Robust Authenticated-Encryption AEZ and the Problem That It Solves

Abstract

Abstract. With a scheme for robust authenticated-encryption a user can select an arbitrary value λ ≥ 0 and then encrypt a plaintext of any length into a ciphertext that's λ characters longer. The scheme must provide all the privacy and authenticity possible for the requested λ. We formalize and investigate this idea, and construct a well-optimized solution, AEZ, from the AES round function. Our scheme encrypts strings at almost the same rate as OCB-AES or CTR-AES (on Haswell, AEZ has a peak speed of about 0.7 cpb). To accomplish this we employ an approach we call prove-then-prune: prove security and then instantiate with a scaled-down primitive (e.g., reducing rounds for blockcipher calls).

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

“…This step usually costs Adv srkprp Φ,E (D), where D is some strong related-key PRP distinguisher with a certain amount of resources, usually q queries to the keyed oracle E φ(k) and τ time, and Φ is the set of related-key deriving functions φ that D is allowed to choose. This reduction is in fact also broadly used beyond the area of tweakable blockciphers, such as in authenticated encryption schemes [1,3,11,21,28,33,37,44,50,51] and message authentication codes [4,13,16,24,29,30,41,47,[57][58][59], and in fact, we are not aware of any security result of a construction based on a standard-model blockcipher that uses a structurally different approach. Inspired by this, we investigate what level of tweakable blockcipher security can be achieved if this proof technique is employed.…”

Authenticated Encryption in the Face of Protocol and Side Channel Leakage

“…For instance, if E's security matches that of a tweakable (variable input length) cipher, the MAC-then-Encrypt constructions become a sort of encodethen-encipher. The latter is secure against release of unverified plaintext [25]. We leave open the identification of sufficient conditions on E for a generic composition result in the presence of leakage to pull through for EtM or E&M; relatedly, we leave open the extension of our work to the encode-then-encipher setting.…”

“…Andreeva et al [2] (RUP) considered the release of unverified plaintexts, where the decryption oracle releases candidate plaintexts even if they fail verification. The robust authenticated encryption notion of Hoang et al [25] also implies security against the leakage of these candidate plaintexts, among other goals. Barwell et al [4] defined the SAE framework as a generalisation of these notions, and used it to compare the three previous works.…”

“…This meant ruling out every NRS construction secure in the nonce misuse model, an important feature for a modern robust AE schemes [10,25,51]. Roughly speaking, for MRAE security a scheme must be MtE (to ensure maximum diffusion) yet for leakage resilience it must be EtM (to ensure minimal leakage).…”

“…In response, a number of works have tried to capture more closely how protocols behave when implemented [14,21,25]. We are particularly interested in subtle authenticated encryption [4] which augments the authenticated encryption security game with an implementation-dependent leakage oracle that provides an adversary deterministic decryption leakage on invalid ciphertexts only.…”