Mustafa Khairallah
@mustafakhairallah.bsky.social
Reposted by Mustafa Khairallah
If you believe that smart people cannot do utterly dumb things, just look at the Eurocrypt'26 rebuttal process.
December 16, 2025 at 11:55 AM
If you believe that smart people cannot do utterly dumb things, just look at the Eurocrypt'26 rebuttal process.
Now accepted at ToSC25/FSE26
New paper with Mario Marhuenda Beltrán where we study a concept known as Plaintext Awareness in leakage-resilient AEAD. We show that SIV is plaintext-aware, something that has been expected but was recently proven with a a proof that we demonstrate is false.
On the Plaintext Awareness of AEAD Schemes (Mario Marhuenda Beltrán, Mustafa Khairallah) ia.cr/2025/1820
November 29, 2025 at 1:45 PM
Now accepted at ToSC25/FSE26
I’m seeking a new role and would appreciate your support. If you hear of any opportunities in cryptography and/or hardware security, please send me an email, mstfkhero (gmail).
November 11, 2025 at 10:10 PM
I’m seeking a new role and would appreciate your support. If you hear of any opportunities in cryptography and/or hardware security, please send me an email, mstfkhero (gmail).
New paper with Mario Marhuenda Beltrán where we study a concept known as Plaintext Awareness in leakage-resilient AEAD. We show that SIV is plaintext-aware, something that has been expected but was recently proven with a a proof that we demonstrate is false.
On the Plaintext Awareness of AEAD Schemes (Mario Marhuenda Beltrán, Mustafa Khairallah) ia.cr/2025/1820
![Abstract. Plaintext-awareness of AEAD schemes is one of the more obscure and easily misunderstood notions. Originally proposed by Andreeva et al., Mennink and Talnikar 2025 showed that the original definitions are vague and leave too much room for interpretation. They presented new definitions and analyzed the three main AEAD compositions relative to the new definitions. In particular, they showed that MAC-then-Encrypt (MtE) is not plaintext-aware. However, they showed that an SIV-style variant is indeed plaintext-aware. In this work, we first show that their analysis contains a gap, voiding their proof. We show this by showing several attacks; against their choice of extractor, with trivial complexity, and against any extractor, with birthday-bound complexity. Next, we re-establish their results by designing a new extractor that captures their intended goal and prove a tight PA1 security bound. We also show that the result is not dependent on the encryption scheme used, by showing that an extractor can also be designed for sMtE[ΘCB3], a variant where the encryption step is done by an ΘCB3-like scheme. Afterwards, we strengthen their results, by revisiting other compositions. In particular, we show that Encrypt-then- MAC (EtM) is in fact PA2-secure. Furthermore, we show that SIV-style MtE cannot be PA2-secure. Additionally, we also show that Encode-then-Encipher is PA2-secure, but not beyond the first successful forgery. More importantly, we show that up to some necessary assumptions, PA2 and RAE are equivalent.
Last but not least, we investigate the value of the notion of plaintext awareness. We look deeper into the relation between plaintext awareness and confidentiality. We show that the problem of confidentiality in the presence of release of unverified plaintext can be seen as a confidentiality-with-leakage problem in the simulatable leakage framework. In this regard, we start, by showing that PA1 security cannot imply confidentiality with leakage. Similarly, we compare our results to the AERUP notion of TOSC 2019. We show that a scheme can be AERUP secure but not secure against a somewhat straightforward left-or-right attack in the same model. This puts into question the meaning and relevance of the PA1 and AERUP security notions. These results can be seen as providing security in a two-phase game, where the adversary does not observe any leakage after the first challenge query, as we argue in the paper. On the positive side, we show that if a scheme achieves IND-CPA, INT-RUP and PA2, then it achieves confidentiality with leakage for the appropriate leakage function. This closes a gap in the literature on the relation between confidentiality with leakage and RUP notions.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:fwa55bujvdrwlwlwgqmmxmuf/bafkreiegv2tst4pdwd7xlk5bfqgzz2cs7nlhfnfggu2fpsizevlwceck7i@jpeg)
October 8, 2025 at 4:43 AM
New paper with Mario Marhuenda Beltrán where we study a concept known as Plaintext Awareness in leakage-resilient AEAD. We show that SIV is plaintext-aware, something that has been expected but was recently proven with a a proof that we demonstrate is false.
Looking forward to the GAPS research workshops in two weeks gapsworkshop.github.io/gaps2025/
August 14, 2025 at 8:30 AM
Looking forward to the GAPS research workshops in two weeks gapsworkshop.github.io/gaps2025/
July 10, 2025 at 9:07 AM
The paper actually explains just before and after this image that collision resistance is only for the commitment result but for AEAD, full random oracle assumption is needed.
July 8, 2025 at 7:37 AM
The paper actually explains just before and after this image that collision resistance is only for the commitment result but for AEAD, full random oracle assumption is needed.
Stuck at Doha airport.
Watching people lose their shit over plane delays and not being able to control their children for a few hours, while the planes are delayed due to the country being a warzone.
Watching people lose their shit over plane delays and not being able to control their children for a few hours, while the planes are delayed due to the country being a warzone.
June 24, 2025 at 4:00 AM
Stuck at Doha airport.
Watching people lose their shit over plane delays and not being able to control their children for a few hours, while the planes are delayed due to the country being a warzone.
Watching people lose their shit over plane delays and not being able to control their children for a few hours, while the planes are delayed due to the country being a warzone.
When have I seen this movie before? techcrunch.com/2024/02/15/v...
Spyware startup Variston is losing staff — some say it's closing | TechCrunch
The Barcelona-based startup's malware has been used to target iPhones, Android devices and PCs running Windows Defender.
techcrunch.com
February 13, 2025 at 8:06 PM
When have I seen this movie before? techcrunch.com/2024/02/15/v...
Get a grant.
Do the work.
Publish papers.
Have it all flushed down the toilet because of some VISA clerk.
Do the work.
Publish papers.
Have it all flushed down the toilet because of some VISA clerk.
February 13, 2025 at 4:28 PM
Get a grant.
Do the work.
Publish papers.
Have it all flushed down the toilet because of some VISA clerk.
Do the work.
Publish papers.
Have it all flushed down the toilet because of some VISA clerk.
Egypt topping this list is a bit suspect, a country that less than 10 years ago tried to promote a fake HIV cure, with wide support from the public. In another instance and academic economist was killed and his body dumped in a mental institute.
💡 Across 68 countries, trust in scientists is moderately high (mean trust = 3.62, on a scale from 1 = very low trust to 5 = very high trust), with strong differences across countries.
January 24, 2025 at 4:30 PM
Egypt topping this list is a bit suspect, a country that less than 10 years ago tried to promote a fake HIV cure, with wide support from the public. In another instance and academic economist was killed and his body dumped in a mental institute.
Apparently there was an award for Asiacrypt distinguished PC members and apparently I was one of them 🤷🏼♂️
December 26, 2024 at 9:25 PM
Apparently there was an award for Asiacrypt distinguished PC members and apparently I was one of them 🤷🏼♂️