Algorithm substitution attacks against receivers

Abstract

This work describes a class of Algorithm Substitution Attack (ASA) generically targeting the receiver of a communication between two parties. Our work provides a unified framework that applies to any scheme where a secret key is held by the receiver; in particular, message authentication schemes (MACs), authenticated encryption (AEAD) and public key encryption (PKE). Our unified framework brings together prior work targeting MAC schemes (FSE’19) and AEAD schemes (IMACC’19); we extend prior work by showing that public key encryption may also be targeted. ASAs were initially introduced by Bellare, Paterson and Rogaway in light of revelations concerning mass surveillance, as a novel attack class against the confidentiality of encryption schemes. Such an attack replaces one or more of the regular scheme algorithms with a subverted version that aims to reveal information to an adversary (engaged in mass surveillance), while remaining undetected by users. Previous work looking at ASAs against encryption schemes can be divided into two groups. ASAs against PKE schemes target key generation by creating subverted public keys that allow an adversary to recover the secret key. ASAs against symmetric encryption target the encryption algorithm and leak information through a subliminal channel in the ciphertexts. We present a new class of attack that targets the decryption algorithm of an encryption scheme for symmetric encryption and public key encryption, or the verification algorithm for an authentication scheme. We present a generic framework for subverting a cryptographic scheme between a sender and receiver, and show how a decryption oracle allows a subverter to create a subliminal channel which can be used to leak secret keys. We then show that the generic framework can be applied to authenticated encryption with associated data, message authentication schemes, public key encryption and KEM/DEM constructions. We consider practical considerations and specific conditions that apply for particular schemes, strengthening the generic approach. Furthermore, we show how the hybrid subversion of key generation and decryption algorithms can be used to amplify the effectiveness of our decryption attack. We argue that this attack represents an attractive opportunity for a mass surveillance adversary. Our work serves to refine the ASA model and contributes to a series of papers that raises awareness and understanding about what is possible with ASAs.

1 Introduction

Consider two parties communicating over an untrusted channel (in the presence of an adversary). Desired security properties for this scenario include confidentiality and integrity. Confidentiality means that the adversary is unable to learn anything about the messages sent between the parties. Integrity means that the parties can be sure that the messages have not been tampered with in transit. Both confidentiality and integrity are well-studied problems, and there are many reliable and provably secure cryptographic solutions. These solutions rely on the assumption that the software or hardware in which they are implemented behaves as expected. However, we know that in the real world, this assumption does not necessarily hold. Powerful adversaries have the means to insert unreliability into cryptography via external (“real-world”) infrastructure: whether by influencing standards bodies to adopt “backdoored” parameters, inserting exploitable errors into software implementations, or compromising supply chains to interfere with hardware. The Snowden revelations showed that this is indeed the case, and that large and powerful adversaries (interested in mass surveillance) have sought to circumvent cryptography. The reader is referred to the survey by Schneier et al. [57], which provides a broad overview of subversion of cryptography, with some useful case studies detailing known subversion attempts.

The idea that an adversary may embed a backdoor or otherwise tamper with the implementation or specification of a cryptographic scheme or primitive predates the Snowden revelations, and was initiated in a line of work by Young and Yung that they named kleptography [60, 61]. This area of study can be traced back to Simmons’ work on subliminal channels, e.g. [58], undertaken in the context of nuclear non-proliferation during the Cold War. In the original conception [60], kleptography considered a saboteur who designs a cryptographic algorithm whose outputs are computationally indistinguishable from the outputs of an unmodified trusted algorithm. The saboteur’s algorithm should leak private key data through the output of the system, which was achieved using the same principles as Simmons’ earlier subliminal channels. Post-Snowden, work in this area was reignited by Bellare, Paterson and Rogaway (BPR) [14], who formalised the study of so-called algorithm substitution attacks (ASAs) through the example of symmetric encryption schemes. In abstract terms, the adversary’s goal in an ASA is to create a subverted implementation of a scheme that breaks some aspect of security (such as IND-CPA in the case of encryption) while remaining undetected by the user(s).

1.1 Contributions

We provide formal definitions for subversion attacks against generic cryptographic primitives whose syntax allows for both the sending and receiving party to be subverted. Previous work in this area considered only subversion of the sender; our main contribution is to show that this assumption misses an important class of attack that targets the receiver. In this work, we describe how such an ASA against the receiver can be used to exfiltrate the (receiver’s) key, which represents the most devastating attack from the point of view of an attacker. We show that this class of ASA can be applied to symmetric settings (authenticated encryption, message authentication codes, and data encapsulation mechanisms), as well as asymmetric settings (public key encryption and key encapsulation mechanisms). Our work brings together previous work targeting AEAD schemes [5] and MAC schemes [4] in a common framework, expanded to incorporate public key encryption.

Concretely, we alter the behaviour of the receiver’s algorithm to leak information through (artificially induced) decryption error events—the subverted algorithm either rejects (particular, “trigger”) valid ciphertexts or accepts (particular, “trigger”) bogus ciphertexts. An adversary observing the receiver who is able to determine whether a ciphertext has been accepted or rejected learns some information; this subliminal channel can be used to exfiltrate the user’s key. The assumption that a surveillance adversary is able to observe whether a receiver’s algorithm implementation accepts or rejects a ciphertext is a mild one in many practical scenarios; for example, a decryption error may result in a network packet being dropped and automatically retransmitted.¹ A subverted algorithm could, furthermore, go beyond this by e.g. influencing timing information in future messages sent to the network. We conclude that this attack represents an attractive and easy to implement opportunity for a mass surveillance adversary.

1.1.1 AEAD

We first examine authenticated encryption with associated data (AEAD), a symmetric cryptographic primitive that offers the combined properties of confidentiality and message integrity. We show that our class of ASA applies to the decryption component of AEAD schemes, leaking the symmetric key. Our results stand in opposition to previous work [11, 14, 28] which proposed subversion resilience of a large class of AEAD schemes to which many if not all real-world constructions such as GCM, CCM and OCB belong, as long as their nonces are generated deterministically via a shared state maintained by both encryptor and decryptor. The crucial observation to resolve this apparent contradiction is that previous work has assumed, besides explicitly spelled out requirements like uniqueness of ciphertexts and perfect decryptability, implicit notions such as integrity of ciphertexts. In the ASA setting for AEAD where undermining the confidentiality of a scheme is the primary goal of an adversary, it seems just as natural to assume that the adversary is also willing to compromise the integrity guarantees as well.

1.1.2 MACs

We next show that our results apply equally in the setting of message authentication schemes (MACs). MACs provide a message authentication code or tag for a given message; conversely, given a message and a tag, the MAC provides verification that the tag was generated from the message (that is, that the tag is genuine). The security of a MAC is determined by the difficulty of forging tags. If no adversary can forge a tag, then a message with a correct tag must have been generated by the sender. An ASA against a MAC replaces either the tagging function (the generation of message authentication codes) or the verification function (checking that tags have been honestly generated) in such a way as to leak information to an adversary. Applying our attack to a MAC leaks the secret key to an adversary, allowing them to forge any tag. This is an attractive goal for an adversary in real-world settings, as once integrity has been compromised, this can often be leveraged to perform any number of other attacks, for example: enabling attacks against (“encrypt-then-MAC”) confidentiality; getting users to accept compromised (authenticated) software updates; injecting malicious packets into (secured) communication streams to de-anonymise users.

1.1.3 PKE

Lastly, we show that public key encryption (PKE) is also vulnerable to our class of ASA. A public key (or asymmetric) encryption scheme allows secure communication between parties that have not shared a secret key with one another. PKE works by having two keys: the public key is used to encrypt messages, and the private key is used to decrypt. The security of a PKE scheme is determined by the difficulty of determining any information about underlying messages for a given ciphertext.

Our ASA attacks on PKE require a fairly large number of ciphertexts to be sent and observed to reject erroneously in order for the private key to be exfiltrated. In practice, this condition will be met: consider a server that hosts traffic for a large number of clients. The server will have a private/public key pair which is held static over long periods of time. Observing the server receive ciphertexts from many clients will allow an adversary to witness a large enough amount of traffic to recover the server’s private key, rendering all communications between clients and server compromised.

Due to the high overheads associated with PKE, symmetric encryption is better suited to bulk communication. In most practical settings, PKE is used to establish a shared secret between the sender and receiver, so that the shared secret may be used as a key for communicating via symmetric encryption. This notion of sending keys for symmetric encryption via public key methods is formalised as a key encapsulation mechanism (KEM). We show how our notions of subversion apply also to KEMs in Appendix 1. KEMs are typically used together with a data encapsulation mechanism (DEM) in a so-called hybrid encryption scheme to PKE-encrypt messages. We give the definition of a DEM in Appendix 1 for completeness.

1.2 Structure of this document

We first describe related work in Sect. 2, focussing on ASAs that target symmetric encryption, PKE and MACs. Section 3 describes the notation used in this article. We give an abstract description of an ASA targeting generic cryptographic schemes consisting of a sender and receiver in Sect. 4, together with notions of undetectability (Sect. 4.1) and key recovery (Sect. 4.2). We also discuss hybrid subversion (Sect. 4.3), the idea that multiple algorithms (e.g. key generation and encryption) is subverted in tandem. In Sect. 5, we discuss authenticated encryption with associated data, giving syntax and security definitions: privacy in Sect. 5.1 and integrity in Sect. 5.2. We show that our notion of ASAs apply to AEAD schemes in Sect. 5.3. Section 6 discusses MACs, including the definition of integrity; Sect. 6.1 shows that our notion of ASAs apply to MAC schemes. Section 7 discusses PKE, giving syntax and security definitions; Sect. 7.1 shows that our notion of ASAs applies to PKE schemes. We describe our concrete subversion attack, targeting the receiver algorithm, in Sect. 8, together with an analysis of the undetectability and key recovery properties of our attack. We give two versions, a passive attack in Sect. 8.2 and an active attack in Sect. 8.3.

2 Related work

2.1 Symmetric encryption

BPR [14] demonstrate an attack against certain randomised encryption schemes that relies on influencing the randomness consumed in the course of encryption. Their attack, which they call the “biased-ciphertext attack”, is a generic method that relies on rejection sampling. Randomness is resampled until ciphertexts satisfy a particular format (for example, implanting information in the least significant bits), resulting in a subliminal channel.

There is a tension for “Big Brother” between mounting a successful attack and being detected; clearly an attack that simply replaces the encryption algorithm with one that outputs the messages in plaintext would be devastating yet trivially detectable. BPR stipulate that ciphertexts generated with a subverted encryption algorithm should at the very least decrypt correctly with the unmodified decryption routine, in order to have some measure of resistance to detection. Furthermore, BPR define the success probability of a mass surveillance adversary in carrying out a successful attack, as well as the advantage of a user in detecting that a surveillance attack is taking place. The attack of BPR was later generalised by Bellare, Jaeger and Kane (BJK) [11] whose attack applies to all randomised schemes. Furthermore, whereas the attack of BPR is stateful and so vulnerable to detection through state reset, the BJK attack is stateless. BJK [11] later formalised the goal of key recovery as the desired outcome of an ASA from the point of view of a mass surveillance adversary. Lastly, BPR also establish a positive result that shows that under certain assumptions, it is possible for authenticated encryption schemes to provide resistance against subversion attacks.

Degabriele, Farshim and Poettering (DFP) [28] critiqued the definitions and underlying assumptions of BPR. Their main insight is that the perfect decryptability—a condition mandated by BPR— is a very strong requirement and artificially limits the adversary’s set of available strategies. In practice, a subversion with negligible detection probability, say $2^{-128}$, should be considered undetectable.² As DFP note, decryption failures may happen for reasons other than a subverted encryption algorithm, and if they occur sporadically may easily go unnoticed. Thus, a subverted encryption scheme that exhibits decryption failure with a very low probability is a good candidate for a practical ASA that is hard to detect. DFP demonstrate how this can be achieved with an input-triggered subversion, where the trigger is some message input that is difficult to guess, making detection practically impossible. Our work complements the trigger message approach of DFP by limiting ciphertext integrity and establishing a covert channel through decryption error events.

2.2 PKE

Yung and Young (YY) in [60] examine subverting asymmetric protocols in so-called “SETUP” attacks. Their core idea is to encode some information within the public key that allows the private key to be reconstructed. As a simple example, let the public key encode the encryption of the user’s private key under the adversary’s key. Subverted keys should be indistinguishable from real keys and only the adversary should be able to recover a user’s private key from the subverted public key. As well as showing how to subvert RSA keys, YY also give examples of attacks against ElGamal, DSA and Kerberos. Later, Crépeau and Slakmon [27] gave an improved subversion attack against RSA which works by hiding half of the bits of p in the representation of the RSA modulus $N=pq$. Using Coppersmith’s partial information attack [24], it is then possible to recover p and q.

