Authenticated encryption is said to be achievable with either of these three things:

  • Use a separate algorithm that ensures authentications such as HMAC.
  • Use one of the several block cipher modes of operation that generate/verify an authentication tag like OCB, CCM, or GCM.
  • Use a cipher that is dedicated to authentication (in addition to confidentiality, that is).

Some of the entries in the CAESAR competition are of the second solution while the rest are of the third. My trouble is that, after looking at the specifications of the entries that fall into the third category, I'm left wondering a dedicated authenticated encryption algorithm is. Except for possibly the ones based on sponges, in the ones that I looked over, it seemed to me as if the authentication and encryption mechanisms are easily untangled and that you could use one without using the other, just like how block ciphers and block cipher modes of operation are interchangeable. The only ciphers I can think of that I can undoubtedly say are dedicated are Helix and Phelix. I'm unsure as to whether or not to classify sponge-based schemes as dedicated ones, but if I were to decide that they are dedicated schemes, then it would be with less certainty than for Phelix and Helix. Aside from a block cipher that maintains a state that is updated between successively encrypted/decrypted blocks, I can't think of anything else.

So, what would a cipher dedicated to authenticated encryption look like to the cryptographic community at large?

  • 1
    $\begingroup$ Are you asking how to formally define the objective of "dedicated authenticated encryption", or are you asking what the internals of such an object should look like? In the former case, authenticated encryption is a well-established security goal. $\endgroup$ – Mikero Jan 3 '18 at 3:30
  • $\begingroup$ @Mikero I'm not sure. $\endgroup$ – Melab Jan 3 '18 at 3:31
  • 1
    $\begingroup$ We don't actually want just authenticated encryption, we also want to authenticate unencrypted associated data. That's why the acronym AEAD is used so much. The authentication must be able to authenticate data separately from the encryption. $\endgroup$ – SAI Peregrinus Jan 3 '18 at 16:04
  • $\begingroup$ @Melab I think this is a sliding scale; where to draw the line? In the end there will be some part of the algorithm that generates an authentication tag and decouple the calculation of that from the plaintext. I don't know of any schemes that expand the ciphertext without generating an authentication tag. Just like with animal species, any line that is drawn is kind of man-made. If there is anything specific that would make these ciphers authenticated ciphers then you could argue that they are not, as that would show that there is some kind of mode of operation. $\endgroup$ – Maarten Bodewes Jan 4 '18 at 8:49
  • $\begingroup$ I.e. if you answer this question then you've just shown that your answer is invalid. Is there anything that these ciphers have in common that makes them unique :P The ciphers should have a single algorithm definition where the main operation is not operated twice (one time for encryption and one time for calculation of the tag) and the support structure must not be common; that's the best I can think of. $\endgroup$ – Maarten Bodewes Jan 4 '18 at 8:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.