2
$\begingroup$

The partition oracle attacks exploits the non-committing AEAD schemes.

Informally, a committing encryption scheme is one for which it is computationally intractable to find a pair of keys and a ciphertext that decrypts under both keys. AES-GCM and ChaCha20-1305 fail on this so they are non-committing.

As a countermeasure to the partition oracles, it is advised to use Encrypt-then-HMAC with one key since HMAC is committing. I.e. the key for encryption and HMAC are the same. Normally, we don't advise using a key for two different purposes. This, however, advised in the paper.

This question is specific to HMAC. Is there any published attack on a scheme that uses the same key for encryption and HMAC? Or any article that shows its security exists?

$\endgroup$
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.