What is the general purpose of concealment algorithms introduced in https://eprint.iacr.org/2003/050.pdf?

  • $\begingroup$ This is not even a question, try to actually formulate a question instead of "blah blah.. introduced in". $\endgroup$
    – kodlu
    Commented Jan 26, 2018 at 17:20

1 Answer 1


The purpose seems to be offering an interesting new building block for authenticated encryption.

They split a message into a long hider $h$ and a short binder $b$ with the following properties:

  1. $h$ reveals no information about $m$
  2. $h$ and $b$ allow recovering $m$
  3. There is only one $h$ with which $b$ can be used to recover $m$

They use this functionality to extend an authenticated encryption scheme that works only on short messages to one on long messages. One uses the given authenticated encryption scheme $\mathcal{AE}$ to encrypt the shorter binder $b$ and gets authenticated encryption of the entire $m$ by the properties above.


  1. $h$ can be public because it reveals nothing about $m$
  2. After decrypting $\mathcal{AE}(b)$ the receiver can reconstruct $m$ using $h$
  3. The message must be authentic because there is only one $h$ which will work with $b$

They also use it to build Remotely Keyed Authenticated Encryption.

To summarize, we show that concealments are very natural cryptographic gadgets, and can be efficiently built from standard assumptions. In particular, they give an efficient way to implement “long” authenticated encryption from a “short” one. Finally, we describe a powerful application of concealments and our ampli- fication technique to the problem of RKAE , which deserves a separate introduction.

This RKAE has pretty much exactly the goal they achieve, to split authenticated encryption between something like a fast PC and a slow smartcard where the key is only used on the smartcard but it only needs to encrypt small messages.


Not the answer you're looking for? Browse other questions tagged or ask your own question.