Is including the key as AAD actually dangerous?

Question

In a recent answer, Maarten mentioned

including the key is a bad idea as well.

This got my curious. Is there any scientific / cryptographic analysis whether including the key in the authentication actually allows for (easier) attacks in the standard model(s) for authenticated encryption?

_{Obviously this means that both sides include the key in the AAD but don't send it in clear.}

I also see that it's kinda pointless to include it, but is it actually dangerous? (less formal than above)

If no generic answer is possible, please assume AES-GCM as the scheme in question

Answer 1

One potential issue with GCM is that it can potentially make the problems you get from repeating nonces worse; instead of allowing you to forge, and revealing the plaintext for the packets with the repeated nonces, it can become a key recovery issue.

Here's one way it can happen; suppose the AAD is the 128 bit key, and you repeat the nonce with three different messages of different lengths (a 1 block, a 2 block and a 3 block message). Then, the three GCM tags are computed as:

$$KH^3 + C_1H^2 + C_2H + Y = T_1$$ $$KH^4 + C_3H^3 + C_4H^2 + C_5H + Y = T_2$$ $$KH^5 + C_6H^4 + C_7H^3 + C_8H^2 + C_9H + Y = T_3$$

where $K$ is the unknown key, $H$ is the unknown $H = E_k(0)$ value, $Y$ is the unknown value $Y = E_k(nonce)$ used to protect the tag (and because all three messages use the same nonce, they have that value in common), and $C_1, ..., C_9$ and the tag values $T_1, T_2, T_3$ are values known to the attacker.

These are three polynomial equations in three unknowns; they can be combined into a single fourth degree polynomial in $H$ (and not $K$ or $Y$); it can be solved for $H$ (giving up to 4 possible solutions), from that, you can recover the secret key $K$ value as one of 4 possibilities.

Answer 2

I think the realistic answer is that we don't know if it's dangerous. In cryptography, anything we don't know the security properties of needs to be treated by default as if it's insecure.

To my knowledge, GCM (and similarly HMAC) haven't been extensively analyzed from the perspective of having the key included as the message, either in whole or in part. Realistically, they're probably secure when used in this capacity, but history is littered with constructs that seemed to be secure at first but turned out not to be in the scope of a larger cryptosystem - MAC-then-Encrypt and Encrypt-and-MAC come to mind.

Answer 3

As a concrete example of a recent discussion where a similar question was considered, the IRTF draft for AES-GCM-SIV was at one point revised because of possible attacks on protocols that (unjustifiably) assume that their AAD is confidential:

The major change in this update is the use of nonce-specific POLYVAL keys. Previous versions of GCM-SIV did not do this and, instead, used part of the AEAD's key as the POLYVAL key. Bleichenbacher pointed out (https://mailarchive.ietf.org/arch/msg/cfrg/qgh-Yxmj7CC7cq2YZLpmfGA3x-o) that this allowed some unexpected behavior if AES-GCM-SIV is used under the assumption that the additional data is confidential. In such a case, an attacker who controls the AEAD key can force the POLYVAL key to be zero. If a user uses this AEAD to authenticate messages based on a secret additional-data value, then this would be insecure, as the attacker could calculate a valid authenticator without knowing the input. This does not violate the standard properties of an AEAD, as the additional data is not assumed to be confidential. However, it demonstrates that AES-GCM-SIV is not a drop-in replacement to AES-GCM in this scenario. We want the AES-GCM-SIV AEADs to be robust to plausible misuse and also to be drop-in replacements for AES-GCM, and therefore derive nonce-specific POLYVAL keys to avoid this issue.