I have doubts for the definition of the decryption algorithm $D(.)$. I think I've already seen that the decryption returns a plaintext $M$ on input the key $K$ and $C=E_K(M)$. I have also seen thet ...
In the paper On the Security of the TLS Protocol: A Systematic Analysis, the authors define the notion of a stateful length-hiding authenticated encryption scheme (sLHAE). For the purpose of this ...