I'm trying to understand the purpose of tag in AEAD. As far as I can understand, the resulting ciphertext will be slightly longer than the plaintext due to the authentication tag. Will it reduce the security of AEAD if the authentication tag is embedded to the ciphertext(e.g. by performing XOR/modular addition to the last block of ciphertext)?

  • 5
    $\begingroup$ If you xor in the tag into the last block of ciphertext, how do you recover that last block to decrypt? $\endgroup$ – poncho Aug 1 '19 at 2:46
  • $\begingroup$ @poncho So that's what I missed. You're right, it's impossible to decrypt the last block. $\endgroup$ – comepradz Aug 1 '19 at 2:55
  • 1
    $\begingroup$ The SIV construct masquerades tag as IV. $\endgroup$ – DannyNiu Aug 1 '19 at 7:03

As discussed in RFC 5116, AEAD is the tuple of encryption and decryption function:

  • An encryption function that takes a key, a nonce, a plaintext and a header (associated data), and produce a ciphertext and a tag.

  • A decryption function that takes a key, a nonce, a ciphertext, and a header, and produces either 1) the plaintext, or 2) decryption failure indication.

The tag part you're concerned with is used to verify the decrypted plaintext (roughly speaking).

However, there's a requirement that can sometimes be a pitfall in the real world: the nonce must be unique for most AEAD algorithms to be secure. So the clever people invented "deterministic authenticated encryption" (DAE in short, a.k.a. key-wrap in some contexts). These encryption algorithms advertise the property of "misuse-resistance". And AES-SIV is one such example.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.