Score:1

Non-committing authenticated encryption schemes vs committing authenticated encryption schemes

fr flag

I'm told that TLS 1.3 supports only non-committing authenticated encryption schemes. What is a non-committing authenticated encryption scheme? What is the difference between committing and non-committing authenticated encryption schemes? What are the pros and cons?

kelalaka avatar
in flag
A related question [Can an authenticated encryption scheme detect if wrong key is used?](https://crypto.stackexchange.com/q/96032/18298) and dangers with [GCM](https://crypto.stackexchange.com/q/88716/18298)
Score:4
in flag

A committing authenticated encryption scheme is an encryption scheme where the ciphertext & tag could only have been created by one specific key. A non-committing authenticated encryption scheme is then one where an attacker may have created a valid ciphertext / tag combination using a different key.

The problem for the attacker is of course that they won't know if a specific combination is valid a-priori. If that wasn't the case then an attacker could launch a man-in-the-middle attack.


A committing scheme has in principle more security as you can prove that the message was created by the right party.

This may of course also work the other way as it also means that there is no plausible deniability either. This is less of a problem with symmetric ciphers as you can only link the ciphertext to a specific entity if you have the secret key.


TLS is a protocol where the keys are established by both parties beforehand. As such, it is not directly affected by ciphers that are committing or not. Attackers should not be able to change existing messages or transmit different, valid messages using the wrong key after all.


For more, easy to understand information here is a nice set of slides created by Paul Grubbs for a meeting in November of 2019.

kelalaka avatar
in flag
A non-committing authenticated is not restricted to finding another ciphertext/tag combination with a different key. The attacker is free to choose $k_1, k_2, c$ and the tags. The negation of the definition is also clear on this ( see the slides). In the TLS case, one entity can be malicious like the Facebook Message Franking.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.