9  Authenticated Encryption

\[ \newcommand{\F}{\mathbb{F}} \newcommand{\G}{\mathbb{G}} \newcommand{\N}{\mathbb{N}} \newcommand{\R}{\mathbb{R}} \newcommand{\Z}{\mathbb{Z}} \newcommand{\Zq}{\Z_q} \newcommand{\zo}{\{0,1\}} \newcommand{\bin}{\zo} \newcommand{\zon}{\{0,1\}^n} \newcommand{\A}{\mathcal{A}} \newcommand{\B}{\mathcal{B}} \newcommand{\calA}{\mathcal{A}} \newcommand{\calB}{\mathcal{B}} \newcommand{\calC}{\mathcal{C}} \newcommand{\calD}{\mathcal{D}} \newcommand{\calK}{\mathcal{K}} \newcommand{\calM}{\mathcal{M}} \newcommand{\calT}{\mathcal{T}} \newcommand{\calX}{\mathcal{X}} \newcommand{\calY}{\mathcal{Y}} \newcommand{\xor}{\oplus} \newcommand{\cross}{\times} \newcommand{\deq}{\mathrel{\mathop:}=} \newcommand{\abs}[1]{\left| #1 \right|} \newcommand{\set}[1]{\left\{ #1 \right\}} \renewcommand{\vec}[1]{\mathbf{#1}} \newcommand{\poly}{\operatorname{poly}} \newcommand{\negl}{\operatorname{negl}} \newcommand{\classP}{\mathsf{P}} \newcommand{\classNP}{\mathsf{NP}} \newcommand{\INDCPA}{\text{IND-CPA}} \newcommand{\Enc}{\mathsf{Enc}} \newcommand{\Dec}{\mathsf{Dec}} \newcommand{\Gen}{\mathsf{Gen}} \newcommand{\Derive}{\mathsf{Derive}} \newcommand{\Sign}{\mathsf{Sign}} \newcommand{\Ver}{\mathsf{Ver}} \newcommand{\MAC}{\mathsf{MAC}} \newcommand{\MACSign}{\mathsf{MAC.Sign}} \newcommand{\MACVerify}{\mathsf{MAC.Verify}} \newcommand{\Funs}{\mathsf{Funs}} \newcommand{\ToString}{\mathsf{ToString}} \newcommand{\sk}{\mathsf{sk}} \newcommand{\pk}{\mathsf{pk}} \newcommand{\vk}{\mathsf{vk}} \newcommand{\sig}{\sigma} \newcommand{\rgets}{\mathrel{\overset{\scriptscriptstyle\mathrm{R}}{\leftarrow}}} \newcommand{\getsr}{\rgets} \newcommand{\bits}{\{0,1\}} \newcommand{\Tag}{\operatorname{Tag}} \newcommand{\Vrfy}{\operatorname{Verify}} \newcommand{\EncAM}{\operatorname{Enc}^{\mathrm{E\&M}}} \newcommand{\DecAM}{\operatorname{Dec}^{\mathrm{E\&M}}} \newcommand{\EncME}{\operatorname{Enc}^{\mathrm{MtE}}} \newcommand{\DecME}{\operatorname{Dec}^{\mathrm{MtE}}} \newcommand{\concat}{\,\|\,} \]

We have just constructed an encryption scheme with weak (CPA) security: one that provided security given that the adversary could see encryptions of messages of her choice. The “gold standard” security notion for encryption schemes allows the attacker to receive both encryptions of messages of its choice and decryptions of ciphertexts of its choice. Our security notion then says that even an attacker with this power should not be able to distinguish which of two chosen plaintext message a given ciphertext encrypts. This new and strong notion of security for encryption schemes is called security against adaptive chosen-ciphertext attacks.

9.1 Motivation: Chosen-ciphertext security

It is not clear why chosen-ciphertext security is the right security notion to consider. In real-life applications, why would we ever allow an attacker to obtain decryptions of ciphertexts of its choosing? It turns out that, in many settings, attackers can indeed trick honest parties into decrypting adversarially ciphertexts and revealing their contents.

As a simple example, imagine a server that receives encrypted requests from the network, decrypts them, and either:

• returns an error if the decrypted request is malformed, or
• silently processes the request otherwise.

