Deterministic Authenticated-Encryption: A Provable-Security Treatment of the Key-Wrap Problem
By Phillip Rogaway, Thomas Shrimpton. IACR Cryptology ePrint Archive, 2006
484 citations recorded by the source corpus.
View Paper: https://www.semanticscholar.org/paper/099a5796bc29964ffd393677142e039176c5bf45
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
- Mihir Bellare
- Sriram Keelveedhi
- Dennis Hofheinz
- Eike Kiltz
- Alexandra Boldyreva
- Phillip Rogaway
- Guido Marco Bertoni
- Thomas Ristenpart
Citations in the corpus
- Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm (2000, background): “Rogaway and Shrimpton [47] explore the problem of cryptographic key transport, referred to as the key wrap problem, and introduce a notion of deterministic authenticated encryption, which they prove to be equivalent to key wrapping.”
- DupLESS: Server-Aided Encryption for Deduplicated Storage (2013, methodology): “The simple approach of sharing a secret key across clients with a deterministic encryption scheme [16] [68] fails to achieve compromise resilience.”
- The Software Performance of Authenticated-Encryption Modes (2011, methodology): “…with AD and alleged speed improvements ISO 19772 CCFB [29] 2005 I Similar to RPC [23], but with chaining — CHM [18] 2006 C Beyond-birthday-bound security — SIV [36] 2006 C Deterministic/misuse-resistant AE RFC 5297 CIP [17] 2008 C Beyond-birthday-bound security — HBS [20] 2009 C Deterministic AE.”
- Order-Preserving Symmetric Encryption (2009, background): “(Such an approach was taken previously in the case of deterministic public-key encryption [6, 11, 7], on-line ciphers [5], and deterministic authenticated encryption [28].”
- Duplexing the sponge: single-pass authenticated encryption and other applications (2011, background): “Some block cipher based modes are misuse resistant , i.e., they are designed in such a way that in case the nonce requirement is not fulfilled, the only information an a(cid:308)acker can find out is whether B and B ′ are equal or not [46].”
- Secure Hybrid Encryption from Weakened Key Encapsulation (2007, background): “This is simultaneously captured (similar to the more-time attack case [26]) by defining the ae-ot-advantage of an adversary Bae as Advae-ot AE ,Bae (k) =”