Paper 2025/758 Original: eprint.iacr.org/2025/758 ↗
Blockcipher-Based Key Commitment for Nonce-Derived Schemes
Abstract
AES-GCM has seen great adoption for the last 20 years to protect data in various use-cases because of its optimal performance. It has also posed some challenges to modern applications due to its nonce, block size, and lack of key commitment. Nonce-derived schemes address these challenges by deriving a different key from random values and using GCM with the derived key. In this work, we explore efficient key commitment methods for nonce-derived schemes. For concreteness, we focus on expanding XAES-256-GCM, a derived key scheme originally introduced by Filippo Valsorda. We propose an efficient CMAC-based key commitment solution, and prove its security in the ideal-cipher model. This proposal yields a FIPS-compliant mode and offers much better data bounds than GCM. Finally, we benchmark the new mode's performance to demonstrate that the additional cost affects mostly small plaintexts.
Metadata
- Available format(s)
PDF- Category
- Foundations
- Publication info
- Preprint.
- History
- 2025-09-02: last updated
- 2025-04-28: published
- Short URL
- https://ia.cr/2025/758
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2025/758,
author = {Panos Kampanakis and Shai Halevi and Nevine Ebeid and Matt Campagna},
title = {Blockcipher-Based Key Commitment for Nonce-Derived Schemes},
howpublished = {Cryptology {ePrint} Archive, Paper 2025/758},
year = {2025},
url = {https://eprint.iacr.org/2025/758}
}