There is a handful of attacks against AEAD, and GCM in particular, which demonstrates that it is feasible for an attacker $\mathcal{A}$ to obtain a ciphertext $C$ which encrypts to multiple key/message pairs $(k_i, M_i)$. This is commonly referred to AES-GCM not being key-committing. Now, I'm a bit confused about the nature of the attacks that are possible with this, do I understand correctly that $\mathcal{A}$ needs to be able to 'modify' the ciphertext $C$ to be able to perform the outlined attacks? Or is it also possible for $\mathcal{A}$, given a fixed $C$ encrypting $m_1$ under $k_1$, to obtain another decryption $m_2$ which yields $C$ under another key $k_2$?
$\begingroup$
$\endgroup$
2
-
1$\begingroup$ Can an authenticated encryption scheme detect if wrong key is used? $\endgroup$– kelalakaCommented Jun 21, 2022 at 18:21
-
$\begingroup$ And the result of non-commitment; Understanding the impact of partitioning oracle attacks on stream ciphers $\endgroup$– kelalakaCommented Jun 21, 2022 at 20:34
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
do I understand correctly that $\mathcal{A}$ needs to be able to 'modify' the ciphertext $C$ to be able to perform the outlined attacks?
No, these attacks assume that the attacker generates $C$; he takes a number of keys $k_1, k_2, ..., k_n$, and using those, generates a ciphertext $C$ that 'decrypts' successfully (that is, the integrity tag check succeeds) under all of them.
Or is it also possible for $\mathcal{A}$, given a fixed $C$ encrypting $m_1$ under $k_1$, to obtain another decryption $m_2$ which yields $C$ under another key $k_2$?
We don't know how to do that; the attack we know about requires that the attacker has some flexibility in choosing $C$. Now, he doesn't need to specify the entire value; he does need to specify at least 2 16-byte blocks to construct a $C$ that will decrypt under two different keys).
-
$\begingroup$ Thanks for the response! Very interesting, I read another paper which states that Unlike CBC-HMAC, GCM is not committing 1: for a given ciphertext and tag ($C$,$T$ ) encrypted with key $k$, one can find $k'$ ≠ $k$ that decrypts $C$ to a different plaintext while computing the same tag, as GCM MAC is not collision-resistant. I suppose this claim is then incorrect, as the attack to this specific setting is unknown, no? $\endgroup$ Commented Jun 22, 2022 at 16:56
-
$\begingroup$ @SeminalWorker: yes, I believe that paper misstates things; you need some flexibility in choosing the ciphertext and/or tag (unless they are assuming flexibility in choosing the AAD, which for this attack can be treated as ciphertext). $\endgroup$– ponchoCommented Jun 22, 2022 at 17:38
-
2$\begingroup$ @SeminalWorker: here's the issue: the tag computation can be summarized as $F(C, H) + G(K, IV) = tag$; they note that $F$ doesn't have a lot of cryptographical strength; for example, given $C$ and $F(C, H)$, we can efficiently find all the $H$ values that would generate that target value (and there is often more than 1). On the other hand, $H$ (and $G(K, IV)$) are a complex function of the key; given a value of $H$ that we want, we don't know how to generate a key that would generate that $H$. $\endgroup$– ponchoCommented Jun 22, 2022 at 17:47