Abstract: We address practice of key-wrapping, where one symmetric cryptographic key is used to encrypt another. This practice is used extensively in key-management architectures, often to create an adapter layer between incompatible legacy systems. Although in principle any encryption scheme can be used for key wrapping, practical constraints (which are commonplace when dealing with legacy systems) may severely limit possible implementations, sometimes to point of ruling out any general-purpose encryption. It is therefore desirable to identify security requirements that are really needed for key-wrapping application, and have a large variety of implementations that satisfy these requirements.
This approach was developed in a work by Rogaway and Shrimpton at EUROCRYPT 2006. They focused on allowing deterministic encryption, and defined a notion of deterministic authenticated encryption (DAE), which roughly formalizes the strongest security that one can get without randomness. Although DAE is weaker than full blown authenticated encryption, it seems to suffice for case of key wrapping (since keys are random and therefore encryption itself can be deterministic). Rogaway and Shrimpton also described a mode of operation for block ciphers (called SIV) that realizes this notion.
We continue in direction initiated by Rogaway and Shirmpton. We first observe that notion of DAE still rules out many practical and seemingly secure implementations. We thus look for even weaker notions of security that may still suffice. Specifically we consider notions that mirror usual security requirements for symmetric encryption, except that inputs to be encrypted are random rather than adversarially chosen. These notions are all strictly weaker than DAE, yet we argue that they suffice for most applications of key wrapping.
As for implementations, we consider key-wrapping notion that mirrors authenticated encryption, and investigate a template of Hash-then-Encrypt (HtE), which seems practically appealing: In this method key is first hashed into a short nonce, and then nonce and key are encrypted using some standard encryption mode. We consider a wide array of hash functions, ranging from a simple XOR to collision-resistant hashing, and examine what hash function can be used with what encryption mode.
Publication Year: 2009
Publication Date: 2009-01-01
Language: en
Type: preprint
Access and Citation
AI Researcher Chatbot
Get quick answers to your questions about the article from our AI researcher chatbot