A preliminary version of this paper appears in EUROCRYPT 2020. This is the full version. Security under Message-Derived Keys: Signcryption in iMessage Mihir Bellare1 Igors Stepanovs2 February 2020 Abstract At the core of Apple’s iMessage is a signcryption scheme that involves symmetric encryption of a message under a key that is derived from the message itself. This motivates us to formalize a primitive we call Encryption under Message-Derived Keys (EMDK). We prove security of the EMDK scheme underlying iMessage. We use this to prove security of the signcryption scheme itself, with respect to definitions of signcryption we give that enhance prior ones to cover issues peculiar to messaging protocols. Our provable-security results are quantitative, and we discuss the practical implications for iMessage. 1 Department of Computer Science & Engineering, University of California San Diego, 9500 Gilman Drive, La Jolla, California 92093, USA. Email:
[email protected]. URL: https://cseweb.ucsd.edu/~mihir/. Supported in part by NSF grant CNS-1717640 and a gift from Microsoft. 2 Department of Computer Science, ETH Zürich, Universitätstrasse 6, 8092 Zürich, Switzerland. Email:
[email protected]. URL: https://sites.google.com/site/igorsstepanovs/. Supported in part by grants of first author. Work done while at UCSD. Contents 1 Introduction 2 2 Preliminaries 6 3 Signcryption 7 4 Encryption under message derived keys 12 4.1 Syntax, correctness and security of EMDK . 12 4.2 iMessage-based EMDK scheme . 14 5 Design and security of iMessage 16 5.1 iMessage-based signcryption scheme IMSG-SC ...................... 16 5.2 Parameter-choice induced attacks on privacy of iMessage ...............