Cryptology ePrint Archive: Report 2020/232

Combiners for AEAD

Bertram Poettering and Paul Rösler

Abstract: The Authenticated Encryption with Associated Data (AEAD) primitive, which integrates confidentiality and integrity services under a single roof, found wide-spread adoption in industry and became indispensable in practical protocol design. Recognizing this, academic research put forward a large number of candidate constructions, many of which come with provable security guarantees. Nevertheless, the recent past has shaken up with the discovery of vulnerabilities, some of them fatal, in well-regarded schemes, stemming from weak underlying primitives, flawed security arguments, implementation-level vulnerabilities, and so on. Simply reacting to such findings by replacing broken candidates by better(?) ones is in many cases unduly, costly, and sometimes just impossible. On the other hand, as attack techniques and opportunities change over time, it seems venturous to propose any specific scheme if the intended lifetime of its application is, say, twenty years.

In this work we study a workable approach towards increasing the resilience against unforeseen breaks of AEAD primitives. Precisely, we consider the ability to combine two AEAD schemes into one such that the resulting AEAD scheme is secure as long as at least one of its components is (or: as long as at most one component is broken). We propose a series of such combiners, some of which work with fully generic AEAD components while others assume specific internal structures of the latter (like an encrypt-then-MAC design). We complement our results by proving the optimality of our constructions by showing the impossibility of combiners that get along with less invocations of the component algorithms.

Category / Keywords: secret-key cryptography / Secure Combiners, Provable Security, AEAD, Encrypt-then-MAC, Ciphertext Translation, Impossibility Result

Original Publication (with minor differences): IACR-FSE-2020

Date: received 21 Feb 2020, last revised 11 Mar 2020

Contact author: poe at zurich ibm com, paul roesler@rub de

Available format(s): PDF | BibTeX Citation

Note: Final ToSC version plus appendices.

Version: 20200311:133359 (All versions of this report)

Short URL: ia.cr/2020/232


[ Cryptology ePrint archive ]