Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm

By Mihir Bellare, Chanathip Namprempre. 2000

1,217 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Riffle (2016, methodology): “To show verifiability, let us assume that the authenticated encryption used by Riffle is secure against forgery, following the proposal of [9].”
VC3: Trustworthy Data Analytics in the Cloud Using SGX (2015, methodology): “We assume the publickey encryption scheme to be at least IND-CPA [10]: without the decryption key, and given the ciphertexts for any chosen plaintexts, it is computationally hard to extract any information from those ciphertexts.”
The Software Performance of Authenticated-Encryption Modes (2011, background): “EtM [1] 2000 C Encrypt-then-MAC (and other) generic comp. schemes ISO 19772 RPC [23] 2000 I Insert counters and sentinels in blocks, then ECB — IAPM [21] 2001 I Seminal integrated scheme.”
Formal Proofs for the Security of Signcryption (2002, background): “We point out that while the symmetric composition EtM is secure against chosen ciphertext attack (indeed, EtM is generically secure as shown in [6]), the simple asymmetric version EtS is completely insecure against adaptive chosen ciphertext attack, even if the underlying encryption scheme is secure”
VerifyNet: Secure and Verifiable Federated Learning (2020, methodology): “Because we just change the content of ciphertext, the properties of symmetric authenticated encryption [11], [31] ensure the indistinguishability between this hybrid with real protocol. hyb 3 In this hybrid, we ﬁrst deﬁne a subset as below.”
Deterministic Authenticated-Encryption: A Provable-Security Treatment of the Key-Wrap Problem (2006, background): “Scheme AKW1 is described as a probabilistic scheme that aims to achieve (probabilistic) AE, the original notion of AE put forward in [6] [8] [20].”
Lucky Thirteen: Breaking the TLS and DTLS Record Protocols (2013, background): “That this is so, and that encrypt-then-MAC is the preferable construction, has been known in a theoretical sense since at least [4, 20].”
Secure Hybrid Encryption from Weakened Key Encapsulation (2007, methodology): “In the full version we recall (following the encrypt-then-mac approach [4,13]) how to build such algebraic AE satisfying all required functionality and security from the following basic primitives: – A (computationally secure) one-time symmetric encryption scheme with binary k-bit keys (such as AES ”
DupLESS: Server-Aided Encryption for Deduplicated Storage (2013, methodology): “An authenticated encryption (AE) scheme is pair of algorithms AE = (EA, DA) [19] [67].”
Duplexing the sponge: single-pass authenticated encryption and other applications (2011, neutral): “∀n ≥ 0, ∀M, M′ ∈ Z∗ 2 : M ̸= M′ ⇒ M||pad[r](|M|) ̸= M′||pad[r](|M′|)||0nr (3)”
FPGA Intrinsic PUFs and Their Use for IP Protection (2007, methodology): “Finally, we write MACK(·), to indicate a message authenticating code (MAC) computed with the secret-key K providing integrity of plain texts (see [5]).”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Unobservable Communication over Fully Untrusted Infrastructure Unobservable Communication over Fully Untrusted Infrastructure (neutral): “Specifically, we target the strongest cryptographic properties that capture these goals, namely integrity of ciphertexts under chosen plaintext attacks (INT- CTXT) [21] [70], and indistinguishability under adaptive chosen ciphertext attacks (IND-CCA2) [99] [110].”
A New Randomness Extraction Paradigm for Hybrid Encryption (2009, background): “Scheme Assumption Encryption Decryption Ciphertext Key-size Restriction #[multi/sequential,single]-exp Size Public Secret on p = ord(G) KD DDH & TCR [1, 2]+tcr [1, 0]+tcr 2|G|+|ψ| 4|G|+|τtcr| 4|Zp| lg p ≥ 2l(k) HE 1 DDH [0, 3]+4wh [1, 0]+4wh 2|G|+|ψ| 3|G|+|τ4wh | 2|Zp| lg p ≥ 4l(k) HE 2 DDH [0, 4]+4”
Security Proofs for Identity-Based Identification and Signature Schemes (2008, background): “The notion of strong unforgeability [2,3,46] (referred to as non-malleability in [46]) would be sufficient for our purposes, but unfortunately the SS schemes in question do not satisfy it.”
Introduction to Modern Cryptography, Second Edition (2014, neutral): “The importance of authenticated encryption was first explicitly highlighted in [100, 19], who propose definitions similar to what we have given here.”
Practical Secure Aggregation for Privacy-Preserving Machine Learning (2017, methodology): “For security, we require indistinguishability under a chosen plaintext attack (IND-CPA) and ciphertext integrity (IND-CTXT) as deﬁned in [41].”
Order-Preserving Encryption Revisited: Improved Security Analysis and Alternative Solutions (2011, background): “In the example, N = 32, M = 8, c = {6, 19, 24}, and we are looking at the particular OPF f ∈ OPF[8],[32](c) with range X = {2, 6, 8, 15, 19, 24, 25, 30}.”