Re: [Cfrg] Discuss/standardize Preview extension to AEAD abstraction?

[Alex Elsayed <[e-mail]>]

On Fri, 04 Dec 2015 11:53:02 +0100, Bryan Ford wrote:

<major snip>

Apologies for the (very!) late reply, but was off-list for quite a while.

> Is there anything seriously
> problematic or unsound from a crypto perspective about such an APEAD
> interface extension or feature, aside from the well-known risks
> associated with any use of (“previewed”) data before it’s been
> integrity-checked?

One particular problem is that APEAD is hard-incompatible with MRAE - in 
order for an AEAD to satisfy MRAE, every bit of the ciphertext must 
depend on every input bit from (nonce, ad, pt). As a result, "previewing" 
some prefix is infeasible for the exact same reason as MRAE and "online" 
AEAD being disjoint (Hoang, Reyhanitabar, Rogaway, and Vizar have a 
fascinating paper on this - https://eprint.iacr.org/2015/189).

However, this does leave some options regarding length-hiding on the 
table.

For one, given an AEAD based on the encode-then-encipher paradigm with 
variable \tau, one can increase the length of the verifier arbitrarily. 
This permits essentially padding each message to any extended length and 
gaining that length as additional integrity protection.