The Associated-Data Problem

When using an authenticated-encryption scheme (a shared-key mechanism that provides both privacy and authenticity) it is sometimes useful, when encrypting a message, to also authen­ ticate some additional information which is not privacy protected. We address this associateddata problem, wherein a Sender can bind to an authenticated ciphertext C a string AD, called its associated-data, and where the Receiver must provide the identical associated-data AD when processing C—otherwise, the ciphertext will, almost certainly, be deemed invalid. We explain the utility of this problem, give a formal definition for it, and provide efficient solutions, both in general and for the authenticated-encryption scheme OCB.