Presumably an entirely trivial question: Is it good, bad or
neutral to employ a key to encrypt a value that is unique
to each message (e.g. a composition of time and message no.)
and use that as the key for doing the actual encryption of
the message? (This could have the merit of automatically
keeping the volume of text that is encrypted by any
particular key to a quite limited value practically.)

"Mok-Kong Shen" <mok-kong.shen@t-online.de> wrote:

Presumably an entirely trivial question: Is it good, bad or
neutral to employ a key to encrypt a value that is unique
to each message (e.g. a composition of time and message no.)
and use that as the key for doing the actual encryption of
the message? (This could have the merit of automatically
keeping the volume of text that is encrypted by any
particular key to a quite limited value practically.)

Typically you re-key as often as practical (i.e. every new session, every
2^20 packets or whatever).
Normally the MAC and Encrypt keys are different but derived from a master
key. I use a hash to accomplish this in the software I write. E.g.

Hk = HASH(k || "hmac")
Ek = HASH(k || "encrypt")

That way compromising one key won't reveal the other [easily].

Tom St Denis wrote:

"Mok-Kong Shen" <mok-kong.shen@t-online.de> wrote:

Presumably an entirely trivial question: Is it good, bad or
neutral to employ a key to encrypt a value that is unique
to each message (e.g. a composition of time and message no.)
and use that as the key for doing the actual encryption of
the message? (This could have the merit of automatically
keeping the volume of text that is encrypted by any
particular key to a quite limited value practically.)

Typically you re-key as often as practical (i.e. every new session,
every
2^20 packets or whatever).
Normally the MAC and Encrypt keys are different but derived from a
master
key. I use a hash to accomplish this in the software I write. E.g.

Hk = HASH(k || "hmac")
Ek = HASH(k || "encrypt")

That way compromising one key won't reveal the other [easily].

A related question: Isn't it that, through limiting
the materials encrypted by one key to sufficiently
small quantity, one is safe against attacks that needs
fairly huge amounts of materials for success?

Presumably an entirely trivial question: Is it good, bad or
neutral to employ a key to encrypt a value that is unique
to each message (e.g. a composition of time and message no.)
and use that as the key for doing the actual encryption of
the message? (This could have the merit of automatically
keeping the volume of text that is encrypted by any
particular key to a quite limited value practically.)

Mok-Kong Shen <mok-kong.shen@t-online.de> wrote:

Presumably an entirely trivial question: Is it good, bad or
neutral to employ a key to encrypt a value that is unique
to each message (e.g. a composition of time and message no.)
and use that as the key for doing the actual encryption of
the message? (This could have the merit of automatically
keeping the volume of text that is encrypted by any
particular key to a quite limited value practically.)

It is as you noted the solution is marginally good, as it limits the
available ct/pt pairs available. I suspect that unless you have some
exotic requirements that it is entirely neutral, simply because the
required texts to break a modern cipher would take up an insane amount
of space. The biggest question is: How paranoid are your users? Using
the time should help address their paranoia, something I've concluded
is what most encryption advancements are actually used for.

I didn't say that the utility is marginal. If I may
express my own opinion, I think that, if the currently
best known analytical attack of a cipher requires 2^m
units of pt and/or ct, then setting a factor of safety
of 2^s (say, s=15) would allow a maximum of 2^(m-s)
units being used without changing of the message key.
That would mean that even certain block ciphers that
are considered broken could still quite well be used.
Anyway, on the other hand, for an intact and not yet
broken cipher, having a simple and cheap automatic
mechanism that fairly effectively guards against too
much material being processed by any single encryption
key does seem to be something worthwhile of consideration.

[snip]
The accepted standard for a cipher is 2^{m/2} for a m-bit block. For
instance, AES is considered safe upto 2^64 blocks in CBC.

Presumably an entirely trivial question: Is it good, bad or
neutral to employ a key to encrypt a value that is unique
to each message (e.g. a composition of time and message no.)
and use that as the key for doing the actual encryption of
the message?

Mok-Kong Shen<mok-kong.shen@t-online.de> wrote:

Presumably an entirely trivial question: Is it good, bad or
neutral to employ a key to encrypt a value that is unique
to each message (e.g. a composition of time and message no.)
and use that as the key for doing the actual encryption of
the message?

Well, it is possible that an adversary would guess the time and
message number. So as you have outlined it, the scheme could be bad.

If one used a truly random session key to actually encrypt the
message, and used a key-exchange key to encrypt the session key, that
would be good, since the amount of known plaintext for any one key is
minimized.

But the said unique value is encrypted (by a master key)
to become a key that is used in the proper encryption.

Could you give some references of such opinions? How
about the case of ECB (which I suppose is what the
figures of analytical attacks refer to) that should
anyway provide a lower bound? Thanks.

In article <3FE94DA5.E53BE50C@t-online.de>,
Mok-Kong Shen <mok-kong.shen@t-online.de> wrote:
Could you give some references of such opinions? How
about the case of ECB (which I suppose is what the
figures of analytical attacks refer to) that should
anyway provide a lower bound? Thanks.

ECB is unsafe at any speed, as Mok-Kong damn well
knows.

Gregory G Rose wrote:

In article <3FE94DA5.E53BE50C@t-online.de>,
Mok-Kong Shen <mok-kong.shen@t-online.de> wrote:
Could you give some references of such opinions? How
about the case of ECB (which I suppose is what the
figures of analytical attacks refer to) that should
anyway provide a lower bound? Thanks.

ECB is unsafe at any speed, as Mok-Kong damn well
knows.

But, the materials needed for analytical attacks
is therefore likely to be of smaller quantity than
other better modes and this would hence lead to a
ower estimate of the number of units of plaintexts to
be encrypted before a change of key is required.
This way, one would get a figure that is conservative
and applicable for all modes, I suppose.

On Wed, 24 Dec 2003 14:11:11 +0100, Mok-Kong Shen
mok-kong.shen@t-online.de> wrote, in part:

But the said unique value is encrypted (by a master key)
to become a key that is used in the proper encryption.

I am sorry that I failed to read your post carefully. Yes, if the time
and message number are transmitted in the clear, but their encryption
by the master key is used as the key, that is acceptable.

John Savard
http://home.ecn.ab.ca/~jsavard/index.html