In this case, an attacker can send ciphertexts to the server and learn information about their decryptions by noticing whether or not the server returned an error message.

If the server returns an error when the decrypted message is ill-formed, we often call it a padding oracle. Many many real-world protocols using non-chosen-ciphertext-secure encryption schemes fall victim to this sort of attack.

CPA-secure encryption schemes provide no security guarantees in this setting. Even if the server leaks a single bit to the attacker about the decrypted value (such as whether the decrypted ciphertext is a well-formed request or not), the attacker could potentially learn the entire secret key!

As a concrete application-level example, consider what could happen if SSH (the secure shell protocol) used the counter-mode encryption scheme, as described in the previous lecture, without any authentication. A user might send the command echo secret > secret-file to write their secret string, secret, to their own private file secret-file. The encryption of this command, sent over the network, would be the XOR of the command and the PRF-generated pseudorandom bytes. Suppose that the adversary knows the user is running this command, but doesn’t know the contents of the 6-byte secret string. Consider what happens if the adversary XORs the encrypted message with the hexadecimal bytes 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 11 0e 02 4a 04 58 04 05 05 06, where the leading zeroes mean that the first part of the command, echo secret >, will remain unchanged. When the server decrypts the latter part of the command (originally secret-file), however, it will obtain the XOR of secret-file and the bytes that the adversary XOR’ed in, which happens to turn into the string /tmp/public. As a result, if the server now runs this command, the user’s secret data will be written to a file /tmp/public, which might be available to an adversary that also has an account on that same server and can look at files in /tmp.

Chosen-ciphertext security guarantees that such attacks are ineffective.

9.2 Defining Authenticated Encryption

Authenticated-encryption schemes simultaneously provide message integrity (as a MAC does) and confidentiality (as CPA-secure encryption does). Additionally, authenticated-encryption schemes remain secure even when an attacker can see encryptions and decrypts of ciphertexts of her choice. Perhaps unsurprisingly, the standard way to construct an authenticated-encryption scheme is to combine a CPA-secure encryption scheme with a MAC in a careful way.

We now formally define our strong security notion: indistinguishability under chosen ciphertext attacks, also known as IND-CCA2 (Chosen Ciphertext Adaptive Attacks) security or CCA security.

Definition 9.1 (CCA security for encryption (strong)) An encryption scheme is secure against adaptive chosen-ciphertext attacks if every efficient adversary wins the following game with probability at most \(\tfrac{1}{2} + \text{``negligible''}\):

• The challenger samples \(b \rgets \bin\) and \(k \rgets \calK\).
• The adversary can make either of the following queries to the challenger repeatedly:
  • Chosen-plaintext queries
    • The adversary sends the challenger a message \(m_i \in \calM\)
    • The challenger replies with \(c_{m_i} \gets \Enc(k, m_i)\).
  • Chosen-ciphertext queries
    • The adversary sends the challenger a ciphertext \(c_j \notin \set{c_{m_0}, \ldots, c_{m_i}}\)
    • The challenger replies with \(m_{c_j} \gets \Dec(k, c_j)\).
• The adversary then sends two messages \((m^*_0, m^*_1) \in \calM^2\) to the challenger, where \(\abs{m^*_0} = \abs{m^*_1}\).
• The challenger replies with \(c^* \gets \Enc(k, m^*_b)\).
• The adversary can make more chosen-plaintext queries and more chosen-ciphertext queries. (The adversary may not make a chosen-ciphertext query on the challenge ciphertext \(c^*\).)
• The adversary outputs a value \(b' \in \bin\).
• The adversary wins if \(b=b'\).

9.3 RSA with Randomized Padding is not IND-CCA2 secure

Even if randomized for CPA security, “textbook” RSA and simple padding covered in the previous lecture is malleable, which makes it fail IND-CCA2 (security against adaptive chosen-ciphertext attacks).

The Homomorphic Property

RSA has a multiplicative homomorphic property: \[ (m_1)^e \cdot (m_2)^e \equiv (m_1 \cdot m_2)^e \pmod N \] This allows an attacker to manipulate a ciphertext \(c = m^e \pmod N\) into a new ciphertext \(c' = c \cdot 2^e \pmod N\).

