View source for CWC mode

{{Short description|Authenticated encryption mode for block ciphers}}
{{More citations needed|date=April 2019}}

In [[cryptography]], '''CWC Mode''' (Carter–Wegman + [[Block cipher modes of operation|CTR]] mode) is an [[AEAD block cipher modes of operation|AEAD block cipher mode of operation]] that provides both encryption and built-in message integrity, similar to CCM and OCB modes. It combines the use of CTR mode with a 128-bit block cipher for encryption with an efficient polynomial [[Carter–Wegman MAC]] with a tag length of at most 128 bits and is designed by [[Tadayoshi Kohno]], [[John Viega]] and [[Doug Whiting]].<ref name=spec>{{cite book | chapter-url=https://link.springer.com/chapter/10.1007/978-3-540-25937-4_26 | doi=10.1007/978-3-540-25937-4_26 | isbn=9783540259374 | series=Lecture Notes in Computer Science | year=2004 | pages=408–426 | last1=Kohno | first1=Tadayoshi | last2=Viega | first2=John | last3=Whiting | first3=Doug | title=Fast Software Encryption | chapter=CWC: A High-Performance Conventional Authenticated Encryption Mode | volume=3017 }}</ref>

CWC mode was submitted to [[National Institute of Standards and Technology|NIST]]<ref>{{Cite web |date=August 30, 2017 |title=NIST.gov - Computer Security Division - Computer Security Resource Center |url=http://csrc.nist.gov/groups/ST/toolkit/BCM/modes_development.html |url-status=dead |archive-url=https://web.archive.org/web/20170830120738/http://csrc.nist.gov/groups/ST/toolkit/BCM/modes_development.html |archive-date=2017-08-30}}</ref> for standardization, but NIST opted for the similar [[Galois/Counter Mode|GCM mode]] instead.<ref>{{cite web | url=https://csrc.nist.gov/projects/block-cipher-techniques/bcm/modes-development | title=Modes Development - Block Cipher Techniques &#124; CSRC &#124; CSRC | date=4 January 2017 }}</ref>

Although GCM has weaknesses compared to CWC,<ref>{{Cite web |date=2005-05-20 |title=Authentication weaknesses in GCM |url=https://csrc.nist.gov/csrc/media/projects/block-cipher-techniques/documents/bcm/comments/cwc-gcm/ferguson2.pdf}}</ref> the GCM authors successfully argued for GCM.<ref>{{Cite web |date=May 31, 2005 |title=GCM Update |url=https://csrc.nist.gov/CSRC/media/Projects/Block-Cipher-Techniques/documents/BCM/Comments/CWC-GCM/gcm-update.pdf}}</ref>

CWC allows the payload and associated data to be at most 2<sup>32</sup> - 1 blocks or nearly 550 GB.<ref name=spec />

==References==
<references />

==External links==
* [https://web.archive.org/web/20111228025901/http://www.zork.org/cwc/ CWC mode home page]
* [https://eprint.iacr.org/2003/106 CWC: A high-performance conventional authenticated encryption mode] on Cryptology ePrint
* {{usurped|1=[https://web.archive.org/web/20140314190553/http://gladman.plushost.co.uk/oldsite/AES/index.php Implementation of CWC]}} on top of [[Advanced Encryption Standard|AES]].

{{Cryptography navbox | block | hash}}

[[Category:Block cipher modes of operation]]
[[Category:Authenticated-encryption schemes]]


{{crypto-stub}}