Cryptology ePrint Archive: Report 2019/1033

Anonymous AE

John Chan and Phillip Rogaway

Abstract: The customary formulation of authenticated encryption (AE) requires the decrypting party to supply the correct nonce with each ciphertext it decrypts. To enable this, the nonce is often sent in the clear alongside the ciphertext. But doing this can forfeit anonymity and degrade usability. Anonymity can also be lost by transmitting associated data (AD) or a session-ID (used to identify the operative key). To address these issues, we introduce anonymous AE, wherein ciphertexts must conceal their origin even when they are understood to encompass everything needed to decrypt (apart from the receiver's secret state). We formalize a type of anonymous AE we call anAE, anonymous nonce-based AE, which generalizes and strengthens conventional nonce-based AE, nAE. We provide an efficient construction for anAE, NonceWrap, from an nAE scheme and a blockcipher. We prove NonceWrap secure. While anAE does not address privacy loss through traffic-flow analysis, it does ensure that ciphertexts, now more expansively construed, do not by themselves compromise privacy.

Category / Keywords: secret-key cryptography / anonymous encryption, authenticated encryption, nonces , privacy, provable security, symmetric encryption

Original Publication (in the same form): IACR-ASIACRYPT-2019

Date: received 11 Sep 2019

Contact author: rogaway at cs ucdavis edu

Available format(s): PDF | BibTeX Citation

Version: 20190916:094043 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]