Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme:


generate random seed z using n - 1 bits - where n is the size of the modulus N
interpret the seed z as unsigned number and encrypt using the public key e: w = RSA(e, z)
derive a session key and IV using s = KDF(z, "skey") and iv = KDF(z, "iv")
encrypt the plaintext message m' using (c, t) = AEAD(s, iv, ad, m), where t is the authentication tag and ad is (additional) authenticated data
output w | c | t


Would it be advantageous to include the value of w - the encrypted key seed - in the authenticated data ad?
It probably doesn't hurt to include the encapsulation as additional data for the AEAD, but there is no need.  The generic KEM/DEM composition,

\begin{align}
  &amp;(C_0, k) \leftarrow \operatorname{KEM}_{\mathit{pk}}() \\
  &amp;C_1 \leftarrow \operatorname{DEM}_k(M) \\
  &amp;\operatorname{return} C_0\mathbin\|C_1,
\end{align}

provides adequate security by the standard theorems, e.g. Cramer–Shoup 2001, Theorem 5 on p. 41.



You can safely separate the concerns of


generating the encapsulation $C_0$ and the key $k$ with RSA, and
one-time authenticated encryption under $k$,


as separate subroutines that communicate only $k$.

See Shoup's ISO proposal for more practical details of composition and instantiation with less math.



Incidentally, it is also unnecessary to generate an IV, since the key is used only once: you can safely use an IV/nonce of zero for the AEAD as a DEM.