2024-03-01 | Patrick Derbez, Pierre-Alain Fouque, Takanori Isobe, Mostafizar Rahman, André Schrottenloher
This paper assesses the key commitment security of several authenticated encryption with associated data (AEAD) schemes, focusing on AEGIS and Rocca-S. Key commitment ensures that a ciphertext can only be decrypted using the same key used to derive it. The authors demonstrate a novel attack on AEGIS, showing that it does not qualify as a fully committing AEAD scheme. This attack is executed within the FROB game setting, which is one of the most stringent key commitment frameworks. The complexity of this attack is $O(1)$, meaning it can find collisions on tags with minimal effort. Additionally, the authors present a key commitment attack on Rocca-S with a complexity of $2^{64}$. However, the same techniques do not compromise the key-committing security of Tiaoxin-346 and Rocca, providing valuable insights into the design considerations for AES-based AEAD schemes. The paper concludes by discussing the resistance of these schemes against key commitment attacks and the implications for future designs.This paper assesses the key commitment security of several authenticated encryption with associated data (AEAD) schemes, focusing on AEGIS and Rocca-S. Key commitment ensures that a ciphertext can only be decrypted using the same key used to derive it. The authors demonstrate a novel attack on AEGIS, showing that it does not qualify as a fully committing AEAD scheme. This attack is executed within the FROB game setting, which is one of the most stringent key commitment frameworks. The complexity of this attack is $O(1)$, meaning it can find collisions on tags with minimal effort. Additionally, the authors present a key commitment attack on Rocca-S with a complexity of $2^{64}$. However, the same techniques do not compromise the key-committing security of Tiaoxin-346 and Rocca, providing valuable insights into the design considerations for AES-based AEAD schemes. The paper concludes by discussing the resistance of these schemes against key commitment attacks and the implications for future designs.