iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes: under some non-committing authenticated-encryption schemes and attack models, one ciphertext can be accepted under two different keys and yield two valid plaintexts. That does not mean an AEAD tag is generally easy to forge under the key that originally produced the ciphertext. It means ordinary AEAD authenticity and key commitment answer different security questions: authentication checks a ciphertext against a key, while key commitment asks whether the ciphertext can be validly explained by another key as well.
What does it mean for one ciphertext to have two valid plaintexts?
An AEAD encryption operation takes a key, nonce, associated data, and plaintext, then produces a ciphertext. Decryption with the relevant key, nonce, and associated data either returns a plaintext or rejects the input. The surprising case is when two different keys can each accept the same ciphertext, potentially returning different plaintexts.
Those two outputs are not necessarily the result of a broken tag check under the original key. Each decryption can authenticate successfully in its own key context. The ambiguity is that the ciphertext does not uniquely identify which key—and therefore which interpretation—was intended. John Chan and Phillip Rogaway call a ciphertext that is “explained” in multiple valid ways a misattribution in their 2022 paper On Committing Authenticated-Encryption.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Think of ordinary authentication as checking whether a document’s seal is valid under a particular key. Key commitment adds another guarantee: the seal should identify which key made it. Without that added property, a program that treats “decryption succeeded” as proof of file identity, key provenance, or object type may be relying on more than the AEAD scheme promises.
Popular on Amazon
- 【90 Degree Full Function USB C Adapter】Supports the latest USB4 standard for up to 40Gbps of bandwidth, 8K video support, and up to 240W Fast charging; Support USB PD 3.1 Extended Power Range (EPR) including 140W, 180W and 240W. Your productivity is easily doubled. *Warm Tip: For the best fit, please make sure the USB-C port is fully exposed; thick or bulky cases may affect compatibility.
- 【Reliable Quality】Made from high-quality, scratch-resistant aluminum alloy, delicate metal frame. get excellent wear resistance and heat dissipation. Non-Slip Design for easier insertion and removal.
- 【Small and portable】Ultra thin size, ultra compact design, a petite physique that matches the minimalist design of your modern laptops. Coming with a slim figure that won't block the port next to the one it's plugged into.
- 【Compatibility】Widely work with most usb c, thunderbolt 4/3 devices. Compatibilit for ROG Ally, Steam Deck, Switch, MacBook Pro, Quest 3 VR headset, Surface Book 2, iPhone 18/17/16/15, Samsung Galaxy S23/S22/S21, Note 20/10, Google Pixel, ChromeBook, etc.
- 【Excellence Customer Support】If you experience any issues or cable failure, simply reach out to our dedicated customer service team. We provide a prompt response within 18 hours, providing you with the necessary technical support to resolve any concerns.
Why doesn’t AEAD authentication automatically bind the key?
Conventional authenticated encryption is designed to protect confidentiality and integrity in a specified setting, commonly one key at a time with nonces used as required by the scheme. Key commitment is a separate property: it asks whether a ciphertext can be valid under more than one key. Passing the first kind of security check does not, by itself, establish the second.
This distinction is the reason the apparent paradox is possible. A successful check says that the ciphertext is acceptable for the particular key and inputs that the decryption operation used. It does not automatically say that no other key and valid input combination could also accept it. If an application assumes that authentication success proves unique key identity, that assumption needs a committing construction or another mechanism that establishes the identity.
RFC 9771 classifies key commitment as an additional AEAD security property and uses CMT-1 for the associated notion. The RFC also lists key robustness and key collision resistance as alternate names. It is an IRTF Crypto Forum Research Group consensus document: a terminology and classification reference, not an IETF product or Internet Standard that mandates one construction for every deployment.
What is the difference between key commitment and full commitment?
Key commitment concerns whether the ciphertext can be explained under two different keys. Full commitment is stronger: it binds the entire encryption input tuple—key, nonce, associated data, and plaintext. RFC 9771 states that full commitment implies key commitment, but key commitment alone does not imply full commitment.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Property or term | What it binds or describes | What it does not establish by itself |
|---|---|---|
| Ordinary AEAD authenticity | Integrity and authenticity for the key and inputs used in a decryption check, within the scheme’s security model | That no other key can also explain the ciphertext |
| Key commitment (CMT-1-style) | The key: it rules out two different keys validly explaining the same ciphertext in the relevant formal model | That nonce, associated data, and plaintext are all uniquely bound |
| Full commitment | The full tuple of key, nonce, associated data, and plaintext | Security outside the assumptions and adversary capabilities of the exact construction |
| Committing authenticated encryption | A broader research framework for preventing misattribution under specified adversary capabilities | A guarantee independent of the precise game, inputs, and keys involved |
These labels should not be used interchangeably. In particular, a statement that a construction is “committing” is incomplete unless it identifies what is committed and under what adversary model. Chan and Rogaway’s strongest target is full commitment, in which a difference anywhere in the encryption-input tuple is covered.
