The AEAD scheme SpongeWrap based on the sponge construction gets only a header (additional data), a body (the message) and a key as input values, according to the paper where it is defined.

What is missing compared to other AEAD schemes is a nonce to make the key stream unique. I am wondering, why this is possible. The way I understand it, the sponge state for the first message block only depends on the key and the AD, thus an adversary is able to decrypt at least that first block, if key and AD are reused.


1 Answer 1


Indeed, the SpongeWrap paper does not claim CPA security (or, really, any kind of privacy protection at all) unless a nonce is included in the associated data, or the associated data can otherwise be guaranteed to be unique for each message. In particular, if you look closely at section 2.2, you'll find the following note at the end of page 3:

For privacy, we consider only adversaries who respect the nonce requirement. For a single header-body pair, it means that, for any two queries $(A, B)$ and $(A′, B′)$, we have $A = A′ ⇒ B = B′$. In general, the nonce requirement specifies that for any two queries $(\overline{A, B})$ and $(\overline{A′, B′})$ of equal length $n$, we have $${\rm pre}(\overline{A, B}) = {\rm pre}(\overline{A′, B′}) ⇒ B^{(n)} = B′^{(n)},$$ with ${\rm pre}(\overline{A, B}) = (A^{(1)}, B^{(1)}, A^{(2)}, \dots , B^{(n−1)}, A^{(n)})$ the sequence with the last body omitted. As for a stream cipher, not respecting the nonce requirement means that the adversary can learn the bitwise difference between two plaintext bodies.

  • $\begingroup$ Thanks. Still weird, that the authors put such an important information in a sidenote and did not integrate it directly into the algiorithm. $\endgroup$
    – mat
    May 24, 2017 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.