, c) \)
-

- The authentication key \( h \) is independent of the - nonce \( n \). The constant term \( s \) acts as a blind to - hide the confidential block data in the MAC. Finally, note - that the polynomial computation reverses the order of the blocks. -

-- cgit v1.2.3