The Attack

In an IND-CCA2 game, the adversary is allowed to use a Decryption Oracle:

1. Adversary receives challenge \(c^* = m_b^e \pmod N\).
2. Adversary cannot ask the Oracle to decrypt \(c^*\).
3. However, they can compute \(c' = c^* \cdot 2^e \pmod N = (2m_b)^e \pmod N\).
4. Since \(c' \neq c^*\), the Oracle decrypts it and returns \(m' = 2m_b\).
5. The adversary divides \(m'\) by 2 to recover the original message \(m_b\).

Conclusion: RSA-OAEP

To reach the “Gold Standard” of IND-CCA2 security, RSA must use Optimal Asymmetric Encryption Padding (OAEP). OAEP ensures that any modification to the ciphertext will result in a padding error during decryption, effectively “breaking” the malleability and making the Decryption Oracle useless to an attacker.

9.4 Encrypt then MAC

We typically achieve CCA security using the “encrypt-then-MAC” construction:

• First, encrypt the message using a CPA-secure encryption scheme on key \(k_\mathsf{Enc}\).

• Next, MAC the ciphertext using a secure MAC scheme and an independent key \(k_\mathsf{MAC}\).

• Output the ciphertext and the MAC tag.

As we discuss below, it is possible to derive both keys \(k_\mathsf{Enc}\) and \(k_\mathsf{MAC}\) from a single key \(k\) using a pseudorandom function.

The decryption routine first checks the MAC tag, then decrypts the ciphertext.

Using independent keys \((k_\mathsf{Enc}, k_\mathsf{MAC})\) is important in encrypt-then-MAC, as in many other cryptographic constructions. For example, a CPA-secure encryption scheme using \(2n\)-bit keys can reveal the low order \(n\) bits of its secret key in the ciphertext. And a secure MAC scheme using \(2n\)-bit keys can reveal the high-order \(n\) bits of its secret key in each MAC tag. Used independently, the encryption scheme and the MAC scheme are both secure, each with security parameter \(n\). Used together with the same key \(k\) with \(2n\) bits, the attacker learns all \(2n\) bits of the key and can break both primitives!

So, in general, you should always use independent keys for different primitives. To reduce the amount of keying material parties need to store, it is actually sufficient to store a single secret key \(k\) for a pseudorandom function \(F\) and derive all subsequent keys from the pseudorandom strings \(F(k, 0), F(k, 1), \dots\).

Theorem 9.1 (Informal) The Encrypt-then-MAC construction yields a CCA-secure encryption scheme, provided that the keys are generated independently, and the underlying encryption scheme is CPA-secure and the underlying MAC scheme is secure (existentially unforgeable against adaptive chosen message attacks).

Warning! Only use encrypt-then-MAC. There are a number of bad ways to combine encryption and MACs to attempt to build authenticated-encryption schemes. Encrypt-and-MAC (i.e., MAC the message instead of the ciphertext) is one way. MAC-then-Encrypt is another way.

Reminder: You should never need to implement authenticated-encryption schemes yourself. Instead use an off-the-shelf implementation that does the hard work for you. AES-GCM is one popular and widely implemented authenticated encryption scheme

Encrypt-and-MAC is broken

We construct a CPA-secure encryption scheme and an unforgeable MAC, with independently generated keys, whose encrypt-and-MAC composition is not even CPA-secure, and therefore is not CCA-secure. The attack recognizes a deterministic tag of the plaintext.

Let \(n\) be the security parameter. Let \(F\) and \(G\) be secure pseudorandom-function families with \(n\)-bit keys, inputs, and outputs. Generate \[ k_E\getsr\bits^n, \qquad k_M\getsr\bits^n \qquad\text{independently.} \] The keys are chosen once and reused; the encryption randomness below is fresh on every invocation.

Encryption. For \(m\in\bits^n\), define \[ \Enc_{k_E}(m)=\bigl(r,\,m\oplus F_{k_E}(r)\bigr), \qquad r\getsr\bits^n. \tag{9.1}\] Decryption is \(\Dec_{k_E}(r,z)=z\oplus F_{k_E}(r)\). To see CPA security, replace \(F_{k_E}\) with a truly random function. Whenever all sampled \(r\)’s are distinct, its outputs are independent uniform pads, so ciphertexts reveal nothing about the messages. The probability of a repeated \(r\) among polynomially many encryptions is negligible. PRF security then transfers this conclusion to the real scheme.

