2
$\begingroup$

I was reading the Hybrid Public Key Encryption (HPKE) RFC and I came across this sentence in section 9.4 "All AEADs MUST be IND-CCA2-secure, as is currently true for all AEADs listed in Section 7.3."

My first thought is that AE (Authenticated Encryption) implies IND-CCA2 by definition ("Introduction to Modern Cryptography" by Katz and Lindell: "A private-key encryption scheme is an authenticated encryption (AE) scheme if it is CCA-secure and unforgeable") and this is the commonly accepted definition of "AE(AD) security".

So where is the catch? I presume the authors of the RFC have a different interpretation of what is an "AEAD scheme" since my interpretation is "it is AE-secure according to the definition". I googled a bit and found a few papers also discussing stuff like "IND-CCA secure AEAD" so I assume there is something wrong with my understanding of "AE(AD) schemes". Do they just mean that the algorithm has the "AEAD interface", i.e. input to encryption function is (key, nonce, AD, plaintext), and it does not make any claims about security?

Improve this question
$\endgroup$
8
  • $\begingroup$ It is mentioned in a section of generic security requirements for the primitives. That they comply is no surprise and I think that is why there is just a single line ticking off the requirement. I'm not 100% on this, but you may be looking for a catch that isn't there. $\endgroup$
    – Maarten Bodewes ♦
    Oct 4 at 9:48
  • $\begingroup$ @MaartenBodewes It is possible but this message by one of the authors in the IETF mailing list additionally confused me mailarchive.ietf.org/arch/msg/cfrg/mP7swra3Mfni5KoPg2NKFccWTOk. "AES-SIV is by definition not IND-CCA2-secure. Therefore, AES-SIV cannot be registered as an AEAD per the requirements established in RFC9180." In AES-SIV RFC datatracker.ietf.org/doc/html/rfc8452 it called an "AEAD scheme": how can an authenticated encryption scheme be not IND-CCA2 secure? Thats why I think their definitions are probably different. $\endgroup$
    – honzaik
    Oct 4 at 10:09
  • 1
    $\begingroup$ @honzaik Obviously indistinguishable means that the cipher produces a different, randomized ciphertext each time a message is encrypted. AES-SIV is basically a deterministic scheme, although it can be randomized. That randomization is however not a requirement for SIV, so it is not IND-CCA2. AES-SIV + nonce would be CCA2 secure. The scheme is resistant against nonce-reuse, but if the nonce is reused it obviously doesn't offer IND-CCA2. Again, that's my understanding of the topic. $\endgroup$
    – Maarten Bodewes ♦
    Oct 4 at 11:08
  • 1
    $\begingroup$ AEAD stands for Authenticated Encryption with Associated Data. AES-SIV provides all of this at face value. That some author of an RFC doesn't allow for AES-SIV for some reason or other doesn't negate that. In the end terms and definitions are based on context, and apparently the author of the RFC has some context that is not present in the RFC... You may need to ask the author and send them an email. It would be very interesting to see their reply, which you could post as an answer (do notify the author of this). $\endgroup$
    – Maarten Bodewes ♦
    Oct 4 at 12:12
  • 1
    $\begingroup$ @MaartenBodewes yes that is my plan. I just wanted to ask here first if it is something which would be "common knowledge" since the terminology is used across multiple RFCs. $\endgroup$
    – honzaik
    Oct 4 at 12:36

1 Answer 1

Reset to default
2
$\begingroup$

The security guarantee of the SIV mode (as is) is that it is a Deterministic AE(AD) scheme. This means that SIV is an AEAD scheme as long as the adversary is restricted to only encrypting the same message-header pair once, and the adversary never asks for decryption of ciphertext with headers previously queried.

Given its deterministic nature, SIV (as is) doesn't conceal repeated encryption and, therefore, cannot CCA secure in the classical sense.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.