Welcome to the resource topic for 2018/991
Title:
Reconsidering Generic Composition: the Tag-then-Encrypt case
Authors: Francesco Berti, Olivier Pereira, Thomas Peters
Abstract:Authenticated Encryption (\mathsf{AE}) achieves confidentiality and authenticity, the two most fundamental goals of cryptography, in a single scheme. A common strategy to obtain \mathsf{AE} is to combine a Message Authentication Code (\mathsf{MAC}) and an encryption scheme, either nonce-based or \mathsf{iv}-based. Out of the 180 possible combinations, Namprempre et al.~[25] proved that 12 were secure, 164 insecure and 4 were left unresolved: A10, A11 and A12 which use an \iv-based encryption scheme and N4 which uses a nonce-based one. The question of the security of these composition modes is particularly intriguing as N4, A11, and A12 are more efficient than the 12 composition modes that are known to be provably secure.\ We prove that: (i) N4 is not secure in general, (ii) A10, A11 and A12 have equivalent security, (iii) A10, A11, A12 and N4 are secure if the underlying encryption scheme is either misuse-resistant or ``message malleable’', a property that is satisfied by many classical encryption modes, (iv) A10, A11 and A12 are insecure if the underlying encryption scheme is stateful or untidy.\ All the results are quantitative.
ePrint: https://eprint.iacr.org/2018/991
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .