One-pass AE Modes with White-box Incompressibility

At ASIACRYPT 2022, Hosoyamada et al. introduced a rigorous white-box incompressibility framework for symmetric-key primitives, formalizing notions such as wh-PRP, wh-SPRP, and wh-PRI, and establishing reductions that weak public indifferentiability implies white-box reduction in their framework. As a concrete example, they demonstrated that counter mode with SIV construction achieves white-box incompressibility. Extending these results to one-pass constructions appears to be considerably challenging. In particular, any construction that is vulnerable under nonce repetitions with respect to the AE security is incompatible in their white-box setting, thereby posing a fundamental obstacle to achieving white-box incompressibility for such schemes. We address this by considering a weaker notion of AE security and introducing the notion of delayed on-line AE (dOAE), a natural and strictly more expressive extension of on-line AEAD supported by many efficient designs. Within this framework, we analyze the authenticated cipher SAEB, introduced by Naito et al. at TCHES'18, that achieves dOAE security under nonce misuse. We prove that SAEB achieves a white-box delayed on-line PRI (wh-dOPRI), assuming the underlying block-cipher to be wh-PRP. To the best of our knowledge, this is the first result providing a mode-level white-box guarantee for an efficient single-pass AEAD construction.