PPT-Authenticated Encryption

Constructions from ciphers and MACs Online Cryptography Course Dan Boneh but first some history Authenticated Encryption AE introduced in 2000 . Chosen . ciphertext. attacks. Online Cryptography Course Dan Boneh. Example chosen . ciphertext. attacks. A. dversary has . ciphertext. c that it wants to decrypt. Attacking non-atomic decryption. Online Cryptography Course Dan Boneh. SSH Binary Packet Protocol. Decryption:. s. tep 1: decrypt packet length field only (!). s. CBC paddings attacks. Online Cryptography Course Dan Boneh. Recap. Authenticated encryption. : CPA security + . ciphertext. integrity. C. onfidentiality in presence of . prOtection. (AERO). mcgrew@cisco.com. AERO. Authenticated Encryption algorithm. Stateful. and self-synchronizing. Easy to use. Robust against nonce misuse and decryption misuse. Saves bandwidth. No nonce, no sequence number. AEGIS . A Fast Authenticated Encryption Algorithm. . Hongjun Wu Bart Preneel . Nanyang Technological University. KU Leuven and iMinds. SAC 2013 . 2. Outline. Authenticated Encryption (AE). design rationale. (for now). Online Cryptography Course Dan Boneh. Quick Review: primitives. PRG. PRF, PRP. MAC. GGM. CTR. CMAC, HMAC. PMAC. Collision. resistance. k. ey exchange. David Kauchak. CS52 – . Spring 2016. Admin. Assignment 6. Survey: respondents. 24 total respondents. Survey: “How is the class going?”. Survey: “How is the difficulty of the class?”. Survey: time spent per week. Last time I promise. Unitary notation . Writing numbers only using 1. 1 -> 1. 2- > 11 . 3 -> 111. (n times). is shorthand for writing n in unitary.  . Family of games. Generalization of section 7.8 in the book (page 278). Definitions. Online Cryptography Course Dan Boneh. Goals. An . authenticated encryption . system (E,D) is a cipher where . As usual: E: K × M . × . N . ⟶ C. Crypto Concepts Symmetric encryption, Public key encryption, and TLS Cryptography Is: A tremendous tool The basis for many security mechanisms Is not: The solution to all security problems Reliable unless implemented and used properly Authenticated Encryption and Cryptographic Network Protocols David Brumley dbrumley@cmu.edu Carnegie Mellon University Some Straw Men 2 TCP/IP (highly abstracted) packet Destination Machine TCP/IP Stack Authenticated Encryption and Cryptographic Network Protocols David Brumley dbrumley@cmu.edu Carnegie Mellon University Some Straw Men 2 TCP/IP (highly abstracted) packet Destination Machine TCP/IP Stack Cryptography Lecture 9 Arpita Patra © Arpita Patra Recall Attack on cpa -secure scheme from PRF >> cpa -security to cca -security Definitions- cma , scma , cmva , scmva >> MAC of Authenticated Encryption. Mihir Bellare, Shay Gueron, Viet Tung Hoang, Julia Len, Sanketh Menda, and Thomas Ristenpart. Authenticated Encryption. with Associated Data. 2. Scheme . AEAD. Key . K. Scheme .