Security of Symmetric Encryption in the Presence of Ciphertext Fragmentation

Boldyreva, Alexandra; Degabriele, Jean Paul; Paterson, Kenneth G.; Stam, Martijn

doi:10.1007/978-3-642-29011-4_40

Cited by 31 publications

(27 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Albrecht et al [APW09] showed how to carry out a plaintext recovery attack against the Secure Shell (SSH) protocol as a result of byte-by-byte processing. This motivated the need for non-atomic authenticated encryption definitions [BDPS12,FGMP15]. The work of Fischlin et al [FGMP15] in particular is motivated by protocols such as TLS, SSH, and QUIC, and describes checks that can again be correlated with our level-4 AEAD notion.…”

Section: Additional Related Workmentioning

confidence: 99%

From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS

Boyd

Hale

Mjølsnes

et al. 2016

Topics in Cryptology - CT-RSA 2016

View full text Add to dashboard Cite

Authentication and authenticated encryption with associated data (AEAD) are applied in cryptographic protocols to provide message integrity. The definitions in the literature and the constructions used in practice all protect against forgeries, but offer varying levels of protection against replays, reordering, and drops. As a result of the lack of a systematic hierarchy of authentication and AEAD security notions, gaps have arisen in the literature, specifically in the provable security analysis of the Transport Layer Security (TLS) protocol. We present a hierarchy of authentication and AEAD security notions, interpolating between the lowest level of protection (against forgeries) and the highest level (against forgeries, replays, reordering, and drops). We show generically how to construct higher level schemes from a basic scheme and appropriate use of sequence numbers, and apply that to close the gap in the analysis of TLS record layer encryption.

show abstract

Section: Additional Related Workmentioning

confidence: 99%

From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS

Boyd

Hale

Mjølsnes

et al. 2016

Topics in Cryptology - CT-RSA 2016

View full text Add to dashboard Cite

show abstract

“…Bellare and Keelveedhi [7] considered a stronger security model where data may be key-dependent. Boldyreva et al reformulated AE requirements and properties to handle ciphertext fragmentation in [18], and enhanced the syntax and security definitions so that the verification oracle is allowed to handle multiple failure events in [19].…”

Section: Background and Related Workmentioning

confidence: 99%

How to Securely Release Unverified Plaintext in Authenticated Encryption

Andreeva

Bogdanov

Luykx

et al. 2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Scenarios in which authenticated encryption schemes output decrypted plaintext before successful verification raise many security issues. These situations are sometimes unavoidable in practice, such as when devices have insufficient memory to store an entire plaintext, or when a decrypted plaintext needs early processing due to real-time requirements. We introduce the first formalization of the releasing unverified plaintext (RUP) setting. To achieve privacy, we propose using plaintext awareness (PA) along with IND-CPA. An authenticated encryption scheme is PA if it has a plaintext extractor, which tries to fool adversaries by mimicking the decryption oracle without the secret key. Releasing unverified plaintext then becomes harmless as it is infeasible to distinguish the decryption oracle from the plaintext extractor. We introduce two notions of plaintext awareness in the symmetric-key setting, PA1 and PA2, and show that they expose a new layer of security between IND-CPA and IND-CCA. To achieve integrity of ciphertexts, INT-CTXT in the RUP setting is required, which we refer to as INT-RUP. These new security notions are used to make a classification of symmetric-key schemes in the RUP setting. Furthermore, we re-analyze existing authenticated encryption schemes, and provide solutions to fix insecure schemes.

show abstract

“…In response, a number of works have tried to capture more closely how protocols behave when implemented [14,21,25]. We are particularly interested in subtle authenticated encryption [4] which augments the authenticated encryption security game with an implementation-dependent leakage oracle that provides an adversary deterministic decryption leakage on invalid ciphertexts only.…”

Section: Introductionmentioning

confidence: 99%

Authenticated Encryption in the Face of Protocol and Side Channel Leakage

Barwell

Martin

Oswald

et al. 2017

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. Authenticated encryption schemes in practice have to be robust against adversaries that have access to various types of leakage, for instance decryption leakage on invalid ciphertexts (protocol leakage), or leakage on the underlying primitives (side channel leakage). This work includes several novel contributions: we augment the notion of nonce-base authenticated encryption with the notion of continuous leakage and we prove composition results in the face of protocol and side channel leakage. Moreover, we show how to achieve authenticated encryption that is simultaneously both misuse resistant and leakage resilient, based on a sufficiently leakage resilient PRF, and finally we propose a concrete, pairing-based instantiation of the latter.

show abstract

Security of Symmetric Encryption in the Presence of Ciphertext Fragmentation

Cited by 31 publications

References 17 publications

From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS

From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS

How to Securely Release Unverified Plaintext in Authenticated Encryption

Authenticated Encryption in the Face of Protocol and Side Channel Leakage

Contact Info

Product

Resources

About