Authenticated Encryption Sample Clauses

Authenticated Encryption. ⊥ ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } ∈ { } An authenticated encryption scheme AE consists of two algorithms enc and dec. Encryption enc takes a key K 0, 1 k, a nonce N 0, 1 m, associated data A 0, 1 ∗, and a message M 0, 1 ∗ as inputs, and it outputs a ciphertext C 0, 1 |M| and a tag T 0, 1 t. Decryption dec takes a key K 0, 1 k, a nonce N 0, 1 m, associated data A 0, 1 ∗, a ciphertext C 0, 1 ∗, and a tag T 0, 1 t as inputs, and it outputs a message M 0, 1 |C| if the tag is correct, or a dedicated -sign otherwise. The two functions are required to satisfy dec(K, N, A, enc(K, N, A, M )) = M . (Note that the output of enc(K, N, A, M ) consists of a tuple (C, T ), and hence, dec gets as input a tuple of the form (K, N, A, C, T ).) In our work, the authenticated encryption scheme AE is based on an n-bit permutation P, which is modeled as a random permutation: P ←−$ perm(n). We A will consider multi-user security of AE, where an adversary can query up to μ versions of the scheme. The multi-user security of AE against an adversary is defined as AE A Kj Kj