MAC. Define \[ \Tag_{k_M}(m)=G_{k_M}(m), \qquad \Vrfy_{k_M}(m,t)=\mathbf{1}\{t=G_{k_M}(m)\}. \tag{9.2}\] In the random-function hybrid, the tag of any previously unqueried message is an independent uniform \(n\)-bit string, so a single forgery attempt succeeds with probability \(2^{-n}\). PRF security implies unforgeability for the real MAC. Moreover, every message has exactly one valid tag. Thus a different valid tag for an already queried message is impossible, and the MAC is unforgeable under adaptive chosen-message attacks.

Encrypt-and-MAC. The combined encryption algorithm publishes the encryption and the tag of the plaintext: \[ \boxed{ \EncAM_{k_E,k_M}(m) =\bigl(r,\,m\oplus F_{k_E}(r),\,G_{k_M}(m)\bigr). } \tag{9.3}\] To decrypt \((r,z,t)\), compute \(m=z\oplus F_{k_E}(r)\) and return \(m\) if \(t=G_{k_M}(m)\); otherwise return \(\bot\). Malformed tuples are rejected.

A chosen-plaintext attack. The adversary uses one ordinary encryption query, one challenge query, and no decryption queries.

1. Obtain a reference tag. Choose \(m_0=0^n\) and \(m_1=1^n\). Query the combined encryption oracle on \(m_0\) and retain the tag component \[ t_0=G_{k_M}(m_0). \]
2. Request the challenge. Submit \((m_0,m_1)\) to the challenger and receive \[ C^*=(r^*,z^*,t^*), \qquad t^*=G_{k_M}(m_b), \qquad b\getsr\bits. \]
3. Compare the tags. Output \[ b'=\begin{cases} 0,&\text{if }t^*=t_0,\\ 1,&\text{if }t^*\ne t_0. \end{cases} \]

When \(b=0\), the tags match with certainty. When \(b=1\), the adversary errs only if \(G_{k_M}(m_1)=G_{k_M}(m_0)\), which happens with negligible probability!

No MAC forgery occurs. The adversary only recognizes a tag obtained from a chosen-plaintext query. Randomizing the encrypted component does not randomize the deterministic tag of the same plaintext.

This is overwhelming success, rather than the \(1/2+\negl(n)\) permitted by CPA security. Since the attack needs no decryption oracle, it also breaks CCA security.

MAC-then-Encrypt is Broken

We construct a CPA-secure encryption scheme and an unforgeable MAC, with independently generated keys, whose MAC-then-encrypt composition remains CPA-secure but is completely insecure against a chosen-ciphertext attack.

Let \(n\) be the security parameter. Start with any perfectly correct, CPA-secure symmetric encryption scheme \((\Gen_0,\Enc_0,\Dec_0)\) that supports \(2n\)-bit plaintexts. Let \(G\) be a secure pseudorandom-function family with \(n\)-bit keys, inputs, and outputs. Generate \[ k_E\leftarrow\Gen_0(1^n), \qquad k_M\getsr\bits^n, \qquad\text{using independent randomness.} \]

Encryption with an ignored bit. Define a new encryption scheme by \[ \boxed{ \Enc_{k_E}(x)=\bigl(\Enc_{0,k_E}(x),\,u\bigr), \qquad u\getsr\bits, } \tag{9.4}\] where \(u\) is fresh and independent on every invocation. Its decryption algorithm ignores the bit: \[ \boxed{\Dec_{k_E}(c,u)=\Dec_{0,k_E}(c).} \tag{9.5}\] Malformed pairs, including pairs with \(u\notin\bits\), are rejected. This scheme is CPA-secure: a reduction appends an independent random bit to every ciphertext supplied by the underlying encryption oracle, including the challenge ciphertext. This is a perfect simulation and preserves the adversary’s distinguishing advantage. Both values of \(u\) occur in honestly generated ciphertexts.

