Message Extension Attack against Authenticated Encryptions: Application to PANDA

摘要: In this paper, a new cryptanalysis approach for class of authenticated encryption schemes is presented, which inspired by the previous length extension attack against hash function based MACs. The called message attack. target that initialize internal state with nonce and key, update associated data message, extract key stream from state, finally generate tag updated state. A forgery can be mounted in nonce-repeating model chosen-plaintext scenario when to shared processing generating tag. then applied PANDA , dedicated design submitted CAESAR. An existential 25 chosen plaintexts, 264 computations, negligible memory, breaks claimed 128-bit security model. This first result claim .