{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,5,7]],"date-time":"2025-05-07T05:32:07Z","timestamp":1746595927718,"version":"3.37.3"},"reference-count":29,"publisher":"Oxford University Press (OUP)","issue":"4","license":[{"start":{"date-parts":[[2022,2,9]],"date-time":"2022-02-09T00:00:00Z","timestamp":1644364800000},"content-version":"vor","delay-in-days":1,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62032014","61772519"],"award-info":[{"award-number":["62032014","61772519"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,4,15]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>To mitigate state exposure threats to long-lived instant messaging sessions, ratcheting was introduced, which is used in practice in protocols like Signal. However, existing ratcheting protocols generally come with a high cost. Recently, Caforio et al. proposed pragmatic constructions, which compose a weakly secure \u2018light\u2019 protocol and a strongly secure \u2018heavy\u2019 protocol, in order to achieve so-called ratcheting on-demand. The light protocol they proposed has still a high complexity.<\/jats:p><jats:p>In this paper, we propose the lightest possible protocol we could imagine, which essentially encrypts and then hashes the secret key. We prove it secure in the standard model by introducing a new security notion, which relates symmetric encryption with key updates by hashing. Our protocol composes well with the generic transformation techniques by Caforio et al. to offer high security and performance at the same time. In a second step, we propose another protocol based on a newly defined integrated primitive, extending standard one-time authenticated encryption with an additional output block used as a secret key for the next message. We instantiate this primitive firstly from any authenticated encryption with associated data, and then we propose an efficient instantiation using advanced encryption standard (AES) encryption to update the key and AES-Galois\/Counter mode of operation to encrypt and decrypt messages.<\/jats:p>","DOI":"10.1093\/comjnl\/bxab209","type":"journal-article","created":{"date-parts":[[2022,1,25]],"date-time":"2022-01-25T20:12:53Z","timestamp":1643141573000},"page":"987-1016","source":"Crossref","is-referenced-by-count":3,"title":["Optimal Symmetric Ratcheting for Secure Communication"],"prefix":"10.1093","volume":"66","author":[{"given":"Hailun","family":"Yan","sequence":"first","affiliation":[{"name":"University of Chinese Academy of Sciences , Beijing 100049 , China"},{"name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne (EPFL) , Lausanne 1015 , Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Serge","family":"Vaudenay","sequence":"additional","affiliation":[{"name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne (EPFL) , Lausanne 1015 , Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Daniel","family":"Collins","sequence":"additional","affiliation":[{"name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne (EPFL) , Lausanne 1015 , Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrea","family":"Caforio","sequence":"additional","affiliation":[{"name":"\u00c9cole Polytechnique F\u00e9d\u00e9rale de Lausanne (EPFL) , Lausanne 1015 , Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"286","published-online":{"date-parts":[[2022,2,8]]},"reference":[{"article-title":"Signal protocol library for java\/android","year":"2017","author":"Systems","key":"2023041809380017500_"},{"volume-title":"The double ratchet algorithm","year":"2016","author":"Perrin","key":"2023041809380017500_"},{"volume-title":"Whatsapp encryption overview: technical white paper","year":"2017","key":"2023041809380017500_"},{"article-title":"Signal partners with Microsoft to bring end-to-end encryption to skype","year":"2018","author":"Lund","key":"2023041809380017500_"},{"article-title":"Open whisper systems partners with google on end-to-end encryption for Allo","year":"2016","author":"Marlinspike","key":"2023041809380017500_"},{"key":"2023041809380017500_","first-page":"164","volume-title":"CSF 2016","author":"Cohn-Gordon","year":"2016"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"619","DOI":"10.1007\/978-3-319-63697-9_21","volume-title":"CRYPTO 2017","author":"Bellare","year":"2017"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1007\/978-3-030-17653-2_5","volume-title":"EUROCRYPT 2019","author":"Alwen","year":"2019"},{"key":"2023041809380017500_","first-page":"29","volume-title":"EUROCRYPT 1989","author":"G\u00fcnther","year":"1989"},{"key":"2023041809380017500_","first-page":"1","volume-title":"Topics in Cryptology \u2014 CT-RSA 2003","author":"Bellare","year":"2003"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"77","DOI":"10.1145\/1029179.1029200","volume-title":"WPES \u201804","author":"Borisov","year":"2004"},{"key":"2023041809380017500_","first-page":"451","volume-title":"EuroS&P","author":"Cohn-Gordon","year":"2017"},{"key":"2023041809380017500_","first-page":"294","volume-title":"EuroS&P","author":"Blazy","year":"2019"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/978-3-319-96884-1_1","volume-title":"CRYPTO 2018","author":"Poettering","year":"2018"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"33","DOI":"10.1007\/978-3-319-96884-1_2","volume-title":"CRYPTO 2018","author":"Jaeger","year":"2018"},{"key":"2023041809380017500_","first-page":"649","volume-title":"PKC 2021","author":"Caforio","year":"2021"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"159","DOI":"10.1007\/978-3-030-17653-2_6","volume-title":"EUROCRYPT 2019","author":"Jost","year":"2019"},{"key":"2023041809380017500_","first-page":"343","volume-title":"IWSEC 2019","author":"Durak","year":"2019"},{"key":"2023041809380017500_","first-page":"180","volume-title":"TCC 2019","author":"Jost","year":"2019"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"621","DOI":"10.1007\/978-3-030-64840-4_21","volume-title":"ASIACRYPT 2020","author":"Balli","year":"2020"},{"key":"2023041809380017500_","first-page":"184","volume-title":"IWSEC 2020","author":"Yan","year":"2020"},{"key":"2023041809380017500_","first-page":"98","volume-title":"CCS 2002","author":"Rogaway","year":"2002"},{"volume-title":"Submission to NIST Modes of Operation Process","year":"2004","author":"McGrew","key":"2023041809380017500_"},{"volume-title":"Process. Stds. (NIST FIPS)","year":"2015","author":"Dang","key":"2023041809380017500_"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-662-04722-4","volume-title":"The design of Rijndael","author":"Daemen","year":"2002"},{"volume-title":"Sp 800-38d. recommendation for block cipher modes of operation: Galois\/counter mode (GCM) and GMAC","year":"2007","author":"Dworkin","key":"2023041809380017500_"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"343","DOI":"10.1007\/978-3-540-30556-9_27","volume-title":"INDOCRYPT 2004","author":"McGrew","year":"2004"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1007\/978-3-642-32009-5_3","volume-title":"CRYPTO 2012","author":"Iwata","year":"2012"},{"key":"2023041809380017500_","doi-asserted-by":"crossref","first-page":"409","DOI":"10.1007\/11761679_25","volume-title":"EUROCRYPT 2006","author":"Bellare","year":"2006"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/4\/987\/49931903\/bxab209.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/4\/987\/49931903\/bxab209.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,16]],"date-time":"2023-11-16T08:02:45Z","timestamp":1700121765000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/66\/4\/987\/6524371"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,8]]},"references-count":29,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2022,2,8]]},"published-print":{"date-parts":[[2023,4,15]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxab209","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"type":"print","value":"0010-4620"},{"type":"electronic","value":"1460-2067"}],"subject":[],"published-other":{"date-parts":[[2023,4]]},"published":{"date-parts":[[2022,2,8]]}}}