2024-03-01 | Patrick Derbez, Pierre-Alain Fouque, Takanori Isobe, Mostafizar Rahman, André Schrottenloher
This paper presents key committing attacks on several AES-based authenticated encryption with associated data (AEAD) schemes, including AEGIS and Rocca-S. The authors demonstrate that these schemes do not meet the key commitment security requirements, which ensure that a ciphertext can only be decrypted using the same key that was used to generate it. The attacks are conducted within the FROB game setting, a stringent key commitment framework, and are shown to be valid in other, less strict frameworks such as CMT-1 and CMT-4. The attacks exploit the processing of associated data (AD) to manipulate the internal state of the encryption scheme, enabling the generation of ciphertexts that can be decrypted using different keys. The authors also show that their attack techniques do not compromise the key commitment security of Rocca and Tiaoxin-346, suggesting that these schemes may be more resistant to such attacks. The study highlights the importance of evaluating AEAD schemes within the key commitment framework and provides insights into the design of secure round update functions for AES-based AEAD schemes. The results emphasize the ongoing need for research and evaluation in AEAD security, particularly in the context of key commitment.This paper presents key committing attacks on several AES-based authenticated encryption with associated data (AEAD) schemes, including AEGIS and Rocca-S. The authors demonstrate that these schemes do not meet the key commitment security requirements, which ensure that a ciphertext can only be decrypted using the same key that was used to generate it. The attacks are conducted within the FROB game setting, a stringent key commitment framework, and are shown to be valid in other, less strict frameworks such as CMT-1 and CMT-4. The attacks exploit the processing of associated data (AD) to manipulate the internal state of the encryption scheme, enabling the generation of ciphertexts that can be decrypted using different keys. The authors also show that their attack techniques do not compromise the key commitment security of Rocca and Tiaoxin-346, suggesting that these schemes may be more resistant to such attacks. The study highlights the importance of evaluating AEAD schemes within the key commitment framework and provides insights into the design of secure round update functions for AES-based AEAD schemes. The results emphasize the ongoing need for research and evaluation in AEAD security, particularly in the context of key commitment.