Other Work Reducing Multi-key Degradation Sample Clauses

Other Work Reducing Multi-key Degradation. The approach outlined above is that of the standard model. Bellare and Xxxxxxxx [11] use the ideal cipher model in order to understand how different modifications to GCM improve resistance against key recovery in the multi-key setting. Their goal is not to establish μ-independence, but to rather extend the effective key length of GCM over that of the underlying block cipher in order to make key recovery more difficult. However, for GCM, they end up with a factor of μ in their security bounds as a consequence of their method of analysis, whereas our results show that this is not inevitable. In special cases the dependence on μ disappears. Bellare, Xxxxxxxxx, and Xxxxxxx show that this is the case with AMAC [4]. Xxxxx and Xxxxxxx (HT) [28] establish a similar result for key-alternating ciphers, and even show more gen- erally that if a construction has transcripts satisfying some special properties, then μ no longer appears when considering bounds on indistinguishability. The HT-condition is a useful sufficient condition because it only places a require- ment on how an upper bound on the difference between the probabilities of two transcripts behaves. However, its applicability is limited, as we will illustrate in Sect. 4.4, because it does not provide a meaningful bound when considering integrity. In concurrent work, Xxxxx and Xxxxxxx [29] generalize their previous approach, and apply it to double encryption. Their transcript-driven approach 2 xxxxx://xxxxxxxxxxx.xxxx.xxx/arch/msg/tls/M-fcRtoeCtMxDNtMsPrUsBV5rgk. provides different insight into how to prove the lack of multi-key security degra- dation, and can be applied equally well to GCM to arrive at the same conclusion as we do.