I'm currently reading Cryptography Engineering and in Chapter 7, the topic of secure channel is discussed.
The channel described is using CTR for encryption. Below I include images with pseudo-code used in the book (source):
In Secure Channel: Initialization, 4 different keys are generated (assuming no collisions).
In Secure Channel: Sending a Message the key stream is generated using KeySendEnc as the key to the encryption function (let's say we're using AES here). Then, what we do is XOR the message we want to encrypt (plaintext || authenicated plaintext) with the key stream generated in the previous step. To authenticate the plain text, KeySendAux is used. Up to this point, everything makes sense.
Now, in Secure Channel: Receiving A Message, KeyRecEnc is used as the key to generate the key stream k. Then, the encrypted message is XORed with this k to obtain the original message (plaintext || authenicated plaintext). If KeyRecEnc ≠ KeySendEnc, then the key stream k, generated in the two cases is different. My question is exactly here, how do we obtain the original message if we XOR the ciphertext with some other key stream, different from the one that we used to encrypt the message in Secure Channel: Sending a Message.
Then, KeyRecAuth (KeyRecAuth ≠ KeySendAuth) is used to obtain a MAC. This MAC is then compared with the received MAC (after it's decrypted). How can those two MACs can ever be the same (ignoring collisions), since the input to the HMAC-h function is different in both cases (because KeyRecAuth ≠ KeySendAuth).
Thanks in advance.