Recently there has been growing interest in the committing security of authenticated encryption with associated data (AEAD). Although many schemes have been analyzed for security in this notion, some schemes in the standards have not been considered yet. Grain-128a is an AEAD scheme based on a stream cipher, which are incorporated into ISO standards. We give an attack for this scheme, showing that this standardized scheme does not achieve committing security. Subsequently, we analyze the committing security of generic composition schemes for AEAD based on stream cipher, which can be reduced to the collision of the universal hash functions. We analyze several commonly used universal hash functions but with negative results. Encouragingly, we show that two out of three deterministic AEAD (DAEAD) schemes can achieve committing security if the stream cipher satisfies bind security, which also provides insights for designing committing AEAD schemes. Subsequently, we give a fix for ChaCha20-Poly1305 with this inspiration.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Committing Security of AEAD Based on Stream Cipher

  • Xueqi Zhu,
  • Yan Jia,
  • Jun Xu,
  • Peng Wang

摘要

Recently there has been growing interest in the committing security of authenticated encryption with associated data (AEAD). Although many schemes have been analyzed for security in this notion, some schemes in the standards have not been considered yet. Grain-128a is an AEAD scheme based on a stream cipher, which are incorporated into ISO standards. We give an attack for this scheme, showing that this standardized scheme does not achieve committing security. Subsequently, we analyze the committing security of generic composition schemes for AEAD based on stream cipher, which can be reduced to the collision of the universal hash functions. We analyze several commonly used universal hash functions but with negative results. Encouragingly, we show that two out of three deterministic AEAD (DAEAD) schemes can achieve committing security if the stream cipher satisfies bind security, which also provides insights for designing committing AEAD schemes. Subsequently, we give a fix for ChaCha20-Poly1305 with this inspiration.