Paper 2017/231

EHE: nonce misuse-resistant message authentication

Sergey Agievich

Abstract

We propose a nonce misuse-resistant message authentication scheme called EHE (Encrypt-Hash-Encrypt). In EHE, a message-dependent polynomial is evaluated at the point which is an encrypted nonce. The resulting polynomial hash value is encrypted again and becomes an authentication tag. We prove the prf-security of the EHE scheme and extend it to two authenticated encryption modes which follow the "encrypt-then-authenticate" paradigm.

Note: Fixed bounds on advantages providing small-order terms, -= typos, ++editorial.