Secure channels based on authenticated encryption schemes: A simple characterization

Abstract

We consider communication sessions in which a pair of parties begin by running an authenticatedk ey-exchange protocol to obtain a sharedsession key, andthen secure successive data transmissions between them via an authenticatedencryption scheme basedon the session key. We show that such a communication session meets the notion of a secure channel protocol proposedb y Canetti andKra wczyk [9] if and only if the underlying authenticated encryption scheme meets two new, simple definitions of security that we introduce, and the key-exchange protocol is secure. In other words, we reduce the secure channel requirements of Canetti andKra wczyk to easier to use, stand-alone security requirements on the underlying authenticated encryption scheme. In addition, we relate the two new notions to existing security notions for authenticatedencryption schemes.