I've seen the term mentioned in a paper by the Keccak team here, and by Adam Langley here when talking about properly authenticating stream ciphers.

What does it actually mean, and how does it work? What are its advantages in the case of encrypting and authenticating streams?

  • 1
    $\begingroup$ My spontaneous guess: It's the same as "intermediate tag generation" which allows you to verify integrity and thus clear the buffer before the full message is processed (but I haven't actually looked at the given references). $\endgroup$ – SEJPM Apr 22 '17 at 8:48

It looks like the first paper you linked hints at an explanation.

From what I can tell the idea is the same as with "intermediate tags", that is you have an instance of your cipher and you process all the data up to some point, then create a MAC-tag, insert it into the data stream for later verification and continue with the very same instance to process more data. The paper says:

With appropriate domain-separating padding the security proofs allow the sponge states to be used for any number of consecutive authenticated messages (“MAC-and-Continue”) without the need for sequence numbers, and re-keying.

So why should one want to do this?

TL;DR: It's a "nice feature" to the programmer and data structure designer.

Strictly speaking you cannot be sure of the security of a decrypted message until you have fully verified the integrity of the entire message. That means if your message is 1MB you have to authenticate and decrypt the entire 1MB message before your crypto implementation should pass it on to the application. And with usual modes the tag marks the end of the message meaning you have to potentially re-initialize instances and worry about what the new nonce shall be. "Mac-and-Continue" simplifies that in that you can just insert a tag pretty much anywhere in the 1MB chunk and then all the data up to that tag is authenticated, meaning it can be handed to the application much sooner than expected. This helps to reduce buffer sizes, reduce latency (as you have less to process before being able to pass it on) and it eliminates the worries you would have if you had to manually design a mode that has chunks (which means defining nonces, protecting against re-ordering attacks and re-initializing your mode object).

|improve this answer|||||
  • $\begingroup$ Thanks for the answer! I'm just wondering, would each of these chunks be their own distinct ciphertext? As in with their own nonces, etc. $\endgroup$ – Awn Apr 22 '17 at 15:44
  • 1
    $\begingroup$ @Awn they wouldn't​ have their own nonces and are kind of a hybrid between "completely separate" and "only on ciphertext" $\endgroup$ – SEJPM Apr 22 '17 at 15:45
  • $\begingroup$ Interesting. Going to look into that, sounds sick. $\endgroup$ – Awn Apr 22 '17 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.