Skip to content

Rogue Decryption Failures: Reconciling AE Robustness Notions

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Standard

Rogue Decryption Failures: Reconciling AE Robustness Notions. / Barwell, Guy; Page, Daniel; Stam, Martijn.

Cryptography and Coding - IMACC 2015: 15th IMA International Conference, IMACC 2015, Oxford, UK, December 15-17, 2015. Proceedings. ed. / Jens Groth. Vol. 9496 Springer, 2015. p. 94-111 (Lecture Notes in Computer Science).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Harvard

Barwell, G, Page, D & Stam, M 2015, Rogue Decryption Failures: Reconciling AE Robustness Notions. in J Groth (ed.), Cryptography and Coding - IMACC 2015: 15th IMA International Conference, IMACC 2015, Oxford, UK, December 15-17, 2015. Proceedings. vol. 9496, Lecture Notes in Computer Science, Springer, pp. 94-111. https://doi.org/10.1007/978-3-319-27239-9_6

APA

Barwell, G., Page, D., & Stam, M. (2015). Rogue Decryption Failures: Reconciling AE Robustness Notions. In J. Groth (Ed.), Cryptography and Coding - IMACC 2015: 15th IMA International Conference, IMACC 2015, Oxford, UK, December 15-17, 2015. Proceedings (Vol. 9496, pp. 94-111). (Lecture Notes in Computer Science). Springer. https://doi.org/10.1007/978-3-319-27239-9_6

Vancouver

Barwell G, Page D, Stam M. Rogue Decryption Failures: Reconciling AE Robustness Notions. In Groth J, editor, Cryptography and Coding - IMACC 2015: 15th IMA International Conference, IMACC 2015, Oxford, UK, December 15-17, 2015. Proceedings. Vol. 9496. Springer. 2015. p. 94-111. (Lecture Notes in Computer Science). https://doi.org/10.1007/978-3-319-27239-9_6

Author

Barwell, Guy ; Page, Daniel ; Stam, Martijn. / Rogue Decryption Failures: Reconciling AE Robustness Notions. Cryptography and Coding - IMACC 2015: 15th IMA International Conference, IMACC 2015, Oxford, UK, December 15-17, 2015. Proceedings. editor / Jens Groth. Vol. 9496 Springer, 2015. pp. 94-111 (Lecture Notes in Computer Science).

Bibtex

@inproceedings{ef59491c5f714f4195656e6c75b9348a,
title = "Rogue Decryption Failures: Reconciling AE Robustness Notions",
abstract = "An authenticated encryption scheme is deemed secure (AE) if ciphertexts both look like random bitstrings and are unforgeable. AE is a much stronger notion than the traditional IND--CCA. One shortcoming of AE as commonly understood is its idealized, all-or-nothing decryption: if decryption fails, it will always provide the same single error message and nothing more. Reality often turns out differently: encode-then-encipher schemes often output decrypted ciphertext before verification has taken place whereas pad-then-MAC-then-encrypt schemes are prone to distinguishable verification failures due to the subtle interaction between padding and the MAC-then-encrypt concept. Three recent papers provided what appeared independent and radically different definitions to model this type of decryption leakage. We reconcile these three works by providing a reference model of security for authenticated encryption in the face of decryption leakage from invalid queries. Having tracked the development of AE security games, we provide a single expressive framework allowing us to compare and contrast the previous notions. We find that at their core, the notions are essentially equivalent, with their key differences stemming from definitional choices independent of the desire to capture real world behaviour.",
author = "Guy Barwell and Daniel Page and Martijn Stam",
year = "2015",
month = "12",
doi = "10.1007/978-3-319-27239-9_6",
language = "English",
isbn = "978-3-319-27238-2",
volume = "9496",
series = "Lecture Notes in Computer Science",
publisher = "Springer",
pages = "94--111",
editor = "Jens Groth",
booktitle = "Cryptography and Coding - IMACC 2015",

}

RIS - suitable for import to EndNote

TY - GEN

T1 - Rogue Decryption Failures: Reconciling AE Robustness Notions

AU - Barwell, Guy

AU - Page, Daniel

AU - Stam, Martijn

PY - 2015/12

Y1 - 2015/12

N2 - An authenticated encryption scheme is deemed secure (AE) if ciphertexts both look like random bitstrings and are unforgeable. AE is a much stronger notion than the traditional IND--CCA. One shortcoming of AE as commonly understood is its idealized, all-or-nothing decryption: if decryption fails, it will always provide the same single error message and nothing more. Reality often turns out differently: encode-then-encipher schemes often output decrypted ciphertext before verification has taken place whereas pad-then-MAC-then-encrypt schemes are prone to distinguishable verification failures due to the subtle interaction between padding and the MAC-then-encrypt concept. Three recent papers provided what appeared independent and radically different definitions to model this type of decryption leakage. We reconcile these three works by providing a reference model of security for authenticated encryption in the face of decryption leakage from invalid queries. Having tracked the development of AE security games, we provide a single expressive framework allowing us to compare and contrast the previous notions. We find that at their core, the notions are essentially equivalent, with their key differences stemming from definitional choices independent of the desire to capture real world behaviour.

AB - An authenticated encryption scheme is deemed secure (AE) if ciphertexts both look like random bitstrings and are unforgeable. AE is a much stronger notion than the traditional IND--CCA. One shortcoming of AE as commonly understood is its idealized, all-or-nothing decryption: if decryption fails, it will always provide the same single error message and nothing more. Reality often turns out differently: encode-then-encipher schemes often output decrypted ciphertext before verification has taken place whereas pad-then-MAC-then-encrypt schemes are prone to distinguishable verification failures due to the subtle interaction between padding and the MAC-then-encrypt concept. Three recent papers provided what appeared independent and radically different definitions to model this type of decryption leakage. We reconcile these three works by providing a reference model of security for authenticated encryption in the face of decryption leakage from invalid queries. Having tracked the development of AE security games, we provide a single expressive framework allowing us to compare and contrast the previous notions. We find that at their core, the notions are essentially equivalent, with their key differences stemming from definitional choices independent of the desire to capture real world behaviour.

U2 - 10.1007/978-3-319-27239-9_6

DO - 10.1007/978-3-319-27239-9_6

M3 - Conference contribution

SN - 978-3-319-27238-2

VL - 9496

T3 - Lecture Notes in Computer Science

SP - 94

EP - 111

BT - Cryptography and Coding - IMACC 2015

A2 - Groth, Jens

PB - Springer

ER -