How to Securely Release Unverified Plaintext in Authenticated Encryption

摘要: Scenarios in which authenticated encryption schemes output decrypted plaintext before successful verification raise many security issues. These situations are sometimes unavoidable practice, such as when devices have insufficient memory to store an entire plaintext, or a needs early processing due real-time requirements. We introduce the first formalization of releasing unverified (RUP) setting. To achieve privacy, we propose using awareness (PA) along with IND-CPA. An scheme is PA if it has extractor, tries fool adversaries by mimicking decryption oracle, without secret key. Releasing attacker then becomes harmless infeasible distinguish oracle from extractor. two notions symmetric-key setting, PA1 and PA2, show that they expose new layer between IND-CPA IND-CCA. integrity, INT-CTXT RUP setting required, refer INT-RUP. compared conventional definitions, used make classification Furthermore, re-analyze existing schemes, provide solutions fix insecure schemes.