Two chosen-plaintext attacks on the Li-Wang joint authentication and encryption scheme

Abstract

In [LW91], Li and Wang proposed a joint authentication and encryption scheme based on algebraic coding theory. They claimed that their scheme is as secure as the Rao-Nam scheme [RN89]. However, in contrast with their claim, it will be shown that this joint authentication and encryption scheme appears to be less secure. In this paper two inherently different chosen-plaintext attacks are presented.

The first attack is based on the linearity of the bit selection function, and obtains a k × n matrix equivalent to the encryption matrix in O(k) encryptions. If the set of error vectors kZ is randomly chosen, about ¦kZ¦ encryptions are necessary to obtain a corresponding set of error vectors. With knowledge of only r error vectors one can always encrypt and decrypt r2^2k−n messages.

The second attack makes use of the non-linearity of the error function, and always obtains 2k − n rows of the encryption matrix after O(k ²) encryptions. Hereafter ¦kZ¦ encryptions are required to create a cryptosystem equivalent to the Li-Wang scheme.

Some extensions of the scheme are discussed, and a general question raised by Brickell and Odlyzko [BO88] related to the Rao-Nam scheme is settled in a negative way.