For the prior work on symmetric encryption discussed above, the techniques can be translated naturally into a PKE setting. Attacks against the encryption algorithm of a PKE scheme however do not present an attractive attack to a mass surveillance adversary, as there is limited scope to undermine confidentiality. The covert channel usually has a bandwidth of a small number of bits per (subverted) ciphertext: not enough to leak the underlying messages. Leaking the private key would allow confidentiality to be broken completely, but the encryption algorithm does not have access to the private key. Chen, Huang and Yung [23] overcome these limitations by considering hybrid PKE constructions consisting of a KEM to send encapsulated session keys which are used for symmetric encryption with a DEM. Their non-generic attack applies to a particular class of practical KEM constructions and leaks session keys, that in turn break the security of the DEM. In contrast, for a PKE primitive not consisting of a hybrid KEM/DEM construction, targeting the decryption algorithm remains the only way to subvert the encryption/ decryption facility of a PKE scheme.

2.3 MACs

The only prior work on MAC subversion that we are aware of is by Al Mansoori, Baek, and Salah [1] who explore how a MAC component in the EAP-PSK wireless protocol could be subverted. After first arguing [1, §II.D] that randomised MAC schemes offer better protection against a kind of birthday attack, they restrict attention to precisely one corresponding construction (two-key CBC-MAC with a random translation of the second key, a scheme that already turned out to be broken in [44]) and show that the rejection-sampling-based key-extraction techniques from [14] are applicable in this setting as well. We emphasise that our results reach far beyond this: our subversion attacks are generic (rather than being focused on one specific MAC) and we do not require exotic technical conditions like randomised tag generation.³

2.4 Further work

Cryptographic reverse firewalls [21, 33, 47, 48, 59] represent an architecture to counter ASAs against asymmetric cryptography via trusted code in network perimeter filters. At a high level, the approach is for a trusted third party to re-randomise ciphertexts before transmission over a public network to destroy any subliminal messages. Fischlin and Mazaheri show how to construct ASA-resistant (asymmetric) encryption and signature algorithms given initial access to a trusted base scheme [37]. Their approach uses trusted samples to essentially perform re-randomisation of ciphertexts.

In a series of work, Russell, Tang, Yung and Zhou [53,54,55,56] study ASAs on one-way functions, trapdoor one-way functions and key generation as well as defending randomised algorithms against ASAs using so-called watchdogs. The watchdog model allows a trusted party to test the implementation of a primitive for subversion, in a variety of different assumptions (e.g. on- or offline, black- or white-box access). Combiners are often used to provide subversion resilience, particularly in the watchdog model. A combiner [38, 50] essentially combines the output from different algorithms (or runs of the same algorithm) in such a way as to produce secure (in this case, unsubverted) combined output as long as any one of the underlying outputs is secure. Aviram et al. [7] consider combining (potentially maliciously chosen) keys for Post-Quantum protocols such as TLS. Bemman, Chen and Jager [16] show how to construct a subversion-resilient KEM, using a variant of a combiner and a subversion resilient randomness generator. Their construction considers Russell et al.’s watchdog from a practical perspective, meaning an offline watchdog that runs in linear time. Another line of work, [9, 31, 36], examined backdoored hash functions, showing how to immunise hash functions against subversion.

Bellare, Kane and Rogaway [12] explore how large keys can prevent key exfiltration in the symmetric encryption setting. Bellare and Hoang [10] give PKE schemes that defend against the subversion of random number generators. The use of state reset to detect ASAs is studied by Hodges and Stebila [41]. Berndt and Liśkiewicz [17] reunite the fields of cryptography and steganography. Goh, Boneh, Pinkas and Golle [39] show how to add key recovery to the SSH and SSL/TLS protocols. Ateniese, Magri and Venturi [6] study ASAs on signature schemes. Berndt et al. consider ASAs against protocols such as TLS, WireGuard and Signal [18]. Dodis, Ganesh, Golovnev, Juels and Ristenpart [32] provide a formal treatment of backdooring PRGs, another form of subversion. This work was extended by Degabriele, Paterson, Schuldt and Woodage [29] to look at robust PRNGs with input. Camenisch, Drijvers and Lehmann [22] consider Direct Anonymous Attestation in the presence of a subverted Trusted Platform Module.

2.5 Cryptographic versus non-cryptographic subversion

In the literature on cryptography, the notion of an ASA assumes the malicious replacement of one or more algorithms of a scheme by a backdoored version, with the goal to leak key material, or at least to weaken some crucial security property. Different types of substitution attack appear in other areas of computing and communication. We discuss some examples in the following.

Program code in the domain of computer malware routinely modifies system functions to achieve its goals, where the latter comprises delivering some damaging payload, ensuring non-detection and thus survival of the malware on the host system, and in some cases even self-reproduction. Numerous techniques towards suitably modifying a host system have been developed and reported on by academic researchers and hackers. Standard examples include redirecting interrupt handlers, changing the program entry point of an executable file, and interfering with the OS kernel by overwriting its data structures [40].

Malicious modifications of implemented functionality are also a recognised threat in the hardware world. It is widely understood that circuit designers who do not possess the technical means to produce their own chips but instead out-source the production process to external foundries, risk that the chips produced might actually implement a maliciously modified version of what is expected. A vast number of independent options are known for when (within the production cycle) and how (functionally) subversions could be conducted. For instance, the survey provided in [19] reports that circuit design software (CAD) could be maliciously altered, that foundries could modify circuits before production, and that after production commercial suppliers could replace legitimate chips by modified ones. Further, [19] suggests that appealing types of functionality modification include deviating from specification when particular input trigger events are recognised, and/or to leak values of vital internal registers via explicitly implemented side channels. Any such technique (or combination thereof) has an individual profile regarding the associated costs and attack detectability. Which of the many options is most preferable depends on the specific attack scenario and target.

We refer to the software- and hardware-based subversion techniques discussed above as “technology driven”. This is in contrast to the techniques considered in this paper which we refer to as “semantics driven”. We consider the two approaches orthogonal: Our (semantics driven) proposed subversion can be implemented using techniques from e.g. [19, 40] (but likewise also through standard methods), and technology-driven subversion proposals can be applied against cryptographic implementations (but likewise also against any other interesting target functionality). Our semantics-driven approach in fact aims to maximise technology independence. As a consequence, the line of attacks proposed in this paper can be implemented easily in software (e.g. in libraries or drop-in code), in hardware (e.g. in ASICs and FPGAs), and in mixed forms (e.g. firmware-programmed microcontrollers). The strategy to achieve this independence is to base the attacks and corresponding notions of (in)security on nothing but the abstract functionalities of the attacked scheme as they are determined by their definitions of syntax and correctness.

As the technology-driven and semantics-driven approaches are independent, they can in particular be combined. This promises particularly powerful subversions. For instance, consider that virtually all laptops and desktop PCs produced in the past decade are required to have an embedded trusted platform module (TPM) chip that supports software components (typically boot loaders and operating systems) with trusted cryptographic services. In detail, software can interact with a TPM chip through standardised API function calls and have cryptographic operations applied to provided inputs, with all key material being generated and held exclusively in the TPM. As TPMs are manufactured in hardware, it seems that the (technology driven) subversion options proposed in [19] would be particularly suitable. However, as most of the attacks from [19] require physical presence of the adversary (e.g. to provide input triggers via specific supply voltage jitters or for extracting side channel information by operating physical probes in proximity of the attacked chip), only those options seem feasible where all attack conditions and events can be controlled and measured via the software interface provided by the API. This is precisely what our semantics driven attacks provide. We thus conclude by observing that dedicated cryptographic hardware like TPMs can only be trusted if extreme care is taken during design and production. While our article lays open the most general and clean line of attack, other attacks might exist as well.

2.5.1 Discussion

As the discussion of cryptographic (“semantics driven”) vs. non-cryptographic (“technology driven”) subversion shows, achieving security against adversaries mounting ASAs is difficult, and essentially reduces to assuming trust in particular components or architectures. The three main theoretical approaches to preventing or mitigating against ASAs in the literature, discussed in Sect. 2.4, are reverse firewalls, self-guarding protocols and watchdogs. We note that these approaches apply in the main to asymmetric primitives, and so (appropriately adapted to target receiver algorithms) would be suitable to defend against our attack against asymmetric schemes in Sect. 7.

Defending against our attacks on AEAD and MACs is more difficult. We note that the watchdog model applies in theory, while reverse firewalls and self-guarding approaches are ineffective against symmetric primitives. The watchdog model considers splitting a primitive into constituent algorithms that are run as subroutines by a trusted “amalgamation” layer. This allows the constituent algorithms to be individually checked and sanitised. Considering the verification algorithm of a MAC scheme as an example, the canonical approach of recalculating and checking the tag is modelled by letting the verification algorithm be a trusted amalgamation of the tagging algorithm with an identity test. The tagging algorithm typically runs a hash function as a subroutine, and so applying results from [9, 31, 36] would allow for the claim that the verification algorithm can be made subversion-resilient in the watchdog model. The assumption of a trusted amalgamation is precisely what makes our attack infeasible, but this assumption is questionable in real-world settings. In particular, as we discussed above, the presence of non-cryptographic vectors makes this assumption unlikely to hold in practice.

Lastly, we note that none of the theoretical approaches are fully satisfying, requiring strong or impractical assumptions. Indeed, it is telling that there are no implementations of subversion-resilient primitives to date, although some recent work seems promising in this regard [16, 21]. The best defence seems to be the unglamorous task of minimising risk by implementing a variety of control mechanisms across the whole infrastructure, in a process of security management. In particular: software implementations could be protected by measures including regular integrity tests and secure boot, hardware implementations could be protected by technical controls such as threshold implementations or testing amplification [35], and both cases can be strengthened by relying on open source implementations and verified supply chains. While such measures can go some way towards minimising risk, we emphasise that there are no security guarantees.

3 Notation

We refer to an element $x\in \{0,1\}^*$ as a string, and denote its length by |x|. The set of strings of length l is denoted $\{0,1\}^l$. By $\varepsilon$, we denote the empty string. For $x\in \{0,1\}^*$, we let x[i] denote the i-th bit of x, with the convention that we count from 0, i.e. we have $x=x[0]\ldots x[|x|-1]$. We use Iverson brackets $[\cdot ]$ to derive bit values from Boolean conditions: For a condition C, we have $[C]=1$ if C holds; otherwise, we have $[C]=0$.

We use code-based notation for probability and security experiments. We write $\leftarrow$ for the assignment operator (that assigns a right-hand-side value to a left-hand-side variable). If $S,S'$ are sets, we write shorthand for $S\leftarrow S\cup S'$. If S is a finite set, then $s \leftarrow _{\scriptscriptstyle \$}S$ denotes choosing s uniformly at random from S. For a randomised algorithm $\mathsf {A}$, we write $y\leftarrow _{\scriptscriptstyle \$}\mathsf {A}(x_1,x_2,\ldots )$ to denote the operation of running $\mathsf {A}$ with inputs $x_1,x_2,\ldots$ and assigning the output to variable y. We denote a $\gamma$-biased Bernoulli trial by $B(\gamma )$, i.e. a random experiment with possible outcomes 0 or 1 such that $\Pr [b\leftarrow _{\scriptscriptstyle \$}B(\gamma ):b=1]=\gamma$. The assignments $b\leftarrow _{\scriptscriptstyle \$}\{0,1\}$ and $b\leftarrow _{\scriptscriptstyle \$}B(1/2)$ are thus equivalent. We use superscript notation to indicate when an algorithm (typically an adversary) is given access to specific oracles. An experiment terminates with a “stop with x” instruction, where value x is understood as the outcome of the experiment. We write “win” (“lose”) as shorthand for “stop with 1” (“stop with 0”). We write “require C”, for a Boolean condition C, shorthand for “if not C: lose”. (We use require clauses typically to abort a game when the adversary performs some disallowed action, e.g. one that would lead to a trivial win.) The “${:=}$” operator creates a symbolic definition; for instance, the code line “$A{:=} E$” does not assign the value of expression E to variable A but instead introduces symbol A as a new (in most cases abbreviating) name for E.

4 Notions of subversion attacks

We consider subversions of the algorithms of cryptographic schemes. Abstractly, we consider a cryptographic scheme $\Pi =(\Pi .\mathsf {gen},\Pi .\mathsf {S},\Pi .\mathsf {R})$ consisting of three components: a key generation algorithm together with an algorithm on the sender side and an algorithm on the receiver side, where the cryptographic scheme is an encryption scheme, $\Pi .\mathsf {S}$ represents encryption and $\Pi .\mathsf {R}$ decryption; when we consider message authentication schemes, the corresponding components represent tagging and verification.