Can AES-GCM decrypt to two valid plaintexts?
Published work demonstrates that AES-GCM ciphertexts can have two valid plaintext interpretations in relevant attack settings, but that is not a claim that every GCM ciphertext is ambiguous or that ordinary tags are generally forgeable under the original key. The 2022 USENIX Security paper by Ange Albertini, Thai Duong, Shay Gueron, Stefan Kölbl, Atul Luykx, and Sophie Schmieg reports proof-of-concept constructions whose plaintexts can be valid PDFs, Windows executables, and DICOM files.
The significance is not merely that two byte strings can be produced. If each interpretation is accepted by downstream software as a legitimate file or object, an application may act on different content depending on the key context it uses. The paper’s examples show why a system must not infer unique file identity or key provenance solely from an AEAD decryption success when its construction does not provide that commitment guarantee.
Free tools Windows power users keep installed
One-click scans. No signup required.
Chan and Rogaway also discuss attacks involving GCM and OCB. Their paper describes a weaker model in which an adversary knows one key and constructs a second valid explanation, and emphasizes that ordinary nonce-based AE security is insufficient for even some weaker committing-AE goals. The exact result depends on the attack model and construction; the paper should not be read as saying that all uses of either algorithm fail in the same way.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Which constructions provide commitment?
The algorithm name alone is not enough to determine the answer: the exact version or transform matters. RFC 9771 lists Ascon as an example of an AEAD algorithm providing both key commitment and full commitment. It separately identifies full-committing versions of GCM and GCM-SIV, so those should not be confused with the base algorithm labels.
- Ascon: RFC 9771 identifies it as providing key commitment and full commitment.
- GCM and GCM-SIV: the RFC’s wording refers to full-committing versions, not a blanket property of every construction or implementation carrying those base names.
- Other schemes: check the exact specification and security claim. Do not infer commitment from the fact that a scheme is an AEAD or has a tag.
For a deployment decision, match the guarantee to the threat model: key-only binding may be sufficient for one question, while an application that needs the full tuple bound needs a full-committing construction. Also check the nonce assumptions and which keys an adversary may know, control, or cause the system to try. A proof for one variant or model is not automatically a proof for a nearby variant.
Where can missing key commitment matter?
RFC 9771 identifies password-authenticated key exchange, password-based encryption, key rotation, and envelope encryption as settings that may need key commitment. They share a practical concern: key identity may be uncertain, negotiated, rotated, or selected through a separate management step.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Password-based systems
Password-based encryption or password-authenticated protocols can involve candidate keys derived from secret inputs. If an application tests candidate keys and uses the first successful decryption as proof that it selected the intended key, a non-committing scheme can leave room for ambiguity. The security question is not simply whether one candidate passes authentication, but whether the ciphertext has a unique valid key explanation under the relevant model.
Also popular on Amazon
- Portable and powerful USB-C HUB: BENFEI USB Type-C HUB, with super-soft and knot-free silicone woven design cable, meets most mobile office needs. Compact, lightweight, stylish, and powerful portable USB C Hub equipped with 1 x HDMI port, 1 x 100W charging, and 3 x USB ports. 18-month warranty, 24-hour response, to ensure you feel at ease when using our product.
- Design centered on comfort and reliability: Thanks to BENFEI's end-to-end in-house cable production capability, in-house PCBA and assembly capability, using the industry's most advanced silicone woven design and process, 20cm cable in length, no knots, super-soft, the HUB is easy to use in all scenarios: laptop, tablet, stand etc. Super-soft, 25000+ life cycles, to meet your daily carrying and office needs.
- 100W Charging: Support up to 90W USB C pass-through charging via Type-C port to keep your laptop powered. 10W is reserved for other interface operations. No data and video function on the Type-C port.
- 4K HDMI Display: The HDMI port supports media display at resolutions up to 4K 30Hz, keeping every incredible moment detailed and ultra vivid. Please note that the C port of the Host device needs to support video output.
- Transfer Files in Seconds: Transfer files and from your laptop at speeds up to 10 Gbps with USB A 3.2 port. Extra 2 USB A 2.0 ports are perfectly for your keyboards and mouse.
Key rotation
During rotation, old and new keys may coexist while ciphertexts are read or migrated. A system that accepts data under multiple keys needs a way to establish which key is authoritative; successful decryption alone may not provide that identity guarantee when the AEAD lacks commitment.
Envelope encryption
Envelope encryption separates data encryption from the process that wraps, stores, or selects the data-encryption key. If those paths can select different keys or interpret metadata differently, commitment can help ensure the ciphertext is tied to the intended key context. This is an application-level implication of the security property, not a claim that every envelope-encryption design is vulnerable.
