Chapter 23 — Cryptography and trust services: methods I

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 Authenticated encryption"]
  N2["23.2 Nonce rules"]
  N3["23.3 Choosing parameters"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 Authenticated encryption"]
  N2["23.2 Nonce rules"]
  N3["23.3 Choosing parameters"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 Authenticated encryption]
    |
    v
[23.2 Nonce rules]
    |
    v
[23.3 Choosing parameters]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) apply authenticated encryption correctly; (2) understand nonces and their rules; (3) choose AES-GCM parameters from standards.

23.1 Authenticated encryption

Authenticated encryption combines confidentiality and integrity: decryption fails if the ciphertext was changed. AES-GCM, specified in SP 800-38D using AES from FIPS 197, is the most widely used scheme. Priya learns its interface: a key, a unique nonce, the plaintext and optional associated data, which is authenticated but not encrypted, such as a record identifier. Including the identifier as associated data prevents an attacker from swapping encrypted records between patrons without detection. Priya demonstrates on synthetic records that changing the identifier makes decryption fail, which convinces sceptical colleagues.

23.2 Nonce rules

GCM requires that a nonce never repeat under the same key. A repeat lets an attacker learn the XOR of two plaintexts, as with the reused pad in Chapter 1, and forge messages. SP 800-38D allows either counters, which must never reset, or random 96-bit nonces, limited to about 2^32 encryptions per key. Priya recommends random nonces generated by the library together with key rotation well before that limit. She checks that Tidewell's export tool never constructs nonces itself. She documents the rule in the code review checklist.

23.3 Choosing parameters

Priya writes a parameter note for Tidewell: AES-256-GCM, 96-bit nonces generated by the library, 128-bit authentication tags, associated data containing the record type and identifier, and keys rotated yearly or after a set number of encryptions. Each choice cites SP 800-38D or SP 800-57. She notes that the library's high-level recipe already chooses most of these, which is the point: engineers should verify parameters, not invent them. Grace files the note with the system documentation, and Priya schedules a yearly review to confirm that the parameters still match current guidance.

Worked example

Priya specifies AES-256-GCM with library-generated 96-bit nonces, full tags and associated data binding records to patrons, citing SP 800-38D.

Synthetic case. The parameter note is invented; SP 800-38D and FIPS 197 are real.

Errors and limits

Nonce reuse breaks GCM badly. Associated data must be identical at encryption and decryption.

Exercises

• EX067 — Associated data. Why include the record identifier as associated data?
  Show marking criteria

  Rubric: 3 = to stop encrypted records being swapped between patrons undetected;; 2 = binding;; 1 = encrypts it;; 0 = none.
• EX068 — Random nonce limit. What limit applies to random 96-bit GCM nonces?
  Show marking criteria

  Rubric: 3 = about 2^32 encryptions per key;; 2 = limit;; 1 = vague;; 0 = none.
• EX069 — Parameter source. Why does Priya call verifying parameters the point?
  Show marking criteria

  Rubric: 3 = engineers should verify, not invent, parameters; recipes choose most;; 2 = verify;; 1 = invent;; 0 = none.

Synthesis

Authenticated encryption with unique nonces and bound associated data protects records when parameters follow standards.

Continue studying — chapter 23 of 40

← Chapter 22 (draft) · Course chapter index · Chapter 24 (draft) →