# Flaw in the security definition of Stateful Length-Hiding Authenticated Encryption (sLHAE)?

In the paper On the Security of the TLS Protocol: A Systematic Analysis, the authors define the notion of a stateful length-hiding authenticated encryption scheme (sLHAE). For the purpose of this question you can just ignore the length-hiding part of sLHAE, since my question deals only with the stateful part.

A stateful (length-hiding) authenticated encryption scheme is a quadruple $\mathsf{stE} = (\mathsf{stE}.\mathsf{Gen},\, \mathsf{stE}.\mathsf{Init},\, \mathsf{stE}.\mathsf{Enc},\, \mathsf{stE}.\mathsf{Dec})$, with all the usual definitions (probabilistic encryption, deterministic decryption, possibility of returning $\perp$ both in encryption and decryption etc...).

The security of sLHAE scheme is defined in terms of a left-right indistinguishability game (Fig.6, page 45), giving the adversary access to an encryption and decryption oracle:

In the paper the authors explains the test on $\mathsf{phase}$ in the decryption oracle $\mathsf{Dec(\cdot)}$ as follows:

However I claim that I (the adversary) can trivially win this game still:

1. Choose a random ciphertext $C$ and ask for its decryption (here and below we ignore all header data $H$, and output lengths $\ell$).
2. In the decryption oracle, if $b = 1$ then $j$ becomes 1, the test $j > i$ pass and hence $\mathsf{phase} \gets 1$.
3. Pick a random message $m^*$ and ask for its encryption two times. I.e. send the tuple $(m^*, m^*)$ to $\mathsf{Enc(\cdot)}$ twice, and store the last returned ciphertext $c^*$. Now $i=2$.
4. Send $c^*$ to the decryption oracle.
5. If $b=1$ then $j$ becomes 2 and the test on line 4 of $\mathsf{Dec(\cdot)}$ will fail ($j = i$, $c^* = c_2$ and $H = H_2$). HOWEVER at no point did $\mathsf{phase}$ become 0 again after Step 2. So the test in line 6 will pass. Hence $\mathsf{Dec(\cdot)}$ will return $m^*$ (which is distinct from $\perp$).

Thus we can trivially distinguish the situations $b= 0$ and $b=1$, with probability 1.

What am I missing?

-
However, the conclusion I draw in the last sentence of point 5 is wrong. Whether the decrypted $m^*$ returned in point 5 differ from $\perp$ or not depends heavily on the stateful decryption semantics of $\mathsf{stE}$. I wrongfully neglected the influence of the current state on what happens when $\mathsf{stE}$ decrypts. In particular, for any reasonable stateful encryption scheme (like TLS), the out-of-sync state resulting from my attack scenario would certainly lead it to output $\perp$ in point 5.