# Is there an existing AEAD scheme with minimal IV requirements?

Is there an existing AEAD scheme such that, for inputs with the same AD and IV

1. ciphertexts are allowed to leak whether or not their plaintexts are equal,
2. if the scheme can process the plaintext in a streaming manner, then it is allowed to leak where different plaintexts have their first difference, and
3. is otherwise secure against an adversary that can choose the IVs used for encryption?
-
You can in principle describe AES-CBC with encrypted IV + an IV-less MAC (CBC-MAC or HMAC) as an AEAD. I think it'd fulfill your requirements. – CodesInChaos Apr 13 '13 at 20:35
I'm not clear on what you mean by "encrypted IV", but I think that would allow detecting $\hspace{1 in}$ equality of plaintexts that had different cleartexts. $\:$ – Ricky Demer Apr 13 '13 at 20:59

## 1 Answer

Sounds like you might be after deterministic authenticated encryption. Check out SIV mode. This mode doesn't use an IV at all (though it does generate one internally, outside of the attacker's control). Being deterministic, it leaks equality of (header, plaintext) pairs.

The basic idea is to put the (header, plaintext) pair through a PRF, such as HMAC, and use the result as an IV for, e.g., CTR mode. After decryption, you check authenticity by checking to see if you can reproduce the IV's value.

If you want to be able to stream plaintexts, look into "Online ciphers from Tweakable Blockciphers". As you anticipate, these schemes leak shared prefixes but are otherwise secure. But note that this latter paper does not consider authentication, and generic techniques that assume standard IND-CPA security may not work. See "On-Line Ciphers and the Hash-CBC Constructions" for how to get AE in this context.

-
The AE proof for the last link uses random IVs, and I can't figure out whether it actually needs those. $\hspace{.55 in}$ (SIV mode seems fine, though.) $\;\;$ – Ricky Demer Apr 14 '13 at 23:14
It looks like if you change "Prepend randomness and message length, and append redundancy" to "Prepend message length and append redundancy", you'd lose IND-CPA security, retain OPerm security (modulo length-preservation), and still gain INT-CTXT security. But you'd also lose the ability to do streaming encryption in cases where the message length is not known in advance. – Seth Apr 15 '13 at 17:35