We give a generic syntax to the scheme $\Pi$ as follows: key generation $\Pi .\mathsf {gen}$ outputs a key pair $(k_\mathsf {S},k_\mathsf {R})\in \mathcal {K}_\mathsf {S}\times \mathcal {K}_\mathsf {R}$; the sender algorithm has associated input and output spaces $\mathcal {X},\mathcal {Y}$ and takes as input a key $k_\mathsf {S}\in \mathcal {K}_\mathsf {S}$ and $x\in \mathcal {X}$, outputting $y\in \mathcal {Y}$; the receiver algorithm has associated input and output spaces $\mathcal {Y},\mathcal {X'}$ (respectively). We note that $\mathcal {X}\subsetneq \mathcal {X'}$; in particular, $\bot \in \mathcal {X'}\setminus \mathcal {X}$. The receiver algorithm takes as input a key $k_\mathsf {R}\in \mathcal {K}_\mathsf {R}$ and $y\in \mathcal {Y}$, outputting $x\in \mathcal {X'}$; the special symbol $\bot$ is used to indicate failure. A shortcut notation for this syntax is

$$\begin{aligned} \Pi .\mathsf {gen}\rightarrow \mathcal {K}_\mathsf {S}\times \mathcal {K}_\mathsf {R},\quad \mathcal {K}_\mathsf {S}\times \mathcal {X}\rightarrow \Pi .\mathsf {S}\rightarrow \mathcal {Y}, \\ \text {and}\quad \mathcal {K}_\mathsf {R}\times \mathcal {Y}\rightarrow \Pi .\mathsf {R}\rightarrow \mathcal {X'}. \end{aligned}$$

A scheme $\Pi$ is said to be $\delta$-correct if for all $(k_\mathsf {S},k_\mathsf {R})\leftarrow \Pi .\mathsf {gen}$ and $x\in \mathcal {X}$ and $y\leftarrow \Pi .\mathsf {S}(k_\mathsf {S},x)$ and $x'\leftarrow \Pi .\mathsf {R}(k_\mathsf {R},y)$ we have

$$\begin{aligned} \Pr \left[ x'\ne x \right] \le \delta \,, \end{aligned}$$

where the probability is over all random coins involved. In the case that $\delta =0$, the scheme is said to be perfectly correct. We note that this generic syntax applies to symmetric encryption (Sect. 5) and message authentication (Sect. 6), as well as to public key encryption (Sect. 7), where for the symmetric case we require $k_\mathsf {S}=k_\mathsf {R}$.

In the following, we give formal definitions for subversion of key generation, sender and receiver algorithms, together with the notion of undetectability (UD). In a nutshell, a subversion is undetectable if distinguishers with black-box access to either the original scheme or to its subverted variant cannot tell the two apart. A subversion should exhibit a dedicated functionality for the subverting party, but simultaneously be undetectable for all others. This apparent contradiction is resolved by parameterising the subverted algorithm with a secret subversion key, knowledge of which enables the extra functionality. (The same technique is used in most prior work, starting with [14].) In what follows, we denote the corresponding subversion key spaces with $\mathcal {I}_\mathsf {gen}, \mathcal {I}_\mathsf {S}$ and $\mathcal {I}_\mathsf {R}$.

In this section, we also specify, by introducing notions of key recoverability, how we measure the quality of a subversion from the point of view of the subverting adversary (who is assumed to know the subversion keys).

4.1 Undetectable subversion

We first define undetectability notions for subverted key generation, sender and receiver algorithms separately. We then offer a joint definition.

Subverted Key Generation A subversion of the key generation algorithm $\Pi .\mathsf {gen}$ of a cryptographic scheme consists of a finite index space $\mathcal {I}_{\mathsf {gen}}$ and a family of algorithms $\mathcal {G} en =\{\Pi .\mathsf {gen}_i\}_{i\in \mathcal {I}_{\mathsf {gen}}}$ with

$$\begin{aligned} \Pi .\mathsf {gen}_i\rightarrow \mathcal {K}_\mathsf {S}\times \mathcal {K}_\mathsf {R}. \end{aligned}$$

That is, for all $i\in \mathcal {I}_{\mathsf {gen}}$ the algorithm $\Pi .\mathsf {gen}_i$ can syntactically replace the algorithm $\Pi .\mathsf {gen}$.

As a security property, we require that also the observable behaviour of $\Pi .\mathsf {gen}$ and $\Pi .\mathsf {gen}_i$ be effectively identical (for uniformly chosen $i\in \mathcal {I}_{\mathsf {gen}}$). This is formalised via the games $\mathrm {UDG}^0,\mathrm {UDG}^1$ in Fig. 1(left). For any adversary $\mathcal {A}$, we define the advantage

$$\begin{aligned} \mathsf {Adv}^{\mathrm {udg}}_{\Pi }(\mathcal {A}){:=}|\Pr [\mathrm {UDG}^1(\mathcal {A})]-\Pr [\mathrm {UDG}^0(\mathcal {A})]|\end{aligned}$$

and say that family $\mathcal {G} en$ undetectably subverts algorithm $\Pi .\mathsf {gen}$ if $\mathsf {Adv}^{\mathrm {udg}}_{\Pi }(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

Fig. 1

Games $\mathrm {UDG}$, $\mathrm {UDS}$ and $\mathrm {UDR}$ modelling undetectability for the subversion of (respectively) key generation, sender and receiver algorithms for a cryptographic scheme $\Pi$. See Sect. 3 for the meaning of “${:=}$”. Note that in each game, the two unsubverted oracles are actually redundant

Subverted Sender A subversion of the sender algorithm $\Pi .\mathsf {S}$ of a cryptographic scheme consists of a finite index space $\mathcal {I}_{\mathsf {S}}$ and a family $\mathcal {S}=\{\mathsf {S}_i\}_{i\in \mathcal {I}_\mathsf {S}}$ of algorithms

$$\begin{aligned} \mathcal {K}_\mathsf {S}\times \mathcal {X}\rightarrow \Pi .\mathsf {S}_i\rightarrow \mathcal {Y}. \end{aligned}$$

That is, for all $i\in \mathcal {I}_{\mathsf {S}}$ the algorithm $\Pi .\mathsf {S}_i$ can syntactically replace the algorithm $\Pi .\mathsf {S}$.

As a security property, we also require that the observable behaviour of $\Pi .\mathsf {S}$ and $\Pi .\mathsf {S}_i$ be effectively identical (for uniformly chosen $i\in \mathcal {I}_\mathsf {S}$). This is formalised via the games $\mathrm {UDS}^0, \mathrm {UDS}^1$ in Fig. 1 (centre). Note that in contrast to prior work like [14, 28], our distinguishers are given free choice over the keys to be used.⁴ For any adversary $\mathcal {A}$, we define the advantage

$$\begin{aligned} \mathsf {Adv}^{\mathrm {uds}}_{\Pi }(\mathcal {A}){:=}|\Pr [\mathrm {UDS}^1(\mathcal {A})]-\Pr [\mathrm {UDS}^0(\mathcal {A})]|\end{aligned}$$

and say that family $\mathcal {S}$ undetectably subverts algorithm $\Pi .\mathsf {S}$ if $\mathsf {Adv}^{\mathrm {uds}}_{\mathsf {PKE}}(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

Subverted Receiver A subversion of the receiver algorithm $\Pi .\mathsf {R}$ of a cryptographic scheme consists of a finite index space $\mathcal {I}_{\mathsf {R}}$ and a family $\mathcal {R}=\{\Pi .\mathsf {R}_i\}_{i\in \mathcal {I}_\mathsf {R}}$ of algorithms

$$\begin{aligned} \mathcal {K}_\mathsf {R}\times \mathcal {Y}\rightarrow \Pi .\mathsf {R}_i\rightarrow \mathcal {X'}. \end{aligned}$$

That is, for all $i\in \mathcal {I}_{\mathsf {R}}$, the algorithm $\Pi .\mathsf {R}_i$ can syntactically replace the algorithm $\Pi .\mathsf {R}$.

As a security property, we also require that the observable behaviour of $\Pi .\mathsf {R}$ and $\Pi .\mathsf {R}_i$ be effectively identical (for uniformly chosen $i\in \mathcal {I}_\mathsf {R}$). This is formalised via the games $\mathrm {UDR}^0, \mathrm {UDR}^1$ in Fig. 1 (right). For any adversary $\mathcal {A}$, we define the advantage

$$\begin{aligned} \mathsf {Adv}^{\mathrm {udr}}_{\Pi }(\mathcal {A}){:=}|\Pr [\mathrm {UDR}^1(\mathcal {A})]-\Pr [\mathrm {UDR}^0(\mathcal {A})]|\end{aligned}$$

and say that family $\mathcal {R}$ undetectably subverts algorithm $\Pi .\mathsf {R}$ if $\mathsf {Adv}^{\mathrm {udr}}_{\mathsf {PKE}}(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

The above undetectability notions demand that subversions do not change the observable behaviour of the key generation, sender and receiver algorithms. A consequence of this is that none of the correctness or security properties of the scheme are noticeably harmed by subversion.

4.1.1 Hybrid subversion of key generation, sender and receiver algorithms

We give a joint definition of undetectability, in the case where the key generation, sender and receiver algorithms are subverted. This is the most general definition; in particular contexts, it may not be appropriate to consider subversion of a particular algorithm—we discuss this in Sects. 4.3, 5.3, 6.1.1 and 7.1.1.

Game $\mathrm {UD}^b$ in Fig. 2(left) combines games $\mathrm {UDG}^b$, $\mathrm {UDS}^b$ and $\mathrm {UDR}^b$ into one. We define

$$\begin{aligned} \mathsf {Adv}^{\mathrm {ud}}_{\Pi }(\mathcal {A}){:=}|\Pr [\mathrm {UD}^1(\mathcal {A})]-\Pr [\mathrm {UD}^0(\mathcal {A})]|. \end{aligned}$$

By a hybrid argument, for all adversaries $\mathcal {A}$, there exist adversaries $\mathcal {A}',\mathcal {A}'', \mathcal {A}'''$ such that

$$\begin{aligned} \mathsf {Adv}^{\mathrm {ud}}_{\Pi }(\mathcal {A})\le \mathsf {Adv}^{\mathrm {udg}}_{\Pi }(\mathcal {A}') +\mathsf {Adv}^{\mathrm {uds}}_{\Pi }(\mathcal {A}'')+\mathsf {Adv}^{\mathrm {udr}}_{\Pi }(\mathcal {A}'''). \end{aligned}$$

Fig. 2

Left: Game $\mathrm {UD}$ modelling hybrid subversion undetectability for a cryptographic scheme $\Pi$. Note that not all of the algorithms need necessarily be subverted, although the syntax allows for this. See the discussion at Sects. 5.3, 6.1.1 and 7.1.1. Centre, Right: Games $\mathrm {KRP}$ and $\mathrm {KRA}$ modelling key recoverability for passive and active attackers, respectively. Note that the adversary’s aim is to recover the receiver’s key $k_\mathsf {R}$, as in both symmetric and asymmetric settings this value is secret

4.2 Subversion leading to key recovery

We observed above that if any of the components $\Pi .\mathsf {gen},\Pi .\mathsf {S}, \Pi .\mathsf {R}$ of a cryptographic scheme $\Pi$ is undetectably subverted, with uniformly chosen indices $i_\mathsf {gen},i_\mathsf {S},i_\mathsf {R}$ that remain unknown to the participants, then all security guarantees are preserved from the original scheme. This may be different if (any of) $i_\mathsf {gen},i_\mathsf {S},i_\mathsf {R}$ are known to an attacking party, and indeed, we assume that mass-surveillance attackers leverage such knowledge to conduct attacks. For any cryptographic scheme, the most devastating attack goal for an attacker is key recovery (KR): Users generate keys using their key generation algorithm $(k_\mathsf {S},k_\mathsf {R})\leftarrow _{\scriptscriptstyle \$}\Pi .\mathsf {gen}_{i_\mathsf {gen}}$.⁵ Generated secret keys are kept hidden, and the adversary aims at recovering these keys through the subversion. Note that in the symmetric case, $k_\mathsf {S}=k_\mathsf {R}$, whereas in the asymmetric case the receiver’s key $k_\mathsf {R}$ represents the private key. In either case, the value $k_\mathsf {R}$ is the target of a KR adversary.

We formalise this attack goal in two versions. The $\mathrm {KRP}$ game in Fig. 2(centre) assumes a passive attack in which the adversary cannot manipulate inputs or outputs (typically representing messages or ciphertexts) to the sender or receiver, and the $\mathrm {KRA}$ game in Fig. 2(right) assumes an active attack in which the adversary can inject and test arbitrary receiver inputs (which potentially correspond to sender outputs). In both cases, with the aim of closely modelling real-world settings, we restrict the adversary’s influence on the sender inputs $x$ by assuming a stateful “message sampler” algorithm $\mathrm {MS}$ (reflecting the fact that, in the contexts we consider inputs to $\Pi .\mathsf {S}$ typically represent messages) that produces the inputs to $\Pi .\mathsf {S}$ used throughout the game. The syntax of this message sampler is

$$\begin{aligned} \Sigma \times A\rightarrow \mathrm {MS}\rightarrow \Sigma \times \mathcal {X}\times B, \\ (\sigma ,\alpha )\mapsto \mathrm {MS}(\sigma ,\alpha )=(\sigma ',x,\beta ), \end{aligned}$$

where $\sigma ,\sigma '\in \Sigma$ are old and updated state, input $\alpha \in A$ models the influence that the adversary may have on message generation, and output $\beta \in B$ models side-channel outputs. In Fig. 2, we write $\diamond$ for the initial state. Note that while we formalise the inputs $\alpha$ and the outputs $\beta$ for generality (so that our models cover most real-world applications), our subversion attacks are independent of them.⁶ For any message sampler $\mathrm {MS}$ and adversary $\mathcal {A}$, we define the advantages

$$\begin{aligned} \mathsf {Adv}^{\mathrm {krp}}_{\Pi ,\mathrm {MS}}(\mathcal {A}){:=}\Pr [\mathrm {KRP}(\mathcal {A})] \\ \text { and }\mathsf {Adv}^{\mathrm {kra}}_{\Pi ,\mathrm {MS}}(\mathcal {A}){:=}\Pr [\mathrm {KRA}(\mathcal {A})]. \end{aligned}$$

We say that subversion family $\mathcal {G} en ,\mathcal {S},\mathcal {R}$ is key recovering for passive attackers if for all practical $\mathrm {MS}$ there exists a realistic adversary $\mathcal {A}$ such that $\mathsf {Adv}^{\mathrm {krp}}_{\mathrm {MS}(\mathcal {A})}$ reaches a considerable value (e.g. 0.1).⁷ The key recovery notion for active attackers is analogous.

