# Can an authenticated encryption scheme detect if wrong key is used?

Can an authenticated encryption scheme (like AES-GCM) detect if a wrong key is used for decryption? If not, what is the standard way to check whether the entered key is indeed correct. I presume KCVs can be used for this but does this somehow leak any information about the key?

• Welcome to Cryptography. The answer is yes and no! AES-GCM and ChaCha20-Poly1305 is non-commiting! Understanding the impact of partitioning oracle attacks on stream ciphers. A committing encryption scheme is a scheme that is computationally intractable to find a pair of keys and a ciphertext that decrypts under both keys. One need to use HMAC and KMAC. Nov 9, 2021 at 20:19
• Thank you for the answer! I was wondering what is the difference between a committing encryption scheme like here and a key committing scheme? Nov 11, 2021 at 17:06
• AFAIK, they are the same. Nov 11, 2021 at 17:52

If two keys $$k_1$$ and $$k_2$$ are independently generated, and $$c$$ is an honestly generated ciphertext under $$k_1$$, then decrypting $$c$$ under $$k_2$$ will result in an error, except with negligible probability. If this weren't the case, it would lead to an attack against AEAD security (the attacker just submits a ciphertext under an independently chosen key). This analysis covers the case of "accidental" or "incidental" decryption under the wrong key.
However, this does not cover the case where $$k_1, k_2, c$$ are all generated adversarially. (Maybe an attacker shows you $$c$$ and $$k_1$$, and since $$c$$ decrypts successfully under $$k_1$$ you incorrectly conclude that someone with a different key could not have accepted $$c$$.) The usual definitions of AEAD don't prevent that. There are natural AEAD schemes (including AES-GCM) where it is possible to generate such $$k_1, k_2, c$$ such that $$c$$ decrypts without error under both $$k_1$$ and $$k_2$$. This property can indeed cause problems for some applications of AEAD, like password-authenticated key agreement and abuse reporting in encrypted messaging.
If it is hard to come up with any $$k_1, k_2, c$$ where $$c$$ decrypts without error under both $$k_1$$ and $$k_2$$, then we say that the scheme is key-committing. Sometimes the key-committing property requires providing some additional value (apart from the usual ciphertext and key) to help bind the key to the ciphertext. Key-committing encryption is studied here and here.