Traditional security definitions in the context of secure communication specify properties of cryptographic schemes. For symmetric encryption schemes, these properties are intended to capture the protection of the confidentiality or the integrity of the encrypted messages. A vast variety of such definitions has emerged in the literature and, despite the efforts of previous work, the relations and interplay of many of these notions (which are a priori not composable) are unexplored. Also, the exact guarantees implied by the properties are hard to understand.

In constructive cryptography, notions such as confidentiality and integrity appear as attributes of channels, i.e., the communication itself. This makes the guarantees achieved by cryptographic schemes explicit, and leads to security definitions that are composable.

In this work, we follow the approach of constructive cryptography, questioning the justification for the existing (game-based) security definitions. In particular, we compare these definitions with related constructive notions and find that some are too weak, such as INT-PTXT, or artificially strong, such as INT-CTXT. Others appear unsuitable for symmetric encryption, such as IND-CCA.

/pdf/confidentiality-and-integrity-a-constructive-perspective-4nkjnpq5a3.pdf

Confidentiality and integrity: a constructive perspective

We study the problem of encrypting and authenticating quantum data in the presence of adversaries making adaptive chosen plaintext and chosen ciphertext queries. Classically, security games use string copying and comparison to detect adversarial cheating in such scenarios. Quantumly, this approach would violate no-cloning. We develop new techniques to overcome this problem: we use entanglement to detect cheating, and rely on recent results for characterizing quantum encryption schemes. We give definitions for (i) ciphertext unforgeability, (ii) indistinguishability under adaptive chosen-ciphertext attack, and (iii) authenticated encryption. The restriction of each definition to the classical setting is at least as strong as the corresponding classical notion: (i) implies \(\mathsf {INT\text {-}CTXT}\), (ii) implies \(\mathsf {IND\text {-}CCA2}\), and (iii) implies \(\mathsf {AE}\). All of our new notions also imply \(\mathsf {QIND\text {-}CPA}\) privacy. Combining one-time authentication and classical pseudorandomness, we construct symmetric-key quantum encryption schemes for each of these new security notions, and provide several separation examples. Along the way, we also give a new definition of one-time quantum authentication which, unlike all previous approaches, authenticates ciphertexts rather than plaintexts.

/pdf/unforgeable-quantum-encryption-259jgab7ul.pdf

Unforgeable Quantum Encryption

Authentication and authenticated encryption with associated data AEAD are applied in cryptographic protocols to provide message integrity. The definitions in the literature and the constructions used in practice all protect against forgeries, but offer varying levels of protection against replays, reordering, and drops. As a result of the lack of a systematic hierarchy of authentication and AEAD security notions, gaps have arisen in the literature, specifically in the provable security analysis of the Transport Layer Security TLS protocol. We present a hierarchy of authentication and AEAD security notions, interpolating between the lowest level of protection against forgeries and the highest level against forgeries, replays, reordering, and drops. We show generically how to construct higher level schemes from a basic scheme and appropriate use of sequence numbers, and apply that to close the gap in the analysis of TLS record layer encryption.

/pdf/from-stateless-to-stateful-generic-authentication-and-2r9mqok8af.pdf

From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS

We draw attention to a gap between theory and usage of nonce-based symmetric encryption, under which the way the former treats nonces can result in violation of privacy in the latter. We bridge the gap with a new treatment of nonce-based symmetric encryption that modifies the syntax (decryption no longer takes a nonce), upgrades the security goal (asking that not just messages, but also nonces, be hidden) and gives simple, efficient schemes conforming to the new definitions. We investigate both basic security (holding when nonces are not reused) and advanced security (misuse resistance, providing best-possible guarantees when nonces are reused).

Nonces Are Noticed: AEAD Revisited

/pdf/from-stateless-to-stateful-generic-authentication-and-5adv4hhwde.pdf

From Stateless to Stateful: Generic Authentication and Authenticated Encryption Constructions with Application to TLS.

In this note we introduce a variation of the standard definition of chosen-ciphertext security, which we call IND-CCA3, and prove that IND-CCA3 is equivalent to authenticated-encryption.

/pdf/a-characterization-of-authenticated-encryption-as-a-form-of-5bl82l9ley.pdf

Tom Shrimpton

Papers

A Characterization of Authenticated-Encryption as a Form of Chosen-Ciphertext Security.

AE5 Security Notions: Definitions Implicit in the CAESAR Call.