Forward-Secure Authenticated-Encryption in Multi-Receiver Setting

In this paper we study a generic construction of forward-secure authenticated-encryption in unidirectional, multi-receiver setting. By “multi-receiver setting” we mean the situation in which a single center transmits large data to a dynamically changing group of receivers. In such scenario a direct application of bidirectional, unicast methods would lead to multiple problems. In particular, we focus on the problem of vulnerability against a type of denial-of-service (DoS) attack. We show that this problem can be effectively resolved by a mechanism we call “MAC-then-MAC” structure. As the name suggests, this structure uses two independent MACs, but we illustrate how it can be realized without losing efficiency in transmission rate, storage size and computational overhead. Despite the fact that one of the MACs uses a constant key, our construction guarantees integrity in the sense of forward security. We provide a concrete security model showing that our construction achieves confidentiality and strong integrity (replay avoidance, in-order packet delivery, etc.) both in the sense of forward security.