15.3 Security of generic composition
In their seminal publication Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm [18], Bellare and Namprempre analyze the generic compositions encrypt-and-MAC, MAC-then-encrypt, and encrypt-then-MAC, and prove whether these compositions are secure for the notions IND-CPA, IND-CCA, NM-CPA, INT-PTX, and INT-CTX.
The proofs given by Bellare and Namprempre are valid under the assumption that the block cipher used is secure against a chosen-plaintext attack and the MAC algorithm is strongly unforgeable under a chosen-message attack.
Popular cryptographic algorithms we have covered so far – for example, the block cipher AES and the keyed hash function HMAC used for message authentication – are believed to offer such security guarantees. As a result, Bellare and Namprempre emphasize that analyzing the compositions under these assumptions yields a realistic and practically useful result.
Table...