MAC. Define \[ \Tag_{k_M}(m)=G_{k_M}(m), \qquad \Vrfy_{k_M}(m,t)=\mathbf{1}\{t=G_{k_M}(m)\}. \] In the random-function hybrid, a forgery on a new message requires guessing an independent uniform \(n\)-bit tag. Each message also has exactly one valid tag, so a different valid tag on a previously queried message is impossible. PRF security therefore makes this MAC strongly unforgeable under adaptive chosen-message attacks.

The MAC-then-encrypt composition. For \(m\in\bits^n\), first compute \(t=G_{k_M}(m)\), then encrypt \(m\concat t\): \[ \boxed{ \EncME_{k_E,k_M}(m) =\bigl(\Enc_{0,k_E}(m\concat G_{k_M}(m)),\,u\bigr), \qquad u\getsr\bits. } \tag{9.6}\] To decrypt \((c,u)\), compute \(x=\Dec_{0,k_E}(c)\). Reject if \(x=\bot\) or if \(x\) is not \(2n\) bits long. Otherwise parse \(x=m\concat t\) with \(|m|=|t|=n\), and return \(m\) if \(t=G_{k_M}(m)\); return \(\bot\) otherwise.

A one-query chosen-ciphertext attack. Choose distinct, equal-length messages \(m_0,m_1\in\bits^n\), for example \(m_0=0^n\) and \(m_1=1^n\). No preliminary encryption queries are necessary.

1. Receive the challenge. Submit \((m_0,m_1)\) and receive \[ C^*=(c^*,u^*), \qquad c^*=\Enc_{0,k_E}\bigl(m_b\concat G_{k_M}(m_b)\bigr), \qquad b\getsr\bits. \]
2. Flip the ignored bit. Construct \[ \boxed{C'=(c^*,1-u^*).} \]
3. Query decryption and decide. Submit \(C'\) to the combined decryption oracle. It returns \(m_b\). Output \(0\) if the response is \(m_0\), and \(1\) if it is \(m_1\).

This query is allowed because \(C'\ne C^*\). The IND-CCA2 game forbids querying the challenge ciphertext itself, not every different ciphertext that decrypts to the same message. By perfect correctness and the fact that decryption ignores \(u\), \[ \Dec_{k_E}(C') =\Dec_{0,k_E}(c^*) =m_b\concat G_{k_M}(m_b). \] The MAC check therefore succeeds: \(\DecME_{k_E,k_M}(C')=m_b\). A single permitted decryption query recovers the challenge plaintext, giving \[ \boxed{\Pr[b'=b]=1.} \]

No MAC forgery occurs. Neither the message nor its tag changes; only their outer ciphertext representation changes. Both values of the ignored bit occur in honest encryptions, so the attack does not depend on accepting an encoding that honest encryption never produces.

Note that the composition remains CPA-secure.

Therefore, the only flavor of authenticated encryption you should use is Encrypt-then-MAC.

9.5 AES-GCM (Galois Counter Mode)

One of the most widely used authenticated-encryption constructions is AES-GCM. It follows the encrypt-then-MAC paradigm. It uses AES as a pseudorandom function for counter-mode encryption from the previous lecture. It uses a Carter-Wegman-style MAC – see previous lecture – as the MAC scheme.

There are a few optimizations that AES-GCM uses beyond what we have described:

• AES-GCM derives both the encryption and MAC keys from a single short key using a pseudorandom function.

• AES-GCM implements a fast form of the Carter-Wegman MAC that does not need arithmetic modulo a big prime \(p\). Instead, of defining the MAC using \(\Z_p\) (integers mod a 128-bit prime \(p\)), GCM works with 128-bit strings. The GCM mode of operation replaces addition modulo \(p\) with XOR of 128-bit strings and it replaces multiplication modulo \(p\) with a somewhat complicated operation on 128-bit strings.

  Formally, the scheme works over the field \(\F_{2^{128}}\) of order \(2^{128}\). This gives a big performance boost with no loss in security.

If you are interested, to implement the multiplication operation: think of both 128-bit strings as polynomials with 128 coefficients in \(\Z_2 = \{0,1\}\). Multiply the polynomials, reducing the coefficients modulo \(2\). Then reduce the resulting polynomial modulo some fixed polynomial of degree-\(128\). Then interpret the result as a \(128\)-bit string.