Security of Symmetric Primitives under Incorrect Usage of Keys

Abstract

We study the security of symmetric primitives under the incorrect usage of keys. Roughly speaking, a key-robust scheme does not output ciphertexts/tags that are valid with respect to distinct keys. Key-robustness is a notion that is often tacitly expected/assumed in protocol design — as is the case with anonymous auction, oblivious transfer, or public-key encryption. We formalize simple, yet strong definitions of key robustness for authenticated-encryption, message-authentication codes and PRFs. We show standard notions (such as AE or PRF security) guarantee a basic level of key-robustness under honestly generated keys, but fail to imply keyrobustness under adversarially generated (or known) keys. We show robust encryption and MACs compose well through generic composition, and identify robust PRFs as the main primitive used in building robust schemes. Standard hash functions are expected to satisfy key-robustness and PRF security, and hence suffice for practical instantiations. We however provide further theoretical justifications (in the standardmodel) by constructing robust PRFs from (left-and-right) collision-resistant PRGs.

A Concrete Treatment of Efficient Continuous Group Key Agreement via Multi-Recipient PKEs

“…We show how to build a CmPKE from an mPKE [43] and a key-committing SKE [2,32,33,37], which can itself be built using standard symmetric primitives [2]. Compared to the base mPKE, the overhead is minimal: ct i = ct i , and T is formed of ct 0 and a term of size 2κ bits, which is no larger than a hash digest.…”

“…We also define key commitment for a SKE [33] which roughly states that it is difficult to find two secret keys that correctly decrypt the same ciphertext (to possibly different messages). As in prior works [2,32,33,37], we define this notion by providing the (non-uniform) adversary oracle access to Enc s and Dec s , where we implicitly assume these two algorithms are implemented using an internal hash function modeled as a random oracle.…”

“…We consider a strengthening of a standard mPKE which we coin a committing mPKE (CmPKE). The motivation for this is similar in spirit to those of key committing SKEs or AEADs [2,32,33,37], where we ask a ciphertext to be bound to a unique key and message pair. Although it may sound like an obscure property at first glance, this property has been shown to be vital for establishing security in several practical applications such as Facebook Messenger [32], (see [2] for more examples).…”

Post-quantum Anonymity of Kyber

“…Roughly speaking, robustness guarantees that it is hard to produce a ciphertext which decrypts validly under two different private keys. Fortunately, it was shown in [28] that composing Kyber.KEM with an appropriately "robust" DEM (as defined in [23]) will result in a robust hybrid PKE scheme. In other words, composing Kyber with a one-time strongly pseudorandom and robust DEM will result in a post-quantum strongly anonymous and robust PKE scheme.…”

Implementation of a Strongly Robust Identity-Based Encryption Scheme over Type-3 Pairings

“…As another robustnesses notions, Mohassel[44] defined robustness for key-encapsulation mechanisms, Farshim et al[30] defined robustness for symmetric primitives (authenticated-encryption, message-authentication codes and pseudo-random functions), and Géraud et al[33] defined robustness for functional encryption and digital signatures.…”