4.2.1 Discussion

We note that the adversary need not necessarily exfiltrate each individual bit of the user’s key,⁸ in order to successfully recover it—this is implicit in our definitions of key recovery. To formalise this, we let the “leakage key” $k_\ell \in \{0,1\}^\lambda$ be a string such that knowledge of $k_\ell$ is sufficient for an adversary to break the security of the primitive. At worst, from the perspective of the adversary, the leakage key may simply be the bit representation of the user’s key. We note that in practice a leakage key consisting of most of the user’s key is sufficient for an adversary to recover the full key using brute force; the exact number of bits to be brute forced would depend on the context and would involve a trade-off for the adversary. Nevertheless, the notion is intuitively clear.

Furthermore, in some contexts, there may be some redundancy or structure that allows for a shorter leakage key. As an example, one may consider DES keys as being 64-bit strings with 8 bits of redundancy, so that an effective leakage key would be of size 56 bits. As another example, the private key in RSA encryption is knowledge of the factorisation of the public modulus $N=pq$. Supposing that the modulus N can be represented using $n=\lfloor \log {N}\rfloor$-bits, one may consider RSA private keys as being $n/2=\lfloor \log {p}\rfloor$-bit strings. However, knowledge of around half the bits of p is sufficient to be able to factorise N using Coppersmith’s partial information attack [24], so that an effective leakage key might have length $\lambda =\lfloor \log {p}\rfloor /2$.⁹

A different approach might be to leak, for example, the seed of a pseudo-random number generator. We discuss breaking security without extracting the full key further in Sect. 4.4.

4.3 Hybrid subversion

Previous work on subversion has looked at either subverted key generation¹⁰ or subverted encryption/ decryption, but not considered the case where these are subverted in tandem. For key generation, this has meant that the subverted algorithm needs to leak the whole key in a single operation. This setting was studied by Young and Yung [60] under the name “kleptography”, and they showed how it is possible to subvert key generation such that the adversary is able to recover the private key $sk$ from the public key $pk$ (together with any public parameters and knowledge of secret trapdoor information). They show how such attacks against key generation could look in the case of RSA and ElGamal cryptosystems. Such subversion imposes a large cost on the subverter: requiring that all key bits are leakable in one operation means that the subverted keys are given some structure (e.g. the public key is the encryption of the secret key under the attacker’s key). This imposes significant overhead, and would likely lead to detection in a real world setting (using either timing information, code review or hardware inspection). Considering the subversion of key generation and sender/receiver algorithms in tandem, it is possible to reduce this overhead.

Generically, this tandem subversion can be achieved by subverting key generation to produce weaker keys and combining this with a subverted sender and/or receiver that provides a subliminal channel. Consider a subverted key generation algorithm $\Pi .\mathsf {gen}_i$ that outputs (receiver keys) in some reduced key set $\widetilde{\mathcal {K}}_\mathsf {R}\subset \mathcal {K}_\mathsf {R}$. The smaller this subverted key set $\widetilde{\mathcal {K}}_\mathsf {R}$, the less information needs to be leaked via the subliminal channel. One method to implement such a subverted key generation algorithm is to use the rejection sampling method described in Sect. 2.1, so that $\Pi .\mathsf {gen}_i$ runs the unsubverted algorithm $\Pi .\mathsf {gen}$ as a subroutine and resamples until keys are in $\widetilde{\mathcal {K}}_\mathsf {R}$. There are certainly more targeted attacks that take into account the specific structure of keys being generated—and that may leverage more specific attacks than the generic weakening of keys.

4.4 Breaking security without extracting the full key

The $\mathrm {KRA}$ and $\mathrm {KRP}$ notions introduced in Sect. 4.2 assume that key recovery is the ultimate goal in subversion. This suggests that longer keys make a scheme more resilient, an approach explored in big key cryptography [12]. In practice, it may be more efficient to exploit non-generic features of a particular scheme to minimise the information to be leaked. In this section, we will consider AEAD schemes as an illustrative example.

As we detail, many current AEAD schemes have inner building blocks that maintain their own secret values, and scaling up key sizes does not automatically also increase the sizes of these internal values. We note that proposed ASAs against AEAD schemes (including our attacks presented in Sect. 8) can easily be adapted to leak this internal information instead of the key. As the recovery of such values might not always directly lead to full message recovery, the assessment of whether the resulting overall attack is more or less effective than our generic attacks has to be made on a per scheme basis. We exemplify this on the basis of two of the currently best-performing AES-based AEAD schemes: GCM [34] and OCB3 [45]. In both cases, the size of the crucial internal value and the block size of the cipher have to coincide and the latter value is fixed to 128 bits for AES (independently of key size).

AES-GCM We consider the following abstraction of GCM. The AEAD key k is used directly to create an instance E of the AES blockcipher. To encrypt a message m with respect to associated data d and nonce n, E is operated in counter mode, giving a pad $E(n+1) \mathrel {\Vert }E(n+2) \mathrel {\Vert }\ldots ,$ where a specific nonce encoding ensures there are no collisions between counter values of different encryption operations. The first part $c_1$ of the ciphertext $c=c_1c_2$ is obtained by XORing the pad into the message, and finally the authentication tag $c_2$ is derived by computing $c_2\leftarrow E(n)+H_h(d, c_1)$. Here, $H_h$ is an instance of a universal hash function H indexed (that is, keyed) with the 128-bit value $h=E(0^{128})$. Concretely, $H_h(d, c_1)= \sum _{i=1}^l v_i h^{l-i+1},$ where coefficients $v_1, \ldots , v_l$ are such that a prefix $v_1\ldots v_j$ is a length-padded copy of the associated data d, the middle part $v_{j+1}\ldots v_{l-1}$ is a length-padded copy of ciphertext component $c_1$, and the last item $v_l$ is an encoding of the lengths of d and $c_1$. The addition and multiplication operations deployed in this computation are those of a specific representation of the Galois field $\mathrm {GF}(2^{128})$.

In executing a practical ASA against AES-GCM, it might suffice to leak the value h (which has length 128-bits independently of the AES key length, and furthermore stays invariant across encryption operations). The insight is that if the key of a universal hash function is known, then it becomes trivial to compute collisions. Concretely, assume the adversary is provided with the AES-GCM encryption $c=c_1c_2=\mathsf {enc}(k,n,d,m)$ for unknown k, m but chosen d, n. Then by the above, we have $c_2=R+\sum _{i=1}^ jv_i h^{l-i+1}$ where the coefficients $v_1\ldots v_j$ are an encoding of d and R is some residue. If, having been successfully leaked by the ASA, the internal value h is known, by solving a linear equation, it is easy to find an associated data string $d'\ne d$, $|d'|=|d|$, such that for its encoding $v'_1\ldots v'_j$ we have $\sum _{i=1}^j v'_i h^{l-i+1}=\sum _{i=1}^j v_i h^{l-i+1}$. Overall this means that we have found $d'\ne d$ such that $\mathsf {enc}(k,n,d',m)=c=\mathsf {enc}(k,n,d,m)$. In a CCA attack, the adversary can thus query for the decryption of c with associated data $d'$ and nonce n, and thus fully recover the target message m. We finally note that this attack can be directly generalised to one where also the $c_1$ and $c_2$ components are modified, resulting in the decryption of a message $m'\ne m$ for which the XOR difference between m and $m'$ is controlled by the adversary.

OCB3 Multiple quite different versions of the OCB encryption scheme exist [42], but a common property is that the associated data input is incorporated via “ciphertext translation” [52]. To encrypt a message m under key k with associated data d and nonce n, in a first step, the message m is encrypted with a pure AE scheme¹¹ ) to an intermediate ciphertext $c^*\leftarrow \mathsf {enc}^*(k,n,m)$. Then to obtain the final ciphertext c, a pseudo-random function value $F_k(d)$ of the associated data string is XORed into the trailing bits of $c^*$. Concretely, in OCB3, we have $F_k(d)=\sum _{i=1}^lE(v_i+C_i)$ where all addition operations are XOR combinations of 128 bit values, $E(\cdot )$ stands for AES enciphering with key k, values $v_1,\ldots ,v_l$ represent a length-padded copy of associated data d, and coefficients $C_1,\ldots ,C_l$ are (secret) constants deterministically derived from the value $L=E(0^{128})$.

In the context of an ASA, we argue that it is sufficient to leak the 128 bit value L. The attack procedure is, roughly, as in the AES-GCM case. Assume the adversary is provided with the OCB3 encryption ${c=\mathsf {enc}(k,n,d,m)}$ for unknown k, m but chosen d, n, and assume the adversary knows L and thus $C_1,\ldots ,C_l$. Now let $1\le s<t\le l$ be any two indices, let $\Delta =C_s+C_t$ and let $d'\ne d$, $|d'|=|d|$, be the associated data string with encoding $v'_1,\ldots ,v'_l$ such that we have $v'_s=v_t+\Delta$ and $v'_t=v_s+\Delta$ and $v'_i=v_i$ for all $i\ne s,t$. Then, we have $E(v'_s+C_s)=E(v_t+\Delta +C_s)=E(v_t+C_t)$ and $E(v'_t+C_t)=E(v_s+\Delta +C_t)=E(v_s+C_s)$, which leads to $F_k(d)=F_k(d')$ and ultimately $\mathsf {enc}(k,n,d',m)=\mathsf {enc}(k,n,d,m)$. In a CCA attack environment, this can immediately be leveraged to the full recovery of m. As in the AES-GCM case, we note that many variants of our attack exist (against all versions of OCB), including some that manipulate message bits in a controlled way.

5 AEAD schemes

We recall standard notions of (deterministic) nonce-based AEAD, as per [52], and study how to adapt them to the ASA setting. Formally, a scheme ${\mathsf {AEAD}}$ providing authenticated encryption with associated data consists of algorithms ${\mathsf {AEAD}}.\mathsf {gen},{\mathsf {AEAD}}.\mathsf {enc},{\mathsf {AEAD}}.\mathsf {dec}$. The scheme has associated spaces $\mathcal {K},\mathcal {N},\mathcal {D},\mathcal {M},\mathcal {C}$. The key generation algorithm ${\mathsf {AEAD}}.\mathsf {gen}$ outputs a key ${k\in \mathcal {K}}$. The encryption algorithm ${\mathsf {AEAD}}.\mathsf {enc}$ takes key ${k\in \mathcal {K}}$, nonce $n\in \mathcal {N}$, associated data $d\in \mathcal {D}$ and message $m\in \mathcal {M}$, to produce ciphertext $c\in \mathcal {C}$. The decryption algorithm ${\mathsf {AEAD}}.\mathsf {dec}$ takes key $k$, nonce $n\in \mathcal {N}$, associated data $d\in \mathcal {D}$ and ciphertext $c\in \mathcal {C}$ to output either a message $m\in \mathcal {M}$ or the special symbol $\bot \notin \mathcal {M}$ to indicate rejection. A shortcut notation for this syntax is

$$\begin{aligned}\begin{array}{c} {\mathsf {AEAD}}.\mathsf {gen}\rightarrow \mathcal {K}, \;\; \mathcal {K}\times \mathcal {N}\times \mathcal {D}\times \mathcal {M}\rightarrow {\mathsf {AEAD}}.\mathsf {enc}\rightarrow \mathcal {C}\\ \text {and}\quad \mathcal {K}\times \mathcal {N}\times \mathcal {D}\times \mathcal {C}\rightarrow {\mathsf {AEAD}}.\mathsf {dec}\rightarrow \mathcal {M}\cup \{\bot \}\,. \end{array}\end{aligned}$$

Scheme ${\mathsf {AEAD}}$ is said to be $\delta$-correct if for $k\leftarrow _{\scriptscriptstyle \$}{{\mathsf {AEAD}}}.\mathsf {gen}$ and $c\leftarrow {{\mathsf {AEAD}}}.\mathsf {enc}(k,n,d,m)$ for some (n, d, m) and $m'\leftarrow {{\mathsf {AEAD}}}.\mathsf {dec}(k,n,d,c)$ the probability that $m'\ne m$ is upper-bounded by $\delta$, where the probability is over all coins involved.

