Abstract
An encrypted-document envelope carries advisory metadata — a threshold/quorum requirement, a lifetime policy, a distribution policy, and a lineage pointer — alongside ciphertext. Conventionally this metadata sits in a plaintext or merely hashed header, where a third party can strip it, alter it, or downgrade the format to disable the behavior it governs, because the metadata is not bound to the ciphertext itself. An unkeyed header hash does not solve this: an attacker who edits the header simply recomputes the hash.
This disclosure describes binding that metadata to the ciphertext as AES-GCM Additional Authenticated Data (AAD), computed over a deterministic canonical serialization, such that any modification, removal, or format-version downgrade of the bound metadata causes authenticated decryption to fail.The binding is not strippable — the recipient always reconstructs the AAD from the current header, so there is no separate field an attacker can delete to disable the check — and not downgradeable — decrypting without the AAD fails the authentication tag, and re-encrypting is impossible without the content encryption key. The mechanism is version-gated so that envelopes written under earlier rules remain verifiable unchanged.
The disclosed technique applies to any client-side-encrypted or end-to-end-encrypted document format that carries governance metadata alongside ciphertext, and is independent of how the content key is distributed to recipients.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Brown, David Lee, "Tamper-Evident, Non-Downgradeable Binding of Advisory Header Metadata to Ciphertext in Client-Side-Encrypted Document Envelopes via AES-GCM Additional Authenticated Data", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/11391