Message Franking via Committing Authenticated Encryption
Message Franking via Committing Authenticated Encryption
复制标题
通过提交经过验证的加密进行邮件盖印
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Thomas Ristenpart
中科院分区：
文献类型：
--
作者：
Paul Grubbs;Jiahui Lu;Thomas Ristenpart
我们发起了消息邮资标记的研究，最近在 Facebook 的端到端加密消息系统中引入了该功能。它的目标是在不损害安全保证的情况下向 Facebook 报告可验证的滥用信息。我们通过新的加密原语实现邮件加盖标记的目标：通过关联数据紧凑地提交经过身份验证的加密 (AEAD)。这是一种 AEAD 方案，其中密文的一小部分可以用作对消息内容的加密承诺。除了消息之外，解密还提供了可用于公开承诺的值。印花税安全性的要求超出了与承诺相关的传统概念的要求。尽管如此，尽管 AEAD 方案通常不会提交（紧凑或其他方式），但我们证明许多正在使用的 AEAD 方案可以通过使用密钥作为开口来用于消息标记。我们的结果意味着，第一个证明了几种正在使用的对称加密方案在传统意义上是可行的。我们还提出并分析了即使在漏洞暴露给对手之后也能保持安全的方案。一个是 Facebook 消息标记协议隐式底层方案的概括，另一个是提供改进性能的新结构。
We initiate the study of message franking, recently introduced in Facebook’s end-to-end encrypted message system. It targets verifiable reporting of abusive messages to Facebook without compromising security guarantees. We capture the goals of message franking via a new cryptographic primitive: compactly committing authenticated encryption with associated data (AEAD). This is an AEAD scheme for which a small part of the ciphertext can be used as a cryptographic commitment to the message contents. Decryption provides, in addition to the message, a value that can be used to open the commitment. Security for franking mandates more than that required of traditional notions associated with commitment. Nevertheless, and despite the fact that AEAD schemes are in general not committing (compactly or otherwise), we prove that many in-use AEAD schemes can be used for message franking by using secret keys as openings. An implication of our results is the first proofs that several in-use symmetric encryption schemes are committing in the traditional sense. We also propose and analyze schemes that retain security even after openings are revealed to an adversary. One is a generalization of the scheme implicitly underlying Facebook’s message franking protocol, and another is a new construction that offers improved performance.