Paper 2020/1456

How to Abuse and Fix Authenticated Encryption Without Key Commitment

Ange Albertini, Thai Duong, Shay Gueron, Stefan Kölbl, Atul Luykx, and Sophie Schmieg


Authenticated encryption (AE) is used in a wide variety of applications, potentially in settings for which it was not originally designed. Recent research tries to understand what happens when AE is not used as prescribed by its designers. A question given relatively little attention is whether an AE scheme guarantees ``key commitment'': ciphertext should only decrypt to a valid plaintext under the key used to generate the ciphertext. Generally, AE schemes do not guarantee key commitment as it is not part of AE's design goal. Nevertheless, one would not expect this seemingly obscure property to have much impact on the security of actual products. In reality, however, products do rely on key commitment. We discuss three recent applications where missing key commitment is exploitable in practice. We provide proof-of-concept attacks via a tool that constructs AES-GCM ciphertext which can be decrypted to two plaintexts valid under a wide variety of file formats, such as PDF, Windows executables, and DICOM. Finally we discuss two solutions to add key commitment to AE schemes which have not been analyzed in the literature: a generic approach that adds an explicit key commitment scheme to the AE scheme, and a simple fix which works for AE schemes like AES-GCM and ChaCha20Poly1305, but requires separate analysis for each scheme.

Note: Incorporated reviewer feedback.

Available format(s)
Secret-key cryptography
Publication info
Published elsewhere. Major revision. USENIX Security 2022
authenticated encryptionrobustnesscommitmentkey commitmentAES-GCM
Contact author(s)
aluykx @ google com
2021-12-08: last of 3 revisions
2020-11-19: received
See all versions
Short URL
Creative Commons Attribution


      author = {Ange Albertini and Thai Duong and Shay Gueron and Stefan Kölbl and Atul Luykx and Sophie Schmieg},
      title = {How to Abuse and Fix Authenticated Encryption Without Key Commitment},
      howpublished = {Cryptology ePrint Archive, Paper 2020/1456},
      year = {2020},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.