Paper 2020/232

Combiners for AEAD

Bertram Poettering and Paul Rösler


The Authenticated Encryption with Associated Data (AEAD) primitive, which integrates confidentiality and integrity services under a single roof, found wide-spread adoption in industry and became indispensable in practical protocol design. Recognizing this, academic research put forward a large number of candidate constructions, many of which come with provable security guarantees. Nevertheless, the recent past has shaken up with the discovery of vulnerabilities, some of them fatal, in well-regarded schemes, stemming from weak underlying primitives, flawed security arguments, implementation-level vulnerabilities, and so on. Simply reacting to such findings by replacing broken candidates by better(?) ones is in many cases unduly, costly, and sometimes just impossible. On the other hand, as attack techniques and opportunities change over time, it seems venturous to propose any specific scheme if the intended lifetime of its application is, say, twenty years. In this work we study a workable approach towards increasing the resilience against unforeseen breaks of AEAD primitives. Precisely, we consider the ability to combine two AEAD schemes into one such that the resulting AEAD scheme is secure as long as at least one of its components is (or: as long as at most one component is broken). We propose a series of such combiners, some of which work with fully generic AEAD components while others assume specific internal structures of the latter (like an encrypt-then-MAC design). We complement our results by proving the optimality of our constructions by showing the impossibility of combiners that get along with less invocations of the component algorithms.

Note: Final ToSC version plus appendices.

Available format(s)
Secret-key cryptography
Publication info
A minor revision of an IACR publication in FSE 2020
Secure CombinersProvable SecurityAEADEncrypt-then-MACCiphertext TranslationImpossibility Result
Contact author(s)
poe @ zurich ibm com
paul roesler @ rub de
2020-05-29: last of 4 revisions
2020-02-24: received
See all versions
Short URL
Creative Commons Attribution


      author = {Bertram Poettering and Paul Rösler},
      title = {Combiners for AEAD},
      howpublished = {Cryptology ePrint Archive, Paper 2020/232},
      year = {2020},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.