I came across something known as deterministic authenticated encryption in my studies, and a lot of people were associating it with Synthetic IV mode.

I am having trouble understanding what exactly DAE is because I thought that if something was deterministic, it didn't have a sense of authenticated encryption. It violates the confidentiality of the message -- deterministic encryption modes are prone to CPA attacks.

Can someone explain in layman's terms what exactly DAE is? How does DAE differ from just normal deterministic encryption modes like ECB mode?

  • $\begingroup$ In layman's terms, it's exactly what it sounds like. ​ It's supposed to provide $\hspace{1.79 in}$ the deterministic version of confidentiality. ​ ​ ​ ​ $\endgroup$ – user991 Mar 15 '16 at 12:19
  • 1
    $\begingroup$ Are we talking about (fully) nonce misuse resistant authenticated encryption (like SIV) here or simple (stateful) nonce-based authenticated encryption (like GCM)? $\endgroup$ – SEJPM Mar 15 '16 at 13:10
  • 5
    $\begingroup$ Opposite to nonce based authenticated encryption, DAE takes as input only the associated data, the plaintext and the key and outputs a ciphertext. SIV is a good example of this. The point is to use such primitives in a context where the use of a IV is rendered irrelevant because the plaintext distribution is of high entropy (such as key encryption) $\endgroup$ – Alexandre Yamajako Mar 15 '16 at 13:18

Deterministic authenticated encryption indeed provides authenticity and it doesn't require a nonce or IV. In that sense it doesn't provide CPA security as identical messages would result in identical ciphertext.

Authentication however doesn't really have to do with CPA security. It is about ensuring that the ciphertext was created by a specific party holding the secret key. In other words it provides authenticity of the ciphertext (and therefore plaintext). Furthermore it ensures that the integrity of the plaintext after decryption (and possibly the ciphertext before decryption) is maintained; i.e. that the ciphertext wasn't altered by an attacker or damaged somehow. If not the verification of the authentication tag will fail.

DAE differs with ECB in the sense that ECB doesn't provide authenticity or integrity of the ciphertext (if multiple blocks of plaintext are encrypted anyway). Furthermore ECB mode leaks information if identical plaintext blocks are encrypted. SIV mode on the other hand calculates an IV using the entire input. Even if just a single bit of plaintext is different the entire ciphertext will be indistinguishable from ciphertexts created from previous plaintexts.

This matters if you for instance wrap a large set of keys that do not encode to fully randomized blocks of data. Take for instance an RSA private CRT key, which consists of many numbers. Usually these are encoded, including the public modulus. It could well be that the same block contains only one byte of a private value. If you have many of those blocks then you will find duplicates, leaking information about the RSA private key. Horrible practices such as wrapping RSA keys using only ECB or CBC (using a zero-valued IV) are pretty wide spread.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.