Authenticated Encryption
Stub. Combining confidentiality and integrity into one primitive: the authenticated encryption (AE) definition, why it implies security against chosen-ciphertext attacks, generic composition (encrypt-then-MAC vs. MAC-then-encrypt, and the padding-oracle attacks that make the latter dangerous in general), nonce-based AE with associated data (AEAD), and case studies — GCM, the TLS 1.3 record protocol, an SSH non-atomic-decryption attack, and WEP as a badly broken historical example.
Corresponds to Chapter 9, entirely new territory — nothing in this vault yet treats confidentiality and integrity as a single combined primitive. Authenticated encryption requires both: ciphertexts must be indistinguishable (as in CPA security) and unforgeable (as a MAC would guarantee), and the combination is exactly strong enough to resist chosen-ciphertext attacks (a decryption oracle gives nothing useful to an adversary who can’t forge new valid ciphertexts). Covers generic composition from separate encryption and MAC primitives: encrypt- then-MAC is always secure given secure components, while MAC-then- encrypt is not secure in general — the chapter’s motivating case studies are the padding oracle attacks on SSL this exact pitfall enabled. AEAD (authenticated encryption with associated data) extends the definition to let some data be authenticated but not encrypted (e.g. a packet header). Case studies: GCM (Galois counter mode, combining counter-mode encryption with a Carter-Wegman-style MAC), the TLS 1.3 record protocol (see transport-layer-security-and-tls for the surrounding handshake), an attack on non-atomic decryption in SSH, and 802.11b WEP as a case study in nearly everything going wrong at once.
Outline (TODO — flesh out each)
- Authenticated encryption — definitions; one-time AE
- Chosen ciphertext attacks — a motivating example; definition
- Authenticated encryption implies CCA security
- Encryption as an abstract interface
- Generic composition: encrypt-then-MAC
- Generic composition: MAC-then-encrypt and padding oracle attacks on SSL
- Secure instances of MAC-then-encrypt
- Encrypt-then-MAC vs. MAC-then-encrypt
- Nonce-based AEAD; CCA-secure ciphers with associated data
- Case study: Galois Counter Mode (GCM)
- Case study: the TLS 1.3 record protocol
- Case study: a non-atomic-decryption attack on SSH
- Case study: 802.11b WEP
- Fun application: private information retrieval