Non-committing authenticated encryption schemes vs committing authenticated encryption schemes

Question

I'm told that TLS 1.3 supports only non-committing authenticated encryption schemes. What is a non-committing authenticated encryption scheme? What is the difference between committing and non-committing authenticated encryption schemes? What are the pros and cons?

Answer 1

A committing authenticated encryption scheme is an encryption scheme where the ciphertext & tag could only have been created by one specific key. A non-committing authenticated encryption scheme is then one where an attacker may have created a valid ciphertext / tag combination using a different key.

The problem for the attacker is of course that they won't know if a specific combination is valid a-priori. If that wasn't the case then an attacker could launch a man-in-the-middle attack.

---

A committing scheme has in principle more security as you can prove that the message was created by the right party.

This may of course also work the other way as it also means that there is no plausible deniability either. This is less of a problem with symmetric ciphers as you can only link the ciphertext to a specific entity if you have the secret key.

---

TLS is a protocol where the keys are established by both parties beforehand. As such, it is not directly affected by ciphers that are committing or not. Attackers should not be able to change existing messages or transmit different, valid messages using the wrong key after all.

---

For more, easy to understand information here is a nice set of slides created by Paul Grubbs for a meeting in November of 2019.