International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Anonymous AE

Authors:
John Chan
Phillip Rogaway
Download:
DOI: 10.1007/978-3-030-34621-8_7
Search ePrint
Search Google
Abstract: The customary formulation of authenticated encryption (AE) requires the decrypting party to supply the correct nonce with each ciphertext it decrypts. To enable this, the nonce is often sent in the clear alongside the ciphertext. But doing this can forfeit anonymity and degrade usability. Anonymity can also be lost by transmitting associated data (AD) or a session-ID (used to identify the operative key). To address these issues, we introduce anonymous AE, wherein ciphertexts must conceal their origin even when they are understood to encompass everything needed to decrypt (apart from the receiver’s secret state). We formalize a type of anonymous AE we call anAE, anonymous nonce-based AE, which generalizes and strengthens conventional nonce-based AE, nAE. We provide an efficient construction for anAE, NonceWrap, from an nAE scheme and a blockcipher. We prove NonceWrap secure. While anAE does not address privacy loss through traffic-flow analysis, it does ensure that ciphertexts, now more expansively construed, do not by themselves compromise privacy.
BibTeX
@article{asiacrypt-2019-30038,
  title={Anonymous AE},
  booktitle={Advances in Cryptology – ASIACRYPT 2019},
  series={Advances in Cryptology – ASIACRYPT 2019},
  publisher={Springer},
  volume={11922},
  pages={183-208},
  doi={10.1007/978-3-030-34621-8_7},
  author={John Chan and Phillip Rogaway},
  year=2019
}