4
$\begingroup$

What is the the point of an "online" mode for an authenticated cipher?

I understand what "online" means in this context. However, I have trouble coming up with applications that would benefit from such a feature.

Usually, the "messages" that are encrypted and authenticated are not too long and I think that this is due to people not wanting to decrypt "big messages" completely only to throw them away if the tag is finally invalid. So, at least for network protocols, it seems like a very good idea to insert authentication tags more frequently.

But this strategy makes the "online" feature of some AE implementation seem irrelevant especially since support for online modes makes the implementation more complicated.

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ Personally I think the "online" feature isn't very important for authenticated encryption. It might be useful for large files downloaded from an untrusted but rarely actually malicious source. But usually I'd prefer a (tree)hash or signed (tree)hash over a MAC in those scenarios. $\endgroup$ – CodesInChaos Mar 27 '14 at 17:23
  • 1
    $\begingroup$ related. Many schemes for constrained devices will be online because it tends to reduce the amount of temporary storage required. Whilst techincally being online doesn't guarantee this (because in theory an online cipher could collect all the previous messages in it's internal state), generally they have relatively small internal state. $\endgroup$ – Cryptographeur Mar 27 '14 at 18:16
  • $\begingroup$ I should add that many online modes are very simple indeed, in some ways more simple than offline modes. Possibly more of interest is whether you implement the scheme in an online fashion or not. $\endgroup$ – Cryptographeur Mar 28 '14 at 16:52
  • $\begingroup$ The reason I ask this is because most candidates of the CAESAR competition advertise their design to be "online". After having implemented NORX with "online support", I'm wondering whether this was really worth the effort. $\endgroup$ – sellibitze Apr 4 '14 at 12:44
3
$\begingroup$

The usefulness of online AE (locally):
Assume you wrote a program that encrypt arbitrary files. Now further assume the user wants to view a movie, encrypted with this tool. The tool can now use the online-property to stream the movie in real-time as it uses online-encryption.

The usefulness of online AE (programatically):
Assume you want to process sensitive data. If your cipher supports online AE it can wipe the data after having written / read it an thus presents less attack surface.

The usefulness of online AE (network related):
Assume you stream a movie. You can now use the online AE feature to minimize the RAM needed (and thus give more RAM to the video decoder) and you can present the user with better loading times.

All in all:
Online-AE reduces memory usage and latency for applictions.

| improve this answer | |
$\endgroup$
  • $\begingroup$ If you encrypt a movie, you should split the file into segments and authenticate them. It's a bad idea to release unauthenticated data to your video player. Why use authenticated encryption if you don't verify the tag until it's too late? $\endgroup$ – CodesInChaos Apr 12 '15 at 9:40
  • $\begingroup$ @CodesInChaos well, you're right, but point 2 still applies: you can wipe potentially sensitive data earlier. $\endgroup$ – SEJPM♦ Apr 12 '15 at 12:03
2
$\begingroup$

If you want to encrypt a long message with authenticated encryption, you should split it into many small segments (e.g. 4KiB each), with each fragment having its own tag. That way you only release plaintext to the application after verifying its tag. (As usual there are some pitfalls with designing such a construction).

Such a construction works with any AEAD scheme, no need for a single pass primitive. Since releasing unauthenticated data to the application is a security risk, I strongly recommend against supporting streaming decryption for authenticated encryption, unless you implemented such a segment based high level construction.

Single pass primitives might be useful in embedded systems with very little RAM or if you only need streaming on the encrypting but not the decrypting side. For usage with a typical computer or mobile device there is little advantage to "online" authenticated encryption primitives.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.