7
$\begingroup$

I am trying to understand what is AEAD exactly. I am application developer not a cryptographer. I have been searching online for a while watched a bunch of Youtube videos, read through a couple of books "Serious Cryptography" and "Understanding Cryptography" but found the AEAD explanations to be too terse. My goal is to understand docs when using crypto libraries and they mention AEAD and the pros and cons of various modes for AES. Below are the questions I have about AEAD.

  • What is an example problem/scenario that AEAD solves? (looking to understand the problem not the solution)
  • How does AEAD solve this problem? (not the algorithm details but higher level big picture)
  • What are typical examples of associated data?
  • If AEAD is not used what are attackers able to do? (a lot of online references talk about a padding oracle attack I tried to understand the attack but it seems to require deep understanding of how AES works)
  • As a developer should I always use AEAD for everything?
  • What are typical mistakes developers make when applying AEAD?
  • Is AEAD only required for block ciphers but not required for stream ciphers?
  • Is AEAD required when using a public key crypto such as RSA?
$\endgroup$

1 Answer 1

8
$\begingroup$

First of all, let us look at what AAD is; it is a string that must be presented both at encryption and decryption; if the decryptor presents the wrong string, the decryption fails.

Why is this useful? Because AAD can be understood as "encryption context". We typically use the same keys to encrypt several messages. What AAD prevents is the attacker taking one of the valid ciphertexts, and replacing another of the ciphertexts (encrypted with the same key) with it; if the decryptor uses different AADs for the two separate contexts, then the decryption will fail (and the attack is thwarted; if the attacker just wanted the decryption to fail, he could just replace the ciphertext with random gibberish).

An alternative approach would be to just use a separate key each time; that'd work, however AAD generally solves the problem with less complexity.

So, to answer your question:

What is an example problem/scenario that AEAD solves?

You asked for one; I'll give you two:

  • Consider TLS, where individual records are encrypted with the same key. TLS uses an AAD that includes the record sequence number (which increments with each record); this prevents an attacker from replaying a previously sent record.

  • Consider database encryption, where we are encrypted individual fields within a database, for example, a database that gives the employee names [1] (unencrypted) and the salary (encrypted). If the attacker could (say) take Alice's salary, and write that into Bob's row, well, that'd be bad. By using the employee name as the AAD, the attacker can't do that undetected.

How does AEAD solve this problem? (not the algorithm details but higher level big picture)

What GCM does is stir in the AAD into the tag; if the AAD isn't correct, the tag would not verify (and you're supposed to reject the decryption in that case).

If AEAD is not used what are attackers able to do?

Replace one ciphertext with another

As a developer should I always use AEAD for everything?

Well, if you're using the same key for multiple purposes, you probably should use a distinct AAD for each encryption. On the other hand, if you're using the key to encrypt only one message (e.g. as the symmetric portion within IES), there is no need

Is AEAD only required for block ciphers but not required for stream ciphers? Is AEAD required when using a public key crypto such as RSA?

Generally, the replay problem needs to be addressed, however stream ciphers and public key methods generally use different approaches.

With stream ciphers, we often generate a single long string, and use distinct portions to encrypt individual messages - this prevents replay attacks. Other times (when we need to be able to decrypt messages out of order), we include a nonce as an input to the stream cipher, and have a higher level protocol ensure that a nonce is not reused.

With public key encryption, it's generally handled at a higher level, possibly with a nonce...


[1]: A real database will be more likely to have some sequence number rather than the name; I'll ignore that for this example.

$\endgroup$
3
  • $\begingroup$ Thanks can you clarify in your answer what AAD stands for? Do you mean Authenticated Associated Data or something else? $\endgroup$
    – ams
    Sep 20, 2020 at 19:01
  • 1
    $\begingroup$ @ams: AAD == Additional Associated Data... $\endgroup$
    – poncho
    Sep 21, 2020 at 2:02
  • $\begingroup$ "As a developer should I always use AEAD for everything?" Note that the question asked here was whether to always use an AEAD, not about using AAD. The answer to that question is "Yes, for everything needing symmetric encryption." You've already answered whether to use the AAD input for everything. $\endgroup$ Sep 24, 2020 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.