5
$\begingroup$

I am trying to solve the question whether "IPsec is IND-CCA secure provided the used block cipher is a pseudorandom function" (with IPsec using a variant of Encrypt-then-MAC)

As a resource I am given the paper Mihir Bellare & Chanathip Namprempre (2000). Authenticate andd Encryption: Relations among notions and analysis of the generic composition paradigm

where I should focus on Theorem 3.2, which is the following implication:
INT-CTXT $\wedge$ IND-CPA $\rightarrow$ IND-CCA

Accordingly, I am trying to verify that the antecedent of the implication holds when using a pseudorandom function as a block cipher. I am currently stuck with the part whether the property of IND-CPA security holds. If I understood it correctly, the IND-CPA security depends on the mode of operation in which the pseudorandom function is used. In our lecture it was mentioned that an encryption scheme using a pseudorandom function as block cipher is indeed CPA-secure if the CTR mode (with a randomly chosen initial ctr) or the CBC mode is used. However, as far as I know it does not hold for other modes.

Therefore, I would like to know which mode of operation is used by IPsec and whether my approach makes sense.

Improve this question
$\endgroup$
4
  • $\begingroup$ Did you mean pseudo-random-permutation? $\endgroup$
    – CodesInChaos
    Commented Jan 6, 2016 at 15:25
  • $\begingroup$ No, the block cipher should really be a pseudorandom function, not a pseudo-random-permutation. $\endgroup$
    – Sky Passaro
    Commented Jan 6, 2016 at 15:31
  • $\begingroup$ But why are you mentioning CBC mode then, which is not compatible with PRFs? The proper model for a block cipher is a (strong) PRP. Since PRPs can approximate PRFs up to the birthday bound we can use PRPs even in PRF assuming modes like CTR. $\endgroup$
    – CodesInChaos
    Commented Jan 6, 2016 at 15:35
  • $\begingroup$ In the lecture we were told that if we have a PRF and the message length is fixed, then the CBC-mode with a random IV for each message is IND-CPA secure. That is why I mentioned the CBC mode and thought that it was compatible with PRFs. Further, in the exercise it is explicitely stated that the block cipher has to be a PRF. Therefore, I have to prove it for a PRF and not a PRP. $\endgroup$
    – Sky Passaro
    Commented Jan 6, 2016 at 15:54

1 Answer 1

Reset to default
2
$\begingroup$

I would like to know which mode of operation is used by IPsec

That depends on what is negotiated; if we assume we're using AES as the block cipher, then the standard modes (that is, ones which have transform numbers assigned by IANA) are CBC, CTR and GCM.

and whether my approach makes sense.

Sounds good to me.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thank you for your answer! What I still need to know is which modes are used in the case of a pseudorandom function as a block cipher. Your examples refer to AES as the block cipher if I understood it correctly. Also the encryption scheme must be EtA and not AtE or E&A, are the modes you mentioned all EtA? $\endgroup$
    – Sky Passaro
    Commented Jan 6, 2016 at 15:23
  • 1
    $\begingroup$ @SkyPassaro: technically speaking, GCM is neither EtA nor AtE nor E&A, but instead is a combined mode (which does both encryption and authentication; all the details are hidden within the mode). As for CBC and CTR mode, the modes themselves don't do authentication; however the standard ways of doing the transform is, in fact, EtA. However, there's nothing in the RFCs that say that you have to do it that way (or, in fact, that you have to do authentication at all); if you somehow configure things to do AH and then an outer ESP (without authentication), you're in AtE-land. $\endgroup$
    – poncho
    Commented Feb 5, 2016 at 17:29
  • 1
    $\begingroup$ @SkyPassaro: this imples that you can't prove IND-CCA for all modes of operation (that's actually known not to be true; for example, you don't have to encrypt). Instead, you need to make assumptions about which IPsec transforms are being used (and in which order). $\endgroup$
    – poncho
    Commented Feb 5, 2016 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.