When using a DEK to encrypt data using envelope encryption do you need to add AEAD to the DEK itself? I would think that it is unnecessary because bit flipping attacks are useless against a DEK and the confused deputy problem doesn't apply either. To be clear, the plaintext the DEK ultimately encrypts should be protected with AEAD. But, if you would argue the DEK itself needs AEAD please tell me why.

Here are some resources to use as a reference for how major cloud platforms recommend using their key managements systems to encrypt data.

https://cloud.google.com/kms/docs/additional-authenticated-data https://cloud.google.com/kms/docs/envelope-encryption

  • $\begingroup$ You mean AD or AAD, not AEAD. AEAD is the name of the type of algorithm (authenticated encryption with associated data). That confused deputy attack seems to rely on the fact that you can trick the deputy in using the wrong key. Using the wrong decryption key seems to be an issue in itself, I'm not sure if you want to solve that by using AAD. If you want to use an authenticated cipher depends on the availability of the wrapped key to an attacker, but if you're going to wrap the DEK anyway, then it's better save than sorry. $\endgroup$ – Maarten Bodewes Jan 25 '18 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.