Using “Additional Authenticated Data” as a secondary key

Question

In implementing a cipher in GCM or CCM mode, you are provided the option to add "Additional Authenticated Data" (AAD). This AAD is required for decrypting the cipher text, and seems to be used when data is crucially specific to a label.

EDIT: to clarify, an example of when it might be used that I have seen is if you want to encrypt the number of shares of a stock that has been purchased, but need to make sure that that number corresponds to the correct stock you would use an AAD containing the name of the stock.

What I am wondering is, could you use this AAD as a secondary key and simply keep it secret?

Thanks

Answer 1

You certainly could keep the AAD secret; however, for GCM, it wouldn't provide any additional security beyond what the secret key already provides; for CCM, it does still provide some limited authentication protection (but probably not enough).

The bottom line: if you can't trust that your key is secret, well, keeping the AAD secret (or have a secret portion) won't help you.

Details:

• If the attacker has a guess for the secret key, he can still verify it, by using that key to decrypt the data, and seeing if the decryption makes sense. He can do this because for both GCM and CCM, the AAD affects only the tag, it does not modify how the ciphertext is converted into plaintext.

• If the attacker has the secret key, he can decrypt ciphertext (just as above).

• If the attacker has the GCM secret key, and has seen one valid encrypted message, he can encrypt any plaintext of his own choosing. This is because the GCM tag can be expressed as $F( Key, Nonce, Plaintext ) \oplus (G( Key, AAD ) \otimes H( Key, Plaintext))$ (where $\otimes$ is multiplication in $GF(2^{128})$). If he has the key, he can compute $F$ and $H$; if he has seen a valid packet, he can solve the above for the value of $G( Key, AAD )$, even if he doesn't know the value of $AAD$.

• If the attacker has the CCM secret key, and has seen one valid encrypted message with a specific nonce, he can encrypt any plaintext of the same length of his choosing with the same nonce. That's because the CCM tag can be expressed as $F_{K, Plaintext}( G(Key, Nonce, AAD, PlaintextLen) )$, where $F_{K, Plaintext}$ is an invertible function; hence, given a valid message, the attacker can recover $G(Key, Nonce, AAD, PlaintextLen)$, and use that to generate a tag for another message with the same length.

The above assumes you transmit the entire 16-byte tag in both cases; if you truncate the tag to $n$ bits, this actually adds some additional protection to CCM (as inverting the $F_{K, Plaintext}$ function does require all 128 bits; if the attacker isn't given all 128 bits, he'll end up having to search for them).