# Can convergent encryption be turned into deterministic authenticated encryption with HMAC?

If you take a convergent encryption algorithm and replace the hash $H$ used to derive the key with HMAC-H, keyed with a secret key $k'$, does the resulting algorithm provide you with deterministic authenticated encryption?

By convergent encryption I mean content-hash keyed encryption, where the hash is encrypted with the user's key (e.g. like this). By deterministic authenticated encryption I mean the definition in the SIV paper by Rogaway and Shrimpton.

I.e. we have a convergent encryption algorithm: $C(k, m) = E(k,H(m))\ ||\ E(H(m),m)$.

We turn it into $D(k, k', m) = E(k, \operatorname{HMAC-H}(k', m))\ ||\ E(\operatorname{HMAC-H}(k', m), m)$.

Is $D$ a deterministic authenticated encryption algorithm, if you verify the HMAC?

Note: the encryption no longer converges for different $k'$, but that is fine. Only the properties of DAE are required here.

• I mean, there would be no feasible way to do it with an ideal MAC, and I don't see any way to utilize HMAC's structure to create an efficient decryption algorithm. $\;$ – user991 Aug 8 '15 at 6:09
• This is a MAC-then-encrypt scheme. If the encryption scheme is vulnerable to e.g. padding oracle attacks then verifying the MAC will be too late. All that said, this does look like it could be an authenticated scheme if the encryption algorithm is chosen well. I'm hesistating if I dare to make that an answer though (ps. thanks for the edits, removed previous comments relating to previous versions of the question). – Maarten Bodewes Aug 12 '15 at 12:14