Context Discovery and Commitment Attacks: How to Break CCM, EAX, SIV, and More

ePrint Report: Context Discovery and Commitment Attacks: How to Break CCM, EAX, SIV, and More

Sanketh Menda, Julia Len, Paul Grubbs, Thomas Ristenpart

A line of recent work has highlighted the importance of context commitment security, which asks that authenticated encryption with associated data (AEAD) schemes will not decrypt the same adversarially-chosen ciphertext under two different, adversarially-chosen contexts (secret key, nonce, and associated data). Despite a spate of recent attacks, many open questions remain around context commitment; most obviously nothing …

aead attacks ciphertext context data decrypt discovery encryption eprint report key nonce paul questions report secret secret key security thomas under work