How would you prove that AES-GCM is secure against a chosen ciphertext attack (IND-CCA2), assuming that the attacker cannot forge AES-GCM MAC tags in less than brute force?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
You would prove it the same way that you prove encrypt-then-MAC in general. In fact, since there are already generic proofs of the encrypt-then-MAC paradigm, and since AES-CTR is already proven as being CPA-secure, all you really need to do is to prove the security of GMAC as a MAC, and then you can apply the general theorem. However, note that your assumption about AES-GCM MAC tags is not an acceptable one. You cannot assume that the "best" is brute force. Rather, you have to take the security based on AES.
Note also that you are better off proving that it achieves authenticated encryption, since this is stronger than CCA security.
answered Oct 28, 2018 at 7:19
-
1$\begingroup$ Are there (published) proofs of this anywhere? Also for the AEAD>IND-CCA claim? I need both (specifically, I need AES-GCM ∈ IND-CCA) in my thesis as a side fact, but prooving it myself would be a little off topic actually... $\endgroup$– MarianCommented Apr 30, 2019 at 13:09
-
2$\begingroup$ Of course, see eprint.iacr.org/2015/214.pdf. $\endgroup$ Commented Jun 18, 2019 at 5:09