是否需要/建议使用流密码进行身份验证？
我想使用共享密码/密钥来保护基于 TCP 的程序的通信。无需处理块大小、填充等的最简单方法是直接使用 流密码。这样做，明文数据和加密数据之间的数据量不会改变，并且修改也很简单。
仅使用流密码意味着没有身份验证，我一直认为/听说没有身份验证的加密不够安全，不应该使用。
如果必须向流密码添加身份验证，我们就会失去流密码所添加的简单性，因为我们必须添加 HMAC 或使用经过身份验证的加密方法（例如 crypto_secretbox 来自 NaCl），有最小消息长度，我们必须处理填充，...
您会推荐什么？在某些特定情况下仅使用流密码而不进行身份验证是否安全？
I want to secure the communication of a TCP-based program using a shared passphrase/key. The easiest way to do that without having to deal with block size, padding, ... is to directly use a stream cipher. Doing that way, the amount of data is not changed between clear and encrypted data and the modification is trivial.
Using only a stream cipher means that there is no authentication and I have always considered/heard that encryption without authentication is not secure enough and should not be used.
If adding authentication to a stream cipher is mandatory, we lose the simplicity that stream cipher has added because we must add an HMAC or use an authenticated encryption method (like crypto_secretbox from NaCl), there is a minimum message length, we must handle padding, ...
What would you recommend? Is it safe to only use stream cipher without authentication in some particular cases?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
使用某种消息验证器对于流密码尤其很重要，因为密文更改和明文更改之间的关系非常简单。
无论如何，你不能只是盲目地应用流密码而不向流添加任何额外的信息 - 请记住流密码最重要的规则：
永远不要重复使用相同的密钥流
所以除非你只打算加密< em>单个连接，然后扔掉密码，您将需要从共享密钥为每个连接生成一个会话密钥。这意味着您需要在连接开始时发送一些额外的信息，并且由于您无论如何都会发送这些信息，因此在每条消息之后发送 HMAC 应该没什么大不了的。
无论如何，因为看起来更简单而使用流密码通常是一个错误。您提到了来自 NaCl 的
crypto_secretbox- 我建议使用它，它将为您处理身份验证和填充问题。Using some kind of message authenticator is particularly important with stream ciphers, because the relationship between changes to the ciphertext and changes to the plaintext is so simple.
You can't just blindly go and apply the stream cipher without adding any extra information to the stream, anyway - remember the most important rule of stream ciphers:
NEVER RE-USE THE SAME KEYSTREAM
So unless you are only ever going to encrypt a single connection, and throw the passphrase away afterwards, you will need to generate a session key for each connection from the shared secret. This implies that you will need to send some extra information at the start of the connection, and since you're sending that anyway, sending a HMAC after each message should be no big deal.
Using a stream cipher because it seems simpler is usually a mistake, anyway. You mentioned
crypto_secretboxfrom NaCl - I recommend using that, it will take care of the authentication and padding issues for you.您可以考虑在 GCM 模式 中使用 AES。这将为您提供具有内置身份验证的流密码。
You could consider using AES in GCM-mode. That will give you a stream-cipher with built-in authentication.