Security of Hash-then-CBC Key Wrapping Revisited
Key wrapping schemes are used to encrypt data of high entropy, such as cryptographic keys. There are two known security definitions for key wrapping schemes. One captures the security against chosen plaintext attacks (called DAB-security), and the other captures known plaintext attacks (called AKW-security). In this paper, we revisit the security of Hash-then-CBC key wrapping schemes. In [17], Osaki and Iwata showed that the U-CC-then-CBC key wrapping scheme, a key wrapping scheme that uses the U-CC hash function and CBC mode, has provable AKW-security. In this paper, we show that the scheme achieves the stronger notion of DAB-security. We also show our proof in the variable input length setting, where the adversary is allowed making queries of varying lengths. Furthermore, we consider the scheme that incorporates the use of headers. To handle such a setting, we generalize the previous definition of the U-CC hash function to the variable input length setting and to take the header as its input, and show an efficient construction that meets the definition.
hash function cbc mode authenticated key wrapping security proof deterministic authenticated encryption