Secure Channels Based on Authenticated Encryption Schemes: A Simple Characterization

We consider communication sessions in which a pair of parties begin by running an au-thenticated key-exchange protocol to obtain a shared session key, and then secure successivedata transmissions between them via an authenticated encryption scheme based on the sessionkey. We show that such a communication session meets the notion of a secure channel protocolproposed by Canetti and Krawczyk [9] if and only if the underlying authenticated encryptionscheme meets two new, simple definitions of security that we introduce, and the key-exchangeprotocol is secure. In other words, we reduce the secure channel requirements of Canetti andKrawczyk to easier to use, stand-alone security requirements on the underlying authenticatedencryption scheme. In addition, we relate the two new notions to existing security notions forauthenticated encryption schemes.