5.1 IND-CCA

We formalise indistinguishability under chosen/ciphertext attack for an AEAD scheme via the game $\mathsf {IND-CCA}$ in Fig. 3 (left). For any adversary $\mathcal {A}$, we define the advantage

and say that scheme ${\mathsf {AEAD}}$ is indistinguishable against chosen-ciphertext attacks if $\mathsf {Adv}^{\mathsf {ind-cca}}_{{\mathsf {AEAD}}}(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

5.2 Authenticity

We formalise the authenticity of an AEAD scheme via the game $\mathsf {AUTH}$ in Fig. 4(left). For any adversary $\mathcal {A}$, we define the advantage

$$\begin{aligned} \mathsf {Adv}^{\mathsf {auth}}_{{\mathsf {AEAD}}}(\mathcal {A}){:=}\Pr [\mathsf {AUTH}(\mathcal {A})] \end{aligned}$$

and say that ${\mathsf {AEAD}}$ provides authenticity if $\mathsf {Adv}^{\mathsf {auth}}_{{\mathsf {AEAD}}}(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

Fig. 3

Games modelling indistinguishability under chosen-ciphertext attacks ($\mathsf {IND-CCA}$), and subverted indistinguishability under chosen-ciphertext attacks ($\mathsf {subIND- CCA}$) for an authenticated encryption scheme with associated data ${\mathsf {AEAD}}$

Fig. 4

Games modelling authenticity ($\mathsf {AUTH}$) and subverted authenticity ($\mathsf {subAUTH}$) of an authenticated encryption scheme with associated data ${\mathsf {AEAD}}$

5.3 Subverting AEAD

We note that AEAD satisfies the generic syntax introduced above in Sect. 4, with key generation algorithm $\Pi .\mathsf {gen}={\mathsf {AEAD}}.\mathsf {gen}$, sender algorithm $\Pi .\mathsf {S}={\mathsf {AEAD}}.\mathsf {enc}$ and receiver algorithm $\Pi .\mathsf {R}={\mathsf {AEAD}}.\mathsf {dec}$. We may thus apply the generic notions of subversion and undetectability introduced in Sect. 4.1. In Fig. 3(right) and Fig. 4(right), we specify the games $\mathsf {subIND- CCA}$ and $\mathsf {subAUTH}$ (respectively), modelling the adversary’s ability to compromise the expected security properties of a scheme $\Pi$ when that scheme has been subverted.

We note that for symmetric primitives, key generation is unlikely to be subverted in practice as symmetric keys are typically generated by some external means not connected with or influenced by the scheme itself—e.g. through key agreement protocols, or by a trusted platform module. Nevertheless, we retain a syntax that allows for the more general case.

6 Message authentication schemes

Cryptographic message authentication is typically realised with a message authentication code (MAC). Given a key k and a message m, a tag t is deterministically derived as per $t\leftarrow \mathsf {tag}(k,m)$. The (textbook) method to verify the authenticity of m given t is to recompute $t'\leftarrow \mathsf {tag}(k,m)$ and to consider m authentic iff $t'=t$. If this final tag comparison is implemented carelessly, a security issue might emerge: A natural yet naive way to perform the comparison is to check the tag bytes individually in left-to-right order until either a mismatch is spotted or the right-most bytes have successfully been found to match. Note that, if tags are not matching, such an implementation might easily give away, as timing side-channel information, the length of the matching prefix, allowing for practical forgery attacks via step-wise guessing.

Fig. 5

Left: Games modelling the unforgeability ($\mathrm {UF}$) and subverted unforgeability ($\mathrm {subUF}$) of a message authentication scheme. Right: Games modelling indistinguishability under chosen-ciphertext attacks ($\mathsf {IND-CCA}$), and subverted indistinguishability under chosen-ciphertext attacks ($\mathsf {subIND- CCA}$) for a public key encryption scheme $\mathsf {PKE}$

This issue is understood by the authors of major cryptographic libraries, which thus contain carefully designed constant-time string comparison code. A consequence is that services for tag generation and verification are routinely split into two separate functions $\mathsf {tag}$ and $\mathsf {vfy}$.¹² Our notion of a message authentication scheme follows this approach. It comprises MAC-based authentication as a special case, but it also comprises the more exotic randomised MACs as considered in [1].

Formally, a scheme $\mathsf {MAC}$ providing message authentication consists of algorithms $\mathsf {MAC}.\mathsf {gen},\mathsf {MAC}.\mathsf {tag},\mathsf {MAC}.\mathsf {vfy}$ and associated spaces $\mathcal {K},\mathcal {M},\mathcal {T}$. The key generation algorithm $\mathsf {MAC}.\mathsf {gen}$ outputs a key $k\in \mathcal {K}$. The tagging algorithm $\mathsf {MAC}.\mathsf {tag}$ takes a key $k\in \mathcal {K}$ and a message $m\in \mathcal {M}$, and returns a message, tag pair $(m,t)\in \mathcal {M}\times \mathcal {T}$. The verification algorithm $\mathsf {MAC}.\mathsf {vfy}$ takes a key $k\in \mathcal {K}$, a message $m\in \mathcal {M}$, and a tag $t\in \mathcal {T}$, and returns either the message m (indicating that the tag is accepted) or the special symbol $\bot$ to indicate rejection.¹³ A shortcut notation for this syntax is

$$\begin{aligned} \mathsf {MAC}.\mathsf {gen}\rightarrow \mathcal {K}\quad \text {and}\quad \mathcal {K}\times \mathcal {M}\rightarrow \mathsf {MAC}.\mathsf {tag}\rightarrow \mathcal {M}\times \mathcal {T}\\ \text {and}\quad \mathcal {K}\times \mathcal {M}\times \mathcal {T}\rightarrow \mathsf {MAC}.\mathsf {vfy}\rightarrow \mathcal {M}\cup \{\bot \}\,. \end{aligned}$$

We formalise the (strong) unforgeability of a message authentication scheme via the game $\mathrm {UF}$ in Fig. 5(left, first column). For any adversary $\mathcal {A}$ we define the advantage $\mathsf {Adv}^{\mathrm {uf}}_{\mathsf {MAC}}(\mathcal {A}){:=}\Pr [\mathrm {UF}(\mathcal {A})]$ and say that the scheme $\mathsf {MAC}$ is (strongly) unforgeable if $\mathsf {Adv}^{\mathrm {uf}}_{\mathsf {MAC}}(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

6.1 Subverting MACs

We note that MACs satisfy the generic syntax introduced above in Sect. 4, with key generation algorithm $\Pi .\mathsf {gen}=\mathsf {MAC}.\mathsf {gen}$, sender algorithm $\Pi .\mathsf {S}=\mathsf {MAC}.\mathsf {tag}$, receiver algorithm $\Pi .\mathsf {R}=\mathsf {MAC}.\mathsf {vfy}$. We may thus apply the generic notions of subversion introduced in Sect. 4.1. We obtain the notion of subverted unforgeability $\mathrm {subUF}$, as in Fig. 5(left, second column).

6.1.1 Discussion

We note that for symmetric primitives, key generation is unlikely to be subverted (see the discussion at Sect. 5.3), leaving us with the possibility that either the tagging or the verification algorithm (or both) could be subverted. However, as tagging and verification are typically performed by distinct, remote parties, successfully conducting such attacks would require replacing implementations of two participants, which we think is considerably less feasible than replacing only one implementation.

7 Public key encryption schemes

In this section, we consider ASAs against PKE schemes. A treatment of key encapsulation mechanisms (KEMs) is given in Appendix 1.

A PKE scheme $\mathsf {PKE}= (\mathsf {PKE}.\mathsf {gen},\mathsf {PKE}.\mathsf {enc},\mathsf {PKE}.\mathsf {dec})$ consists of a triple of algorithms together with key spaces $\mathcal {K}_\mathsf {S},\mathcal {K}_\mathsf {R}$, a message space $\mathcal {M}$ and a ciphertext space $\mathcal {C}$. The key-generation algorithm $\mathsf {PKE}.\mathsf {gen}$ returns a pair $( pk , sk )\in \mathcal {K}_\mathsf {S}\times \mathcal {K}_\mathsf {R}$ consisting of a public key and a private key. The encryption algorithm $\mathsf {PKE}.\mathsf {enc}$ takes a public key $pk$ and a message $m\in \mathcal {M}$ to produce a ciphertext $c\in \mathcal {C}$. Finally, the decryption algorithm $\mathsf {PKE}.\mathsf {dec}$ takes a private key $sk$ and a ciphertext $c\in \mathcal {C}$, and outputs either a message $m\in \mathcal {M}$ or the special symbol $\bot \notin \mathcal {M}$ to indicate rejection. The correctness requirement is that for $( pk , sk )\leftarrow _{\scriptscriptstyle \$}\mathsf {gen}$ and $m \in \mathcal {M}$ and $c\leftarrow \mathsf {PKE}.\mathsf {enc}( pk ,m)$ and $m' \leftarrow \mathsf {PKE}.\mathsf {dec}( sk ,c)$, the probability that $m'\ne m$ is upper-bounded by $\delta$, where the probability is over all coins involved.

We formalise the indistinguishability under chosen/ ciphertext attack of a PKE scheme via the game $\mathsf {IND-CCA}$ in Fig. 5(right, first column). For any adversary $\mathcal {A}$, we define the advantage

$$\begin{aligned}&\mathsf {Adv}^{\mathsf {ind-cca}}_{\mathsf {PKE}}(\mathcal {A}){:=} \end{aligned}$$

and say that scheme $\mathsf {PKE}$ is indistinguishable against chosen-ciphertext attacks if $\mathsf {Adv}^{\mathsf {ind-cca}}_{\mathsf {PKE}}(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

7.1 Subverting PKE schemes

We note that PKE schemes satisfy the generic syntax introduced above in Sect. 4, with the key generation algorithm $\Pi .\mathsf {gen}=\mathsf {PKE}.\mathsf {gen}$, sender algorithm $\Pi .\mathsf {S}=\mathsf {PKE}.\mathsf {enc}$, and receiver algorithm $\Pi .\mathsf {R}=\mathsf {PKE}.\mathsf {dec}$. We may thus apply the generic notions of subversion introduced in Sect. 4.1. See Fig. 5(right, second column) for the game $\mathsf {subIND- CCA}$, modelling the adversary’s ability to compromise $\mathsf {IND-CCA}$ when interacting with a subverted scheme.

7.1.1 Discussion

For PKE schemes, subverting the encryption algorithm is less interesting, as the sender has no secret information to leak. It would be possible to consider the subversion of encryption with the view of compromising confidentiality of ciphertexts, but we are targeting the stronger notion of key recovery (which will lead to a full compromise of the confidentiality of all ciphertexts). For PKE schemes, in contrast to symmetric encryption, subverting the key generation algorithm is a meaningful option, and we explain in Sect. 4.3 how subversion attacks can be amplified when applied together with a subverted key generation algorithm.

8 Concrete subversion attacks via acceptance versus rejection

We assume that the objective of a subverted receiver algorithm is to leak a bit string $k_\ell \in \{0,1\}^\lambda$ representing either some leakage that will enable recovery of the secret (private) key $k_\mathsf {R}$, following the discussion at Sects. 4.2.1 and 4.3, or else a string that is sufficient to break security in the sense of Sect. 4.4. We refer to $k_\ell$ as the leakage key in what follows. At worst, from the subverter’s perspective, the leakage key will simply be a bit string representation of $k_\mathsf {R}$.

We propose two key-recovering subversion attacks against a scheme $\Pi =(\Pi .\mathsf {gen},\Pi .\mathsf {S},\Pi .\mathsf {R})$ satisfying the syntax given in Sect. 4. While both attacks subvert the receiver algorithm only, they differ in that our first attack is passive (can be mounted by a mass surveillance adversary who eavesdrops), and our second attack is active (requires intercepting and modifying sender outputs in transmission—i.e. ciphertexts, in the case of AEAD or PKE, or message-tag pairs in the MAC case). The driving principles behind the two attacks are closely related: In both cases, the receiver algorithm of the attacked scheme is manipulated such that it marginally deviates from the regular accept/reject behaviour; by making these deviations depend on the leakage key, the bits of the latter are leaked one by one.

Our passive attack rejects a sparse subset of the receiver inputs that the unmodified algorithm would accept. Our active attack does the opposite by accepting certain receiver inputs that the unmodified algorithm would reject. A property of the former (passive) attack is that the scheme’s probability of incorrect decryption is increased by a small amount (rendering it detectable with the same probability); we believe however that in settings where rejected messages are automatically retransmitted by the sender (for example, in low-level network encryption like IPSec), this attack is still practical and impactful. Our active attack does not influence correctness. However, as key bits are leaked only when the receiver algorithm is exposed to bogus inputs, successful adversaries are necessarily active. The active attack furthermore has the following attractive property: The underlying receiver outputs (i.e. messages) corresponding to the injected inauthentic receiver inputs are not arbitrary (and thus unexpected to the processing application), but identical with sender inputs previously sent by the sender algorithm. This allows attacks to be kept “under the radar”: the receiver will not realise that an attack has been mounted, as all accepted messages it receives will be those sent by the sender.

