Security Notes on the MAC-then-Encrypt Paradigm

摘要

The security of MAC-then-Encrypt paradigm had been initially discussed by M. Bellare et al. under the assumption that the given symmetric encryption scheme is IND-CPA secure and the given MAC is WUF-CMA secure. Based on the recently systematized game-playing technique, this paper discussed further how the MAC-then-encrypt is secure when the underlying encryption scheme is strengthened up to NM-CPA-secure then to IND-CCA-secure. We then proposed a new secure notion called UF-SCMA (Unforgeability against Stateful Chosen-Message Attacks) to characterize the security of MAC, discussed how secure the MAC-then-encrypt paradigm is under the notions of SINT-PTXT and IND-CCVA, presenting a sufficient condition to implement secure channel via the MAC-then-encrypt paradigm. We also proposed a way to build an UF-SCMA-secure MAC out of an UF-CMA-secure MAC and left an open question to build an IND-CCVA-secure encryption scheme out of an IND-CPA-secure encryption scheme or an IND-CCA-secure encryption scheme.