### Indifferentiable Authenticated Encryption

Manuel Barbosa and Pooya Farshim

##### Abstract

We study Authenticated Encryption with Associated Data (AEAD) from the viewpoint of composition in arbitrary (single-stage) environments. We use the indifferentiability framework to formalize the intuition that a good AEAD scheme should have random ciphertexts subject to decryptability. Within this framework, we can then apply the indifferentiability composition theorem to show that such schemes offer extra safeguards wherever the relevant security properties are not known, or cannot be predicted in advance, as in general-purpose crypto libraries and standards. We show, on the negative side, that generic composition (in many of its configurations) and well-known classical and recent schemes fail to achieve indifferentiability. On the positive side, we give a provably indifferentiable Feistel-based construction, which reduces the round complexity from at least $6$, needed for blockciphers, to only 3 for encryption. This result is not too far off the theoretical optimum as we give a lower bound that rules out the indifferentiability of any construction with less than 2 rounds.

Note: The first version submitted to eprint is the proceedings version. This is the full version.

Available format(s)
Publication info
Keywords
Contact author(s)
mbb @ dcc fc up pt
History
2018-07-02: revised
See all versions
Short URL
https://ia.cr/2018/547

CC BY

BibTeX

@misc{cryptoeprint:2018/547,
author = {Manuel Barbosa and Pooya Farshim},
title = {Indifferentiable Authenticated Encryption},
howpublished = {Cryptology ePrint Archive, Paper 2018/547},
year = {2018},
note = {\url{https://eprint.iacr.org/2018/547}},
url = {https://eprint.iacr.org/2018/547}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.