Re: [Cfrg] Streaming AEAD

[Jean Paul Degabriele <[e-mail]>]

Hi,

The problem of streaming AEAD seems to be closely related to our paper
"Security of Symmetric Encryption in the Presence of Ciphertext
Fragmentation" with Alexandra Boldyreva, Kenny Paterson, and Martijn Stam
from Eurocrypt 2012. In it we consider the problem of achieving
authenticated encryption over channels that may fragment the ciphertext in
arbitrary manner, as is the case with TCP/IP. Protocols like TLS and SSH
tackle this problem by introducing a length field in their respective data
formats.

Extending AEAD to support fragmentation raises a number of new security
concerns. In particular, it can totally undermine the privacy of the
scheme, as was the case with SSH-CBC (see Albrecht Paterson and Watson from
Oakland 09). Additionally it may introduce new vulnerabilities that relate
to Denial of Service. On the other hand, as David already mentioned,
supporting fragmentation may provide a strategy for mitigating Traffic
Analysis if certain additional security properties are met.

In the paper we provide a formal treatment of ciphertext fragmentation
addressing all of these points, and present some constructions which relate
to some of the ideas that you mentioned in this thread. We are currently
doing some major revisions on the proceedings version and an updated full
version will be available on eprint soon.

Best

Jean Paul Degabriele