We note that both of our subversions are stateless, which not only allows for much easier backdoor implementation from a technical perspective but also should decrease the likelihood that an implemented attack is detected through code review or observing memory usage. That said, our passive attack also has a stateful variant with an interesting additional practicality feature. We discuss this further below. We note that our subversion approach, for leaking at most one bit per operation, remains on the conservative side. Depending on the circumstances, in practice, more aggressive methods that leak more than one bit per operation, are expected to be easily derived from our subversion proposals.

8.1 Combinatorics: coupon collection

The passive and active attacks both exfiltrate secret key material one bit at a time. The following lemma recalls a standard coupon collector statement that will help analysing the efficiency of this approach, in particular how long it takes until all bits are extracted. For a proof of the lemma, see e.g. [43, §8.4].

Lemma 1

Fix a finite set S (of “coupons”) and a probability $0<\eta \le 1$. Experiment $\mathrm {CC}(S,\eta )$ in Fig. 6 measures the number of iterations it takes to visit all elements of S (“collect all coupons”) when picked uniformly at random and considered with probability $\eta$. The expected number of iterations is given by $O(n \log n)$, where $n = |S|$. More precisely, we have

$$\begin{aligned} \mathbb {E}[\mathrm {CC}(S,\eta )] =\frac{|S|}{\eta }\left( \frac{1}{1} + \frac{1}{2} + \cdots +\frac{1}{|S|}\right) = O(n \log n). \end{aligned}$$

Note that parameter $\eta$ is fully absorbed by the $O(\cdot )$ notation.

Fig. 6

Coupon collector experiment (see Lemma 1). Recall that $B(\eta )$ denotes a Bernoulli trial with success probability $\eta$ (see Sect. 3)

8.2 Passive attack

We first give an intuition of our passive attack. Our attack subverts the receiver algorithm so that an adversary who observes decryption error events in a “normal” run of communication between sender and receiver is able to learn bits of the leakage key. The subverted receiver monitors incoming ciphertexts. It applies a hash function to each of them to obtain a pointer to a bit of the leakage key. It then, with a configurable probability, artificially rejects the ciphertext if the indicated bit of the leakage key does not match some hard-coded reference value. The adversary is able to apply the same hash function to the ciphertext and thus learns whether the bit position deviates from the reference value. By bit-wise learning the difference between the leakage key and the reference value, eventually the adversary can put the complete leakage key together.

In the remaining part of this section, we describe the specification of our subversion and $\mathrm {KRP}$ adversary in detail, and analyse their effectiveness.

8.2.1 Description of our passive attack

We define our passive subversion of the receiver algorithm $\Pi .\mathsf {R}$ of a scheme $\Pi$ in Fig. 7(left). It is parameterised by a probability $0\le \gamma \le 1$, a large index space $\mathcal {I}_\mathsf {R}$, a PRF $(F_i)_{i\in \mathcal {I}_\mathsf {R}}$, and a family $(G_i)_{i\in \mathcal {I}_\mathsf {R}}$ of random constants. For the PRF we require that it be a family of functions $F_i:\mathcal {Y}\rightarrow [{0}\,..\,{\lambda -1}]$ (that is: a pseudo-random mapping from the ciphertext space to the set of bit positions of a leakage key $k_\ell$), and for the constants we require that $G_i\in \{0,1\}^\lambda$ (that is: a random element of the set of leakage keys $\{0,1\}^\lambda$). (That we use the same index space $\mathcal {I}_\mathsf {R}$ for two separate primitives is purely for notational convenience; our analyses will actually assume that $(F_i)$ and $(G_i)$ are independent.¹⁴ )

Fig. 7

Passive subversion of receiver algorithm $\Pi .\mathsf {R}$ of a scheme $\Pi$. As in Fig. 6, $B(\cdot )$ denotes a Bernoulli trial. We let $\mathop {\texttt {!}}b:=1-b$ denote the inversion of a bit value $b\in \{0,1\}$. Left: Decryption subversion as in Sect. 4.1. Line 07 is redundant if the attack is stateless; in a stateful attack this line is meaningful—see the discussion below. Right: Key recovering adversary for game $\mathrm {KRP}$ as in Sect. 4.2

We provide details on our attack. The idea is that $k_\ell '$ (line 00), which is shared by the subverted algorithm and the key recovering adversary through knowledge of $G_i$, represents an initial reference key¹⁵; the key recovery adversary, throughout the attack, learns the bits that differ between $k_\ell$ and $k_\ell '$. This means that the subversion only needs to leak (on average) half as many bits compared to leaking the whole of $k_\ell$. The Bernoulli trial (line 03) controls the rate with which such differing bits are exfiltrated, and the PRF (line 04) controls which bit position $\iota$ is affected in each iteration. By PRF security, these bit positions can be assumed uniformly distributed (though knowledge of the subversion index i allows tracing which ciphertext is mapped to which position). Any bit difference is communicated to the adversary by artificially rejecting (line 06) the ciphertext, although it is actually valid.

We specify a corresponding $\mathrm {KRP}$ adversary in Fig. 7 (right). It starts with the same random string $G_i$ as the subversion and traces the bit updates of $\Pi .\mathsf {R}_i$ until eventually the full key $k_\ell$ is reconstructed. We assume that $\mathcal {A}$ can tell whether the full leakage key $k_\ell$ has been recovered (line 10), e.g. by recovering the secret key $k_\mathsf {R}$ from $k_\ell$ and verifying one or more recorded authentic outputs with it.

Note that our adversary $\mathcal {A}$ does not need to know the sender inputs (equivalently, receiver outputs) $x\in \mathcal {X}$, which typically represent plaintext messages in the settings we consider, emerging throughout the experiment: The core of the attack, in lines 13 to 16, is independent of the value of $x$. This considerably adds to the practicality of our attack: While messages are not always secret information, in practice they might be hard to obtain. Conducting mass-surveillance attacks is certainly easier if the attacks depend exclusively on the knowledge of ciphertexts (like in our case, line 15).

While we present our subversion as stateless (i.e. the reference key is kept static between invocations), it also works if the $\Pi .\mathsf {R}_{i}$ algorithm maintains state between any two invocations and remembers which differing bit positions have already been communicated. Activate line 07, and execute line 00 only during the first invocation, to obtain the stateful attack. With respect to the detectability and key recovery notions from Sect. 4, the attack’s performance is the same whether the subversion is stateful or not. The stateful version offers better correctness after a subversion is detected, in the sense that the algorithm will only behave unexpectedly at most $|k_\ell |=\lambda$ occasions; once the leakage key $k_\ell$ has been exfiltrated, the subverted scheme $\Pi .\mathsf {R}_{i}$ behaves identically to the honest scheme $\Pi .\mathsf {R}$. (This case is practically less relevant and not covered by our formal models.)

We establish the following statements about the key recoverability and undetectability of our passive subversion attack.

Theorem 1

For a $\delta$-correct scheme $\Pi$, let $\Pi .\mathsf {R}_i$ be defined as in Fig. 7(left) and $\mathcal {A}$ as defined in Fig. 7(right). If $F_i$ behaves like a random function and constants $G_i$ are uniformly distributed, then for any message sampler $\mathrm {MS}$, the key recovery advantage $\mathsf {Adv}^{\mathrm {krp}}_{\mathrm {MS}}(\mathcal {A})$ is expected to reach value 1 once the receive algorithm was invoked on $O(\lambda \log \lambda )$ different inputs.

Proof

We model algorithm $\mathcal {A}(i)$ by experiment $\mathrm {CC}(S,\eta )$ from Fig. 6, with $S = [{0}\,..\,{\lambda -1}]$ and $\eta =1-(\delta -1)(\gamma /2-1)$. The (pseudo-)randomness of $F_i$ ensures that elements of $s\in S$, here representing the possible values of the index $\iota$ (line 04), are picked uniformly at random. The probability $\eta =1-(\delta -1)(\gamma /2-1)=\delta +(1-\delta )(\gamma /2)$ arises through success of the $\mathrm {CC}$ experiment being equivalent to the $\Pi .\mathsf {R}_i$ outputting $x=\bot$. This occurs either:

• Through an early exit with $\bot =\Pi .\mathsf {R}(k_\mathsf {R},y)$ at line 02, which has probability $\delta$.

• Else, continuing to line 03 with $\bot \ne \Pi .\mathsf {R}(k_\mathsf {R},y)$ and triggering both line 03 (with probability $\gamma$) and line 05 (with probability 1/2, as $\Pr \left[ k_\ell '[\iota ]\ne k_\ell [\iota ]\right]$ for $\iota \leftarrow F_i(t)$ is 1/2).

Applying Lemma 1 gives the expected number of messages to be sent as $O(\lambda \log \lambda )$. $\square$

Theorem 2

Let $\mathcal {A}$ be an adversary playing the $\mathrm {UDR}$ game (as in Fig. 1 right), such that $\mathcal {A}$ makes at most q queries to the receiver oracle $\mathrm {Recv}$. The undetectability advantage of the subversion $\Pi .\mathsf {R}_i$, as defined in Fig. 7(left), is bounded by

$$\begin{aligned} \mathsf {Adv}^{\mathrm {UDR}}_{\Pi }(\mathcal {A})\le 1-(1-\gamma )^q. \end{aligned}$$

Proof

Any adversary playing the $\mathrm {UDR}$ game against the subverted $\Pi .\mathsf {R}_i$ must, in order to win, trigger $x=\bot$ with a valid sender output (receiver input) $y$. More precisely, the adversary $\mathcal {A}$ must find $y$ such that $\Pi .\mathsf {R}(k_\mathsf {R},y)\ne \bot$ but $\Pi .\mathsf {R}_i(k_\mathsf {R},y)=\bot$. Figure 8(left) shows the (obviously) best adversarial strategy. Even if the adversary can submit $y$ such that $\iota \leftarrow F_i(y)$ would be assigned in line 04 (Fig. 7), this is contingent on $B(\gamma )$ succeeding in line 03; thus $\Pr [x=\bot ]\le \gamma$ in line 05 (Fig. 8). Clearly, detection adversary $\mathcal {A}$ (Fig. 8left) always returns 1 when interacting with the unsubverted receiver algorithm, as always $x\ne \bot$. Thus,

$$\begin{aligned} \mathsf {Adv}^{\mathrm {UDR}}_{\Pi }(\mathcal {A}) = \left|\Pr [\mathrm {UDR}^1(\mathcal {A})]-\Pr [\mathrm {UDR}^0(\mathcal {A})]\right|\\ \le 1-(1-\gamma )^q. \end{aligned}$$

$\square$

Fig. 8

Detection adversaries for Game $\mathrm {UDR}$ as in Fig. 1. Left: For the passive attack from Fig. 7. Right: For the active attack from Fig. 9

8.3 Active attack

In this section, we describe our second subversion attack. In contrast to the previous attack, key recovery requires an active adversary, i.e. one who injects crafted ciphertexts into the regular transmission stream. Our ASA has the desirable property (from the point of view of the subverter) that correctness is maintained.

We give an overview of our attack for the case of AEAD. (The generalisation to MAC and PKE is immediate; for the generic version following our abstract syntax see Fig. 9.) A prerequisite of the attack is a keyed random permutation $P_i$ of the AEAD ciphertext space. The key is known exclusively to the subversion adversary. The AEAD encryption algorithm $\mathsf {S}$ remains unmodified. For honestly generated ciphertexts, the (subverted) algorithm $\mathsf {R}_i$ implements the unmodified AEAD decryption routine $\mathsf {R}$. This ensures correctness.

Fig. 9

Active subversion of the receiver algorithm $\Pi .\mathsf {R}$ of a ciphertext $\varepsilon$-sparse scheme $\Pi$ (see the discussion at Sect. 8.3). Left: Decryption subversion as in Sect. 4.1. Right: Key recovering adversary for game $\mathrm {KRA}$ as in Sect. 4.2. The adversary needs to have no influence over messages (modelled by $\alpha$; see the discussion at Sect. 4.2). As before, we let $\mathop {\texttt {!}}$ denote the inversion of a bit value

To start a key recovery attack, the subversion adversary waits for an honest ciphertext c and replaces it with $P_i(c)$. That is, the adversary suppresses the delivery of c and instead injects a “randomised same-length version” of the ciphertext. By the authenticity property of the AEAD scheme, the unmodified $\mathsf {R}$ algorithm would reject this ciphertext. This is where the (subverted) $\mathsf {R}_i$ deviates from $\mathsf {R}$: If any incoming ciphertext is deemed invalid upon decryption with $\mathsf {R}$, with the expectation that this could be the case due to a $\mathrm {KRA}$ attack being in operation, $\mathsf {R}_i$ applies $P^{-1}_i$ to c and tries to decrypt the result (with $\mathsf {R}$). If $\mathsf {R}$ rejects, $\mathsf {R}_i$ rejects also (interpretation: c was simply a random ciphertext, not injected by the $\mathrm {KRA}$ adversary). If however $\mathsf {R}$ accepts, then $\mathsf {R}_i$ concludes that a $\mathrm {KRA}$ attack is in operation, and that it ($\mathsf {R}_i$) is supposed to leak key material.¹⁶ Observing that $\mathsf {R}_i$ just recovered the originally encrypted message m, we let $\mathsf {R}_i$ either deliver that message, or we let it return $\bot$, i.e. indicate decryption failure. That way, if a message is delivered by $\mathsf {R}_i$, it is always correct. As in Sect. 8.2, we modulate key bits into the decision of delivering vs rejecting.

