Secure Channel - Encryption and Decryption Keys For A Message I'm currently reading Cryptography Engineering and in Chapter 7, the topic of secure channel is discussed.

The channel described is using CTR for encryption. Below I include images with pseudo-code used in the book (source):





In Secure Channel: Initialization, 4 different keys are generated (assuming no collisions).

In Secure Channel: Sending a Message the key stream is generated using KeySendEnc as the key to the encryption function (let's say we're using AES here). Then, what we do is XOR the message we want to encrypt (plaintext || authenicated plaintext) with the key stream generated in the previous step. To authenticate the plain text, KeySendAux is used. Up to this point, everything makes sense.

Now, in Secure Channel: Receiving A Message, KeyRecEnc is used as the key to generate the key stream k. Then, the encrypted message is XORed with this k to obtain the original message (plaintext || authenicated plaintext). If KeyRecEnc ≠
 KeySendEnc, then the key stream k, generated in the two cases is different. My question is exactly here, how do we obtain the original message if we XOR the ciphertext with some other key stream, different from the one that we used to encrypt the message in Secure Channel: Sending a Message.

Then, KeyRecAuth (KeyRecAuth ≠ KeySendAuth) is used to obtain a MAC. This MAC is then compared with the received MAC (after it's decrypted). How can those two MACs can ever be the same (ignoring collisions), since the input to the HMAC-h function is different in both cases (because KeyRecAuth ≠ KeySendAuth).

Thanks in advance.
how do we obtain the original message if we XOR the ciphertext with some other key stream, different from the one that we used to encrypt the message in Secure Channel: Sending a Message?


Answer: we don't use different keystreams.  When Alice sends Bob a message, she uses the 'Enc Alice to Bob' keystream,  When Bob receives that message, he uses that same 'Enc Alice to Bob' keystream.  The 'Enc Bob to Alice' keystream is used for messages that Bob send to Alice (both by Bob to encrypt those messages, and by Alice to decrypt those messages).

The MACs work the same way; the 'auth Alice to Bob' MAC keys are used by both sides to do integrity checking on the messages that Alice sends to Bob, and the 'auth Bob to Alice' MAC keys are used by both sides for messages that Bob sends to Alice.