Generalized Initialization of the Duplex Construction

The duplex construction is already well analyzed with many papers proving its security in the random permutation model. However, so far, the first phase of the duplex, where the state is initialized with a secret key and an initialization vector ( \( IV \) ), is typically analyzed in a worst case manner. More detailed, it is always assumed that the adversary is allowed to choose the \( IV \) at will. However, in practice, the adversary can be stripped of its power to control the \( IV \) in several ways. One prominent way of doing this is the use of a nonce ( \( IV \) ) masked with a secret, as done in AES-GCM in TLS 1.3. In this paper, we analyze how the security of the duplex construction changes if restrictions on the choice of the \( IV \) are imposed. In particular, we evaluate several strategies that can achieve this, varying from the \( IV \) on key case over the global nonce case to the random \( IV \) case. We apply our findings to duplex-based encryption and authenticated encryption, compare the different strategies, and discuss the practical applications of our results.