CCA Security with Short AEAD Tags

ePrint Report: CCA Security with Short AEAD Tags

Mustafa Khairallah

The size of the authentication tag represents a significant overhead for applications that are limited by bandwidth or memory. Hence, some authenticated encryption designs have a smaller tag than the required privacy level, which was also suggested by the NIST lightweight cryptography standardization project. In the ToSC 2022, two papers have raised questions about the IND-CCA security of AEAD schemes in this situation. These papers show that (a) online AE …

aead applications authentication bandwidth cca cryptography encryption eprint report memory nist privacy project report security size standardization tag tags