In any of these settings, distinguishable success and failure outcomes can also matter. If a system exposes different responses depending on whether a key or interpretation succeeds, ambiguity may contribute to a partitioning-style oracle. That is a risk to assess in the application protocol and error behavior; it is not an automatic consequence of using AEAD.
How can a system add or obtain key commitment?
The most direct route is to choose an AEAD construction whose documented security properties include the commitment level required by the application. Another route is to add an explicit commitment layer, but it must be a construction analyzed for the exact scheme and threat model rather than an improvised extra check.
Also popular on Amazon
- 【Read before You Buy】 Note: This adapter is USB 2.0 version and cannot transmit HDM, VGA, or other video signals. Nevertheless, they are fully capable of charging devices,duplicating files, and can be seamlessly integrated with USB-C earphones, wireless network adapters, and SD card adapters.
- 【Easy to Use and Safe】Thanks to modern manufacturing techniques, we've made these adapters sufficiently compact so that they can remain inserted in your device without noticeable protrusion or inconvenience. This means you don't have to constantly plug and unplug them, reducing the likelihood of wear and misalignment, and making them more convenient to carry around.
- 【Reliable Quality】Engineered for enhanced durability, durable aluminum alloy shell material,get excellent wear resistance and heat dissipation,the male USB C and female USB connectors & the male USB and female USB C connectors are designed to be plugged and unplugged up to 20000 times. Provides data transfer, device charging, memory space expansion, and additional computer peripherals.
- 【Think more for you】Do you need to connect a USB-C-enabled device to an odd device that only has USB-A ports? Then these USB-A male to USB-C female adapters are made for you.Simply insert the adapter into the USB-A port on the device, and you can instantly connect your USB-C device to the device that originally didn't have the correct connection port.
- 【Trusted xiwxi Quality and Service】As a responsible brand seller, you will receive xiwxi's 12-month Quality assurance and lifetime friendly customer service, you're not just buying a product,you're investing in peace of mind with all-round quality and exceptional customer service.
Use a commitment layer
The USENIX Security 2022 paper describes a generic approach as well as scheme-specific fixes for constructions such as AES-GCM and ChaCha20-Poly1305. The authors caution that a scheme-specific fix requires separate analysis for each construction. Developers should use a vetted specification or implementation rather than translating a paper idea into ad hoc application code.
Understand CTX’s trade-off
Chan and Rogaway propose CTX for a tag-based nonce-based AE scheme whose output consists of a ciphertext core and a tag. CTX replaces the tag with a hash-derived value over the key, nonce, associated data, and original tag. Under the paper’s security model, this commits to the full input tuple. The added computation is one hash over a short string, independent of plaintext length.
The paper gives typical construction parameters of about 128 bits for an ordinary AE authentication tag and about 160 bits for a CTX commitment tag. These are parameters discussed by Chan and Rogaway in 2022, not measurements of deployed systems or universal requirements. A system adopting a transform still needs to account for exact encoding, key derivation, nonce handling, implementation interoperability, and the proof assumptions of that transform.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- State the property needed. Decide whether the requirement is unique key explanation or binding of the full key/nonce/associated-data/plaintext tuple.
- Define the adversary model. Record whether keys are hidden, revealed, or potentially corrupted, and what inputs the attacker can choose or observe.
- Verify the exact construction. Check the named variant’s specification and proof rather than assuming a base algorithm name includes commitment.
- Review integration behavior. Ensure key selection, metadata parsing, error handling, and downstream file or object validation do not treat a successful decrypt as a stronger identity statement than the construction supports.
What should developers take away?
AEAD remains an important way to protect confidentiality and integrity, but “authenticated” does not automatically mean “uniquely attributable to one key.” Key commitment addresses that separate ambiguity; full commitment extends the binding to the whole encryption input tuple. The useful question for a design review is therefore not only “Does decryption reject tampering?” but also “Does this exact construction bind the key—or the full tuple—in the model our application needs?”
Frequently Asked Questions
Does two valid plaintexts mean the AEAD tag was forged?
Not necessarily. In a misattribution scenario, each decryption may pass authentication under its own key; the issue is that the ciphertext has more than one valid explanation, rather than a failed tag check under the original key.
Does nonce uniqueness prevent key ambiguity?
Nonce rules are part of an AEAD’s security assumptions, but satisfying them does not by itself establish key commitment. The relevant commitment claim must be made for the exact scheme and security model.
Can an application fix this by trying every key and accepting the first successful decrypt?
That policy can turn decryption success into an implicit key-selection rule without proving that the selected key is unique. Applications that try candidate keys should define how they establish intended key identity and avoid exposing distinguishable outcomes that reveal which interpretation succeeded.
Recommended Free Tools
