# Why is EAX not a generic composition?

In the document http://web.cs.ucdavis.edu/~rogaway/papers/eax.pdf (p. 7) Rogaway et. al. state that EAX is not a generic composition of an encryption and an authentication method.

The EAX algorithm is given in the following Image:

(the image is taken from p. 7 of the referenced paper and simplified by omitting the associated data)

So, the plaintext M is encrypted by a CTR block cipher mode and the resulting ciphertext is authenticated by an OMAC tag. So far, this looks pretty much like an encrypt-then-authenticate based generic composition. The only thing particular here is, that the tag $\mathcal{C}$ isn't the final tag but is XORed by the tagged nonce $\mathcal{N}$.

My questions are:

1. Why isn't EAX considered to be a generic composition ?
2. Would EAX be a generic composition of the block cipher mode encrytion and the OMAC authentication, if $\mathcal{C}$ would be used as authentication tag T ?

Added: Actually, I think the answer depends on the point of view.

(1) Proof of security: Security proofs for generic compositions assume that two different, independet keys are used for encryption and authentication. As EAX uses the same key for both, security results for generic compositions don't apply to EAX. So in this point of view EAX is not a generic composition.

(2) Design principle: When one tries to classify AE algorithms, one can look how they are designed. By design, a generic composition is an algorithm that runs an encryption and an authentication algorithm in a (generic) order that is independent from the primitives: E.g. Encrypt-then-Authenticate, Authenticate-then-Encrypt, etc. In this point of view I would consider EAX (as well as CCM) as a generic composition.

When reading the paper, it seems that there are three or so properties that make a generic authenticated encryption method:

1. a generic encryption method and MAC are used;
2. two different keys are used for both;
3. two pass encryption is used (generally encrypt-than-MAC).

EAX uses two well defined algorithms: AES and CMAC. So it seems the definition fails on (1). As EAX uses only 1 key it will always fail on (2) as well.

But yes, if you do not consider the special way $\mathcal{N}$ is constructed then EAX outputting just $\mathcal{C}$ could be considered a relatively generic construction when it comes to (3).

Adding it up, I personally think this should be a big NO, EAX is not a generic construction as defined in the paper; and just outputting $\mathcal{C}$ only makes a tiny difference.

• Thanks for your answer. I agree with (2): The authors certainly require a generic composition to use two different, independet keys for encryption and authentication, what EAX does not do. However, I disagree on (1). The algorithms for CTR and OMAC in Fig. 1 (p. 6) of the paper are specified for any block cipher E, not just for a particular block cipher like AES. – user120513 Aug 22 '17 at 1:40
• Ah, sorry, that could be a difference between the NIST version and the org. paper. Or it is that a confuse it with a different scheme. I'll try and re-read that section and adjust accordingly. – Maarten Bodewes Aug 22 '17 at 8:20