Compactly Committing Authenticated Encryption Using Encryptment and Tweakable Block Cipher

Message franking is a feature of end-to-end encrypted messaging introduced by Facebook that enables users to report abusive contents in a verifiable manner. Grubbs et al. (CRYPTO 2017) formalized a symmetric-key primitive usable for message franking, called compactly committing authenticated encryption with associated data (ccAEAD), and presented schemes with provable security. Dodis et al. (CRYPTO 2018) proposed a core building block for ccAEAD, called encryptment, and presented a generic construction of ccAEAD combining encryptment and conventional AEAD. We show that ccAEAD can be built on encryptment and a tweakable block cipher (TBC), leading to simpler and more efficient constructions of ccAEAD than Dodis et al.’s methods. Our construction, called EnCryptment-then-TBC (ECT), is secure under a new but feasible assumption on the ciphertext integrity of encryptment. We also formalize the notion of remotely keyed ccAEAD (RK ccAEAD) and show that our ECT works as RK ccAEAD. RK ccAEAD was first considered by Dodis et al. as a useful variant of ccAEAD when it is implemented on a platform consisting of a trusted module and an untrusted (leaking) module. However, its feasibility was left open. Our work is the first to show its feasibility with a concrete scheme.