ISO 20215 pdf download – Space data and information transfer systems -cCSDs cryptographical gorithms.
A cipher-based MAC can be constructed instead of a hash-based MAC. The cipher-based MAC uses a cryptographic algorithm (e.g., AES). The shared secret is used as the cryptographic key for the cryptographic algorithm which provides a MAC as a result. Cipher-based MACs may make belier use of available resources when both authentication and confidentiality are required because a single algorithm can be used for both. In addition. ciphcr.based MACs may be more casily implemented in hardware than hash.bascd MACs.
2.3.3 I)IGITAI. SIGNATURE BASED AUTHENTICATION
For environments where publicprivate key cryptography is available, authentication and integrity may be accomplished using a digital signature algorithm reference [j).
The ‘signer’ (originator) performs a hash over the data to be signed using a hash algorithm (e.g., Secure Hash Algorithm [reference [lOjj). The resultant hash word is then encrypted using the signer’s private key to create the digital signature.
Thc rcccivcr of the signed data verifies the signature on the received data to assure that the data came from the claimed entity and has not been modified. To authenticate the signature. thc message digest is decrypted using the signer’s public key.
The signer’s public key can be sent with the data (and separately authenticated via the certificate authority’s signature). It might already be cached by the receiver if previously obtained. Or it can be obtained from a public key server if it has been posted. If the message digest decryption is successful, it proves the authenticity of the signer’s identity. The hash algorithm is then run on the received data and the resulting hash word is compared to the transmitted, decrypted hash word.
If they are identical, the data integrity is assured. This proves that no unauthorized or accidental modification of the data has occurred while it was in transit and that the data received at the destination is the exact same data as transmitted from the source.
2.4 AUTH ENTICATEI) F.NCRYPTION
Authenticated encryption is a cipher mode which provides the simultaneous security services of confidentiality, integrity, and authenticity. Authenticated encryption is also known as Authenticated Encryption with Associated Data (AEAD).
In general, authenticated encryption can be performed by combining an encryption algorithm with an authentication algorithm (e.g.. MAC) as long as both are known to be secure against attack. It has been shown that encrypting data and then appl>ing a MAC to the ciphertcxt implies security against an adaptise chosen ciphertexi attack.
3.3 ALGORITHM MODE OF OPERATION
CCSDS implementations shall use Counter Mode (references [2j. [3]. and 141)- Other modes
of operation are allowed but should be carefully considered before use.
3.4 ALTIIWNTICATEI) I:NCRPilON
3.4.1 If encryption in combination with data integrity and origin authentication is required. implementations shall use GaloisCounier Mode (GUM) as specified in references [41 and 15] and [II].
3.4.2 The MAC t size shall be l2X bits.
NOTE The cryptographic community has recognized that data encryption without data origin authentication often results in degraded security. As a result. seseral additional counter modes of operation that provide both encryption and data origin authentication hae been specified. These modes are called Authenticated Encryption with Associated Data (AEAD). GCM can provide very high—speed authenticated encryption in hardware as well as in software. It can also be parallelized and pipclined, mcthods that can be very advantageous in the space comnuinity. It also does not require padding with extraneous, throwaway bits.
ISO 20215 pdf download – Space data and information transfer systems -cCSDs cryptographical gorithms