The above should make clear how the attack works. Details, and the generic version, are in Sect. 8.3.2. We note that a technical prerequisite of the attack is that for valid ciphertexts c, $P_i(c)$ should not also be a valid ciphertext. As P is a random permutation, the standard $\mathsf {AUTH}$ and $\mathrm {UF}$ properties of AEAD and MAC ensure this. However, the situation is different for PKE where it is easy to define schemes that accept every ciphertext input, e.g. by outputting a valid but dummy message. We resolve this technicality by requiring the mild assumption of ciphertext sparseness: We say that a PKE scheme has a sparse ciphertext space if the decryption algorithm makes an internal decision about the validity of an incoming ciphertext, with the property that uniformly picked ciphertexts are deemed invalid with overwhelmin probability.

We studied a range of practically relevant PKE schemes and observe that all of them satisfy the ciphertext sparseness demand. For reference, we provide corresponding details for OAEP and Cramer–Shoup encryption in Appendix 1. We further observe that the general classes of plaintext-aware schemes [13] (see also Appendix 1) and of schemes with publicly verifiable ciphertexts [49] have this property as well. We confirm also for all four of the NIST post-quantum cryptography round 3 finalists¹⁷, that are specifically designed to mask decryption failures by accepting every ciphertext and outputting a random value rather than the rejection symbol, that they provide ciphertext sparseness: The mechanics of the decryption/decapsulation algorithms are such that first an internal yet explicit ciphertext validity decision is made and then either the correct or an independent, randomised value is output. Our subversions can easily adapt to such specifications and be directly based on the outcome of the validity check.

Lastly, we note that for the active attack there is no advantage to the subverted receiver keeping state. This is because the subverted receiver reveals key bits only when explicitly queried by the adversary—thus, the adversary is able to maintain all necessary state. Note this is in contrast to our passive attack where the adversary observes the receiver but does not interact with it, and ultimately thus the attack could benefit mildly from the subversion $\mathsf {R}_i$ keeping state.

In the remaining part of this section, we define ciphertext sparseness, describe the specification of our subversion and $\mathrm {KRA}$ adversary, and analyse their effectiveness.

8.3.1 Ciphertext sparseness

We define ciphertext sparseness for a scheme $\Pi$ as follows: We say that $\Pi =(\Pi .\mathsf {gen},\Pi .\mathsf {S},\Pi .\mathsf {R})$ is ciphertext $\varepsilon$-sparse if $\Pr \left[ \mathsf {R}(y)\ne \bot \right] \le \varepsilon$ for $y\leftarrow _{\scriptscriptstyle \$}\mathcal {Y}$. If $\epsilon$ is negligibly small, we refer to the scheme as being ciphertext sparse. For AEAD and MAC schemes, ciphertext sparseness is a corollary of the unforgeability (authenticity) properties. In particular, an AEAD scheme that has ${\mathsf {Adv}^{\mathsf {auth}}_{{\mathsf {AEAD}}}(\mathcal {A})\le \varepsilon }$ is ciphertext $\varepsilon$-sparse, as if $\Pr \left[ \mathsf {R}(y)\ne \bot \right] >\varepsilon$ for $y\leftarrow _{\scriptscriptstyle \$}\mathcal {Y}$, then an adversary who simply chooses an element of $\mathcal {Y}$ uniformly at random would win the $\mathsf {AUTH}$ game with probability greater than $\varepsilon$. Similarly, a MAC scheme with $\mathsf {Adv}^{\mathrm {uf}}_{\mathsf {MAC}}(\mathcal {A})\le \varepsilon$ is ciphertext $\varepsilon$-sparse. As discussed above, ciphertext sparseness is a reasonable assumption also for many practical PKE schemes.

8.3.2 Description of our active attack

We define our active subversion of the receiver algorithm of ciphertext-sparse scheme $\Pi$ in Fig. 9(left). It is parameterised by a large index space $\mathcal {I}_\mathsf {R}$, a PRF $(F_i)_{i\in \mathcal {I}_\mathsf {R}}$, a PRP $(P_i)_{i\in \mathcal {I}_\mathsf {R}}$, and a family $(G_i)_{i\in \mathcal {I}_\mathsf {R}}$ of random constants. (As in Sect. 8.2, our analyses will assume that $(F_i)$ and $(P_i)$ and $(G_i)$ are independent.) For the PRF, we require that it be a family of functions $F_i:\mathcal {Y}\rightarrow [{0}\,..\,{\lambda -1}]$ (that is: a pseudo-random mapping from the output space to the set of bit positions of a leakage key $k_\ell \in \{0,1\}^\lambda$), for the PRP, we require that it be a family of length-preserving permutations $P_i:\mathcal {Y}\rightarrow \mathcal {Y}$ (that is: a pseudo-random bijection on the sender output space), and for the constants, we require that $G_i\in \{0,1\}^\lambda$ (that is: a random element of the set of leakage keys).

The idea of our attack is as follows. Lines 01–03 of $\Pi .\mathsf {R}_i$ ensure that authentic receiver inputs are always accepted (no limitation on correctness). If however a receiver input (sender output) $y$ is identified as not valid, i.e. is unauthentic, then a secret further check is performed: The original value $y$ is mapped to an unrelated value $y'$ using the random permutation (line 04), and the result $y'$ is checked for validity (line 05). For standard (invalid) sender outputs $y$ this second validity check should also fail, and in this case, algorithm $\Pi .\mathsf {R}_i$ rejects as expected (lines 06 and 07). The normally not attainable case that the second validity check succeeds is used to leak key bits. The mechanism for this (lines 08–11) is as in our passive attack from Sect. 8.2, namely by communicating via accept/reject decisions the positions where the bits of a hard-coded random reference value $k_\ell '$ and the to-be-leaked key $k_\ell$ differ.

The corresponding key recovery adversary crafts these required bogus receiver inputs by obtaining a valid sender output¹⁸ $y$ (line 15) and modifies it in line 16. The information thus leaked by the validity checking routine is used to reconstruct target leakage key $k_\ell$ in the obvious way (lines 19 to 21). We establish the following statements about the key recoverability and undetectability of our active subversion attack.

Theorem 3

For an $\varepsilon$-sparse scheme $\Pi$, let $\Pi .\mathsf {R}_i$ be defined as in Fig. 9(left) and $\mathcal {A}$ as in Fig. 9(right). If $F_i$ and $P_i$ behave like random functions, and constants $G_i$ are uniformly distributed, then for any message sampler $\mathrm {MS}$, the key recovery advantage $\mathsf {Adv}^{\mathrm {kra}}_{\mathrm {MS}}(\mathcal {A})$ is expected to reach value 1 once the receive algorithm was invoked on $O(\lambda \log \lambda )$ different inputs.

Proof

By the ciphertext $\varepsilon$-sparseness of the scheme $\Pi$, each invocation of algorithm $\Pi .\mathsf {R}_i$ in an execution of attack $\mathcal {A}(i)$ has $x\ne \bot$ in line 02 (Fig. 9) with probability $\varepsilon$ and thus line 04 is reached with probability $1-\varepsilon$. We model algorithm $\mathcal {A}(i)$ by the experiment $\mathrm {CC}(S,\eta )$ from Fig. 6, with $S = [{0}\,..\,{\lambda -1}]$ and $\eta = (1-\varepsilon )/2$. The (pseudo-)randomness of $F_i$ ensures that elements of $s\in S$, here representing the possible values of the index $\iota$ (line 20), are picked uniformly at random. The probability 1/2 arises through success of the $\mathrm {CC}$ experiment being equivalent to the condition $x\ne \bot$ in line 19. This occurs precisely when $\Pi .\mathsf {R}_i$ returns ${x'\ne \bot }$ in line 10, which is conditional on $\Pi .\mathsf {R}_i$ reaching past line 07. The probability that $x\ne \bot$ in line 19 is 1/2 as this is the probability that for any sender output $y'$ and $\iota \leftarrow F_i(y')$, $k_\ell [\iota ]\ne G_i[\iota ]$ (line 09). We now apply Lemma 1, which gives us that the expected number of messages to be sent is $O(\lambda \log \lambda )$. $\square$

Theorem 4

Let $\mathcal {A}$ be an adversary playing the $\mathrm {UDR}$ game (as in Fig. 1right), such that $\mathcal {A}$ makes at most q queries to the verification oracle $\mathrm {Recv}$. If $P_i$ behaves like a random function, and the scheme $\Pi$ is ciphertext $\varepsilon$-sparse, then the undetectability advantage of the subversion $\Pi .\mathsf {R}_i$, as defined in Fig. 9(left), is given by $\mathsf {Adv}^{\mathrm {udr}}_{\Pi }(\mathcal {A})\le 1-\left( 1- \varepsilon \right) ^q$.

Proof

Any detection adversary $\mathcal {A}$ playing the $\mathrm {UDR}$ game against the subverted $\Pi .\mathsf {R}_i$ must, in order to win, triggers $\Pi .\mathsf {R}_i(y)\ne \bot$ with a bogus $y$. That is, a sender output $y$ with $\Pi .\mathsf {R}(k_\mathsf {R},y)=\bot$ but $\Pi .\mathsf {R}_i(k_\mathsf {R},y)\ne \bot$. This will occur if $y= P_i(y')$, where $\Pi .\mathsf {R}(k_\mathsf {R},y')\ne \bot$. As i is chosen uniformly randomly from $\mathcal {I}_\mathsf {R}$ and P is a (pseudo-)random function, the optimal strategy is to sample values of $y'$ and test whether ${\mathrm {Recv}(k_\mathsf {R},y')\ne \bot }$. Algorithm $\mathcal {A}$ in Fig. 8(right) shows this strategy. When $\mathcal {A}$ interacts with the unsubverted receiver algorithm, we have that $\Pr [\mathrm {UDR}^1(\mathcal {A})]=1$ by construction. When interacting with the subverted receiver algorithm, $\mathcal {A}$ returns $x\ne \bot$ by either triggering line 02 or line 10 of $\Pi .\mathsf {R}_i$. By the ciphertext sparseness of the scheme, line 02 is triggered with probability $1-\varepsilon$. Triggering line 10 happens with probability $\le \varepsilon$. Thus, we have

$$\begin{aligned} \mathsf {Adv}^{\mathrm {UDR}}_{\Pi }(\mathcal {A}) = \left|\Pr [\mathrm {UDR}^1(\mathcal {A})] - \Pr [\mathrm {UDR}^0(\mathcal {A})]\right|\\ \le 1-\left( 1-\varepsilon \right) ^q. \end{aligned}$$

$\square$

9 Conclusion

Our work examines subversion attacks against the receiving party, a class of ASA that was missed by previous work. We give an abstract framework and show that ASAs targeting receivers apply equally to any primitive meeting the syntax—namely AEAD, MAC and PKE schemes. The internal details of our attacks (described in Sects. 8.3.2 and 8.2.1) are such that we require a PRF $(F_i)_{i\in \mathcal {I}_\mathsf {R}}$ to uniformly hash ciphertexts to bit positions. In the AEAD setting, this requirement can be dropped where the AEAD scheme meets the widespread design goal of IND$ security [52], i.e. ciphertexts indistinguishable from random bits. Combined with the fact that symmetric keys are typically 256 bits, the first 8 bits of the (uniformly distributed) ciphertexts are sufficient to point to the bit position. This allows for a reduced footprint (and thus significantly adds to the practicability of the attack for an adversary).

Appendices

A key and data encapsulation mechanisms

1.1 A.1 Key encapsulation mechanisms

For completeness, we give the corresponding definitions of subversion attacks against key encapsulation mechanisms, together with notions of undetectability and key recovery.

1.1.1 A.1.1 KEM definition

A KEM scheme $\mathsf {KEM}=(\mathsf {KEM}.\mathsf {gen},\mathsf {KEM}.\mathsf {enc},\mathsf {KEM}.\mathsf {dec})$ for a finite session key space $\mathcal {K}$ is a triple of algorithms together with a key space $\mathcal {K}_\mathsf {S}\times \mathcal {K}_\mathsf {R}$ and ciphertext space $\mathcal {C}$. The key generation algorithm $\mathsf {KEM}.\mathsf {gen}$ returns a pair $( pk , sk )\in \mathcal {K}_\mathsf {S}\times \mathcal {K}_\mathsf {R}$ consisting of a public key and a secret key. The encapsulation algorithm $\mathsf {KEM}.\mathsf {enc}$ takes a public key $pk$ to produce a session key $k\in \mathcal {K}$ and a ciphertext $c\in \mathcal {C}$. Finally, the decapsulation algorithm $\mathsf {KEM}.\mathsf {dec}$ takes a secret key $sk$ and a ciphertext $c\in \mathcal {C}$, and outputs either a session key $K\in \mathcal {K}$ or the special symbol $\bot \notin \mathcal {K}$ to indicate rejection. The correctness requirement is that for all $( pk , sk )\in \mathcal {K}_\mathsf {S}\times \mathcal {K}_\mathsf {R}$, we have $\Pr \left[ \mathsf {KEM}.\mathsf {dec}( sk ,c)\ne k \right] \le \delta$ for $(k,c)\leftarrow \mathsf {KEM}.\mathsf {enc}( pk )$.

