Authenticated encryption apparatus with initialization-vector misuse resistance and method therefor
A module has a processor for executing an encryption process to encrypt a message to a cipher-text with authentication. The encryption process includes generating a tag from a secret message authentication code (MAC) key, a nonce, a message, and optionally an additional data using a Poly1305 function, generating a pseudorandom initialization vector (IV) from a secret encryption key and the tag using a first encryption function, and generating a cipher-text from the secret encryption key, the generated IV, and the message using a second encryption function. The module or a similar module may execute a corresponding decryption process to decrypt the cipher-text to a decrypted message and verify the authenticity of the cipher-text. At least one of the first and second encryption functions may be an Advanced Encryption Standard (AES) encryption function such as an AES-CTR encryption function, an AES-like encryption function, and/or other suitable encryption functions.
1. An authenticated encryption module for encrypting a message into a cipher-text, the authenticated encryption module comprising:
a processor; and
memory coupled to the processor and including instructions that, when executed by the processor, cause the processor to:
produce, using a Poly1305 function, a tag from at least a secret message authentication code (MAC) key, a nonce, and the message;
produce a pseudorandom initialization vector (IV) by encrypting the tag using a first encryption function and a secret encryption key; and
produce, using a second encryption function, the cipher-text from the secret encryption key, the produced IV, and the message.
2. The authenticated encryption module of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
produce, from a secret value using a key derivation function, the secret MAC key and the secret encryption key.
3. The authenticated encryption module of claim 1 , wherein the instructions, when executed by the processor, cause the processor to:
output a tuple comprising at least the nonce, the IV, and the cipher-text.
4. The authenticated encryption module of claim 1 , wherein at least one of the first and the second encryption functions is an Advanced Encryption Standard (AES) encryption function or an AES-like encryption function.
5. The authenticated encryption module of claim 1 , wherein at least one of the first and the second encryption functions is an AES counter mode (AES-CTR) encryption function.
6. The authenticated encryption module of claim 1 , wherein at least one of the first and the second encryption functions is a block cipher or encryption function for outputting the pseudorandom IV.
7. A computerized authenticated encryption method for encrypting a message into a cipher-text, the authenticated encryption method comprising:
producing, using a Poly1305 function, a tag from at least a secret message authentication code (MAC) key, a nonce, and the message;
producing a pseudorandom IV by encrypting the tag using a first encryption function and a secret encryption key; and
producing, using a second encryption function, the cipher-text from the secret encryption key, the produced IV, and the message.
8. The authenticated encryption method of claim 7 , further comprising:
producing, using a key derivation function, the secret MAC key and the secret encryption key from a secret value.
9. The authenticated encryption method of claim 7 , further comprising:
outputting a tuple comprising at least the nonce, the IV, and the cipher-text.
10. The authenticated encryption method of claim 7 , wherein at least one of the first and the second encryption functions is an AES encryption function or an AES-like encryption function.
11. The authenticated encryption method of claim 7 , wherein at least one of the first and the second encryption functions is an AES-CTR encryption function.
12. The authenticated encryption method of claim 7 , wherein at least one of the first and the second encryption functions is a block cipher or encryption function for outputting the pseudorandom IV.
13. One or more non-transitory computer-readable storage devices comprising computer-executable instructions for encrypting a message into a cipher-text with authentication, wherein the instructions, when executed, cause a processor to perform actions comprising:
producing, using a Poly1305 function, a tag from at least a secret message authentication code (MAC) key, a nonce, and the message;
producing a pseudorandom IV by encrypting the tag using a first encryption function and a secret encryption key; and
producing, using a second encryption function, the cipher-text from the secret encryption key, the produced IV, and the message.
14. The one or more non-transitory computer-readable storage devices of claim 13 , wherein the instructions, when executed, cause the processor to perform further actions comprising:
producing, using a key derivation function, the secret MAC key and the secret encryption key from a secret value.
15. The one or more non-transitory computer-readable storage devices of claim 13 , wherein the instructions, when executed, cause the processor to perform further actions comprising:
outputting a tuple comprising at least the nonce, the IV, and the cipher-text.
16. The one or more non-transitory computer-readable storage devices of claim 13 , wherein at least one of the first and the second encryption functions is an AES encryption function or an AES-like encryption function.
17. The one or more non-transitory computer-readable storage devices of claim 13 , wherein at least one of the first and the second encryption functions is an AES-CTR encryption function.
18. The one or more non-transitory computer-readable storage devices of claim 13 , wherein at least one of the first and the second encryption functions is a block cipher or encryption function for outputting the pseudorandom IV.