Cryptology ePrint Archive: Report 2018/991

Reconsidering Generic Composition: the Tag-then-Encrypt case

Francesco Berti and Olivier Pereira and Thomas Peters

Abstract: Authenticated Encryption ($\mathsf{AE}$) achieves confidentiality and authenticity, the two most fundamental goals of cryptography, in a single scheme. A common strategy to obtain $\mathsf{AE}$ is to combine a Message Authentication Code $(\mathsf{MAC})$ and an encryption scheme, either nonce-based or $\mathsf{iv}$-based. Out of the 180 possible combinations, Namprempre et al.~[25] proved that 12 were secure, 164 insecure and 4 were left unresolved: A10, A11 and A12 which use an $\iv$-based encryption scheme and N4 which uses a nonce-based one. The question of the security of these composition modes is particularly intriguing as N4, A11, and A12 are more efficient than the 12 composition modes that are known to be provably secure.\\ We prove that: $(i)$ N4 is not secure in general, $(ii)$ A10, A11 and A12 have equivalent security, $(iii)$ A10, A11, A12 and N4 are secure if the underlying encryption scheme is either misuse-resistant or ``message malleable'', a property that is satisfied by many classical encryption modes, $(iv)$ A10, A11 and A12 are insecure if the underlying encryption scheme is stateful or untidy.\\ All the results are quantitative.

Category / Keywords: secret-key cryptography / Authenticated Encryption, generic composition, tag-then-encrypt, attacks and proves

Date: received 15 Oct 2018

Contact author: francesco berti at uclouvain be

Available format(s): PDF | BibTeX Citation

Version: 20181022:122407 (All versions of this report)

Short URL: ia.cr/2018/991


[ Cryptology ePrint archive ]