Fig. 10

Games modelling indistinguishability under chosen-ciphertext attacks ($\mathsf {IND-CCA}$), and subverted indistinguishability under chosen-ciphertext attacks ($\mathsf {subIND- CCA}$) for a key encapsulation mechanism $\mathsf {KEM}$

1.1.2 A.1.2 IND-CCA

For a key encapsulation mechanism, we formalise the indistinguishability under chosen-ciphertext attack via the game $\mathsf {IND-CCA}$ in Fig. 10(left). For any adversary $\mathcal {A}$, we define the advantage

and say that scheme $\mathsf {KEM}$ is indistinguishable against chosen-ciphertext attacks if $\mathsf {Adv}^{\mathsf {ind-cca}}_{\mathsf {KEM}}(\mathcal {A})$ is negligibly small for all realistic $\mathcal {A}$.

1.1.3 A.1.3. Subverting KEM

We note that KEM schemes satisfy the generic syntax introduced above in Sect. 4, with key generation algorithm $\Pi .\mathsf {gen}=\mathsf {KEM}.\mathsf {gen}$, sender algorithm $\Pi .\mathsf {S}=\mathsf {KEM}.\mathsf {enc}$, receiver algorithm $\Pi .\mathsf {R}=\mathsf {KEM}.\mathsf {dec}$. We may thus apply the generic notions of subversion introduced in Sect. 4.1, and observe that the passive attack in Sect. 8.2 applies. If the KEM scheme is in addition ciphertext sparse, according to the notion in Sect. 8.3.1, then the attacks in Sect. 8.3 will also apply. Figure 10(right) shows the game modelling subverted indistinguishability under chosen-ciphertext attacks.

Fig. 11

Games modelling indistinguishability under one-time chosen-ciphertext attacks ($\mathsf {IND-CCA}$), and subverted indistinguishability under one-time chosen-ciphertext attacks ($\mathsf {subIND- CCA}$) for a data encapsulation mechanism $\mathsf {DEM}$

1.2 A.1.4. Data encapsulation

A DEM scheme $\mathsf {DEM}=(\mathsf {DEM}.\mathsf {gen},\mathsf {DEM}.\mathsf {enc},\mathsf {DEM}.\mathsf {dec})$ is a triple of algorithms together with associated key space $\mathcal {K}$, message space $\mathcal {M}$ and ciphertext space $\mathcal {C}$. The key generation algorithm $\mathsf {DEM}.\mathsf {gen}$ returns key $k\in \mathcal {K}$. The encapsulation algorithm $\mathsf {DEM}.\mathsf {enc}$ takes key $k\in \mathcal {K}$ and a message $m\in \mathcal {M}$, and outputs a ciphertext $c\in \mathcal {C}$. The decapsulation algorithm $\mathsf {DEM}.\mathsf {dec}$ takes a key $k\in \mathcal {K}$ and a ciphertext $c\in \mathcal {C}$, and outputs either a message $m\in \mathcal {M}$ or the special symbol $\bot \notin \mathcal {M}$ to indicate rejection. The correctness requirement is that for all keys $k\in \mathcal {K},m\in \mathcal {M}$ it holds that $\Pr \left[ \mathsf {DEM}.\mathsf {dec}(k,c)\ne m \right] \le \delta$ for $c\leftarrow \mathsf {DEM}.\mathsf {enc}(k,m)$.

1.2.1 A.1.5. IND-CCA

We formalise the indistinguishability under one-time chosen-ciphertext attack of a data encapsulation mechanism via the game $\mathsf {IND-CCA}$ in Fig. 11(left). Note how lines 04 and 08 ensure that the adversary’s first query is an encryption query, and that all further queries are decryption queries. (This precisely matches the typical situation as it emerges in a KEM/DEM hybrid.) For any adversary $\mathcal {A}$, we define the advantage

and say that scheme $\mathsf {DEM}$ is indistinguishable against chosen-ciphertext attacks if $\mathsf {Adv}^{\mathsf {ind-cca}}_{\mathcal {A}}$ is negligibly small for all realistic $\mathcal {A}$.

1.2.2 A.1.6. Subversion of DEM

We note that Data Encapsulation Mechanism schemes satisfy the generic syntax introduced above in Sect. 4, with key generation algorithm $\Pi .\mathsf {gen}=\mathsf {DEM}.\mathsf {gen}$, sender algorithm $\Pi .\mathsf {S}=\mathsf {DEM}.\mathsf {enc}$, receiver algorithm $\Pi .\mathsf {R}=\mathsf {DEM}.\mathsf {dec}$. We may thus apply the generic notions of subversion introduced in Sect. 4.1, and observe that the passive attack in Sect. 8.2 applies. If the DEM scheme is in addition ciphertext sparse, according to the notion in Sect. 8.3.1, then the attacks in Sect. 8.3 will also apply. Figure 11(right) shows the game modelling subverted indistinguishability under chosen-ciphertext attacks.

Discussion Typically, a DEM is used together with a KEM in a so-called hybrid encryption scheme that uses the KEM to share (symmetric) session keys with which plaintext messages are encrypted under the DEM. In such a setting, subverting the KEM is sufficient to undermine the security of messages sent via the hybrid scheme. Following the discussion at Sect. 4.3, it is conceivable to subvert a KEM and DEM in tandem so that the KEM’s secret key is leaked by the both together. This could allow the subversion to effectively be distributed between the two primitives, aiding undetectability in practice.

B. Example ciphertext sparse PKE schemes

We describe two widespread PKE schemes that satisfy the notion of ciphertext sparseness described in Sect. 8.3.1.

OAEP Optimal Asymmetric Encryption Padding (OAEP) was introduced by Bellare and Rogaway [15] and is a widely deployed and standardised PKE scheme. The encryption algorithm of OAEP works on message space $\mathcal {M}=\{0,1\}^\ell$ with fixed message length $\ell$. Let $k_0$ and $k_1$ be integers, and $G:\{0,1\}^{k_0}\rightarrow \{0,1\}^{\ell +k_1}$ and $H:\{0,1\}^{\ell +k_1}\rightarrow \{0,1\}^{k_0}$ be two hash functions. Messages are padded before being encrypted using the trapdoor permutation (typically RSA): To pad a message $m\in \mathcal {M}$, set $m'\leftarrow m\parallel 0^{k_1}$ and choose $r\leftarrow _{\scriptscriptstyle \$}\{0,1\}^{k_0}$. Then set $s\leftarrow m'\oplus G(r)$, $t\leftarrow r\oplus H(s)$ and ${\hat{m}}\leftarrow s\parallel t$. To decrypt a ciphertext, first decrypt (i.e. apply the trapdoor inverse) before unpadding the resulting padded message ${\hat{m}}$: Parse ${\hat{m}}$ as $s\parallel t$ with $s\in \{0,1\}^{\ell +k_1}$ and $t\in \{0,1\}^{k_0}$. Now compute $r\leftarrow t\oplus H(s)$ and $m'\leftarrow s\oplus G(r)$. If $m'\ne m\parallel 0^{k_1}$ for some m then reject, otherwise return m.

For a randomly chosen element c in the ciphertext space $\mathcal {C}$, the redundancy introduced by padding will ensure that decrypting c results in a valid message with probability $2^{-k_1}$. This is because choosing $c\leftarrow _{\scriptscriptstyle \$}\mathcal {C}$ is equivalent to choosing a random $m'\leftarrow _{\scriptscriptstyle \$}\{0,1\}^{\ell +k_1}$, assuming that the trapdoor permutation and hash functions all behave like random functions. Equivalently, the scheme is ciphertext $2^{-k_1}$-sparse, according to the definition in Sect. 8.3.1.

Cramer–Shoup The Cramer–Shoup PKE scheme was introduced in [26]. The encryption scheme $\mathsf {CS}=(\mathsf {CS}.\mathsf {gen},\mathsf {CS}.\mathsf {enc},\mathsf {CS}.\mathsf {dec})$ is defined in relation to a set of public parameters consisting of finite group $\mathbb {G}$ with $|\mathbb {G}|=q$ and a pair of generators $g,{\hat{g}}$ for $\mathbb {G}$, together with a hash key $\mathsf {hk}$ for a family of keyed collision resistant universal hash functions $H_\mathsf {hk}:\mathbb {G}^3\rightarrow \mathbb {Z}_q$. The family of keyed hash functions is such that given a randomly chosen tuple of group elements and randomly chosen hash function key, it is computationally infeasible to find a different tuple of group elements that hashes to the same value using the given hash key. We give details of Cramer–Shoup in Fig. 12.

For a randomly chosen element $c=(a,{\hat{a}},e,v)$ in the ciphertext space $\mathbb {G}^4$, the redundancy introduced by the hash function will ensure that decrypting c results in a valid message with probability $q^{-1}$. To see this, consider fixed $a,{\hat{a}},e$: this gives a fixed value of $a^{x_1+y_1\rho }\cdot {\hat{a}}^{x_2+y_2\rho }\in \mathbb {G}$ and thus $\Pr \left[ v=a^{x_1+y_1\rho }\cdot {\hat{a}}^{x_2+y_2\rho } \right] =q^{-1}.$

Fig. 12

Cramer–Shoup PKE scheme $\mathsf {CS}=(\mathsf {CS}.\mathsf {gen},\mathsf {CS}.\mathsf {enc},\mathsf {CS}.\mathsf {dec})$

C. Plaintext awareness

We here give the definition of plaintext awareness, a property of PKE schemes that implies ciphertext sparseness (see Sect. 8.3.1). Plaintext awareness essentially means that an adversary is unable to create ciphertexts without knowing the underlying plaintext message. This means that ciphertexts which have not been generated from underlying plaintext messages should be rejected, implying that ciphertexts chosen uniformly at random from the ciphertext space are unlikely to be valid. Both the Cramer–Shoup cryptosystem [25, 30] and RSA+OAEP [15, 51], outlined in Sect. 8.3.1, satisfy plaintext awareness.

The formal definitions of plaintext awareness in the standard model were proposed by Bellare and Palacio [13], and were slightly extended by Dent and Birkett [20, 30]. A scheme is plaintext aware if for all ciphertext creators (attackers) $\mathcal {A}$, there exists a plaintext extractor $\mathsf {K}$ which takes as input the random coins of A and can answer the decryption queries of A in a manner that A cannot distinguish from a real decryption oracle. In order to model the attacker’s ability to obtain ciphertexts for which it does not know the underlying plaintext, the ciphertext creator is equipped with an oracle that will return the encryption of a randomly chosen message $m\leftarrow _{\scriptscriptstyle \$}\mathrm {MS}$, where $\mathrm {MS}$ is an arbitrary (stateful) message sampling algorithm that takes as input $\alpha$ allowing an adversary (ciphertext creator) to specify a distribution on messages. In Fig. 13, we write $\diamond$ for the initial state of $\mathrm {MS}$. After interacting with either the real decryption algorithm or the knowledge extractor simulating decryption, the ciphertext creator outputs a ciphertext c. A distinguisher $\mathcal {D}$ is now tasked with guessing which case we are in. Note that the knowledge extractor $\mathsf {K}$ does not have access to the distinguisher’s randomness.

We formalise plaintext awareness of a public key encryption scheme via the game $\mathsf {PA}$ in Fig. 13. For any distinguisher $\mathcal {D}$, we define the advantage

We say that a scheme is plaintext aware if for all realistic ciphertext creators $\mathcal {A}$, there exists a knowledge extractor $\mathsf {K}$ such that for all message samplers $\mathrm {MS}$ and distinguishers $\mathcal {D}$, the advantage $\mathsf {Adv}^{\mathsf {pa}}_{\mathsf {K},\mathrm {MS},\mathcal {A}}(\mathcal {D})$ is negligibly small.

We note that a PKE scheme that satisfies plaintext awareness and indistinguishability against chosen-ciphertext attacks (Sect. 7) is necessarily ciphertext sparse. To see this, suppose that the PKE scheme is not ciphertext sparse. For a randomly chosen-ciphertext $c\leftarrow _{\scriptscriptstyle \$}\mathcal {C}$, the real game $\mathsf {PA}_{\mathsf {K},\mathrm {MS},\mathcal {A}}^0(\mathcal {D})$ will output a valid message m. However, in the random game $\mathsf {PA}_{\mathsf {K},\mathrm {MS},\mathcal {A}}^1(\mathcal {D})$ the knowledge extractor will not be able to output m without contradicting the plaintext awareness and CCA security of the scheme. We thus conclude that the scheme is ciphertext sparse.

Fig. 13

Game modelling plaintext awareness ($\mathsf {PA}$), for a public key encryption scheme $\mathsf {PKE}$. Note that we retain $\beta$ (modelling side-channel information) in the syntax of message sampler $\mathrm {MS}$ for consistency with previous sections, but here the adversary is not given output $\beta$