10-Round Feistel is Indifferentiable from an Ideal Cipher

Dachman-Soled, Dana; Katz, Jonathan; Thiruvengadam, Aishwarya

doi:10.1007/978-3-662-49896-5_23

Cited by 23 publications

(7 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this setting, the functions are keyless, and one assumes ideality of the underlying primitives in order to prove security in the indifferentiability framework [49]. The Feistel construction has seen notable indifferentiability analysis [26,27,29], and so has the sum of permutation construction [14,23,51].…”

Section: Our Contribution In Bigger Perspectivementioning

confidence: 99%

See 1 more Smart Citation

How to Build Pseudorandom Functions from Public Random Permutations

Chen

Lambooij

Mennink

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Pseudorandom functions are traditionally built upon block ciphers, but with the trend of permutation based cryptography, it is a natural question to investigate the design of pseudorandom functions from random permutations. We present a generic study of how to build beyond birthday bound secure pseudorandom functions from public random permutations. We first show that a pseudorandom function based on a single permutation call cannot be secure beyond the 2 n/2 birthday bound, where n is the state size of the function. We next consider the Sum of Even-Mansour (SoEM) construction, that instantiates the sum of permutations with the Even-Mansour construction. We prove that SoEM achieves tight 2n/3-bit security if it is constructed from two independent permutations and two randomly drawn keys. We also demonstrate a birthday bound attack if either the permutations or the keys are identical. Finally, we present the Sum of Key Alternating Ciphers (SoKAC) construction, a translation of Encrypted Davies-Meyer Dual to a public permutation based setting, and show that SoKAC achieves tight 2n/3-bit security even when a single key is used.

show abstract

Section: Our Contribution In Bigger Perspectivementioning

confidence: 99%

“…of SoP [14,23,51] Indiff. of Feistel [26,27,29] GT [33] K e y A lt e r n a t in g F e is t e l [3 4 , 4 5 ]…”

Section: Our Contribution In Bigger Perspectivementioning

confidence: 99%

How to Build Pseudorandom Functions from Public Random Permutations

Chen

Lambooij

Mennink

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The notion of indifferentiability, introduced by Maurer, Renner and Holenstein [26] generalizes over the standard notion of indistinguishability by considering settings where the adversary has oracle access to both the construction and its underlying primitive. It has been used as a way of reducing concerns in the design of block ciphers (with proofs for Feistel networks [20,21] and substitutionpermutation networks [16]) and hash functions (with proofs for the Merkle-Damgård construction [18] and the Sponge construction [14]), in each case formally capturing the intuition that the construction does not introduce any structural vulnerabilities when the underlying primitive is seen as an ideal black-box. Definition 2.1 (Indifferentiability [26]).…”

Section: Security Of the Sponge Constructionmentioning

confidence: 99%

Machine-Checked Proofs for Cryptographic Standards

Almeida

Baritel-Ruet

Barbosa

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

View full text Add to dashboard Cite

We present a high-assurance and high-speed implementation of the SHA-3 hash function. Our implementation is written in the Jasmin programming language, and is formally verified for functional correctness, provable security and timing attack resistance in the EasyCrypt proof assistant. Our implementation is the first to achieve simultaneously the four desirable properties (efficiency, correctness, provable security, and side-channel protection) for a non-trivial cryptographic primitive.Concretely, our mechanized proofs show that: 1) the SHA-3 hash function is indifferentiable from a random oracle, and thus is resistant against collision, first and second preimage attacks; 2) the SHA-3 hash function is correctly implemented by a vectorized x86 implementation. Furthermore, the implementation is provably protected against timing attacks in an idealized model of timing leaks. The proofs include new EasyCrypt libraries of independent interest for programmable random oracles and modular indifferentiability proofs.

show abstract

“…Essentially, indifferentiability implies that any reduction using the random permutation can be translated to one in the random oracle model. A subsequent sequence of works [12,13,14] show that 8 rounds is sufficient; the minimal number of rounds is still open but known to be at least six. Unfortunately, none of these works are "tight" in the sense that the resulting reduction in the random oracle model will be very loose.…”

Section: Ideal Cipher Modelmentioning

confidence: 99%

“…In our work, the domain of the ideal cipher is that of the trapdoor permutation, which is usually much larger than the block-length of a typical block cipher like AES. Fortunately, as shown by a series of works [10,12,13,14] we can replace arbitrary-length ideal ciphers by using 8 rounds of Feistel network, and obtain the same security in the random oracle as in the ideal cipher model using indifferentiability arguments [23].…”

Section: Introductionmentioning

confidence: 99%

A Unified Framework for Trapdoor-Permutation-Based Sequential Aggregate Signatures

Gentry

O’Neill

Reyzin

2018

Public-Key Cryptography – PKC 2018

View full text Add to dashboard Cite

We give a framework for trapdoor-permutation-based sequential aggregate signatures (SAS) that unifies and simplifies prior work and leads to new results. The framework is based on ideal ciphers over large domains, which have recently been shown to be realizable in the random oracle model. The basic idea is to replace the random oracle in the full-domain-hash signature scheme with an ideal cipher. Each signer in sequence applies the ideal cipher, keyed by the message, to the output of the previous signer, and then inverts the trapdoor permutation on the result. We obtain different variants of the scheme by varying additional keying material in the ideal cipher and making different assumptions on the trapdoor permutation. In particular, we obtain the first scheme with lazy verification and signature size independent of the number of signers that does not rely on bilinear pairings. Since existing proofs that ideal ciphers over large domains can be realized in the random oracle model are lossy, our schemes do not currently permit practical instantiation parameters at a reasonable security level, and thus we view our contribution as mainly conceptual. However, we are optimistic tighter proofs will be found, at least in our specific application.

show abstract

10-Round Feistel is Indifferentiable from an Ideal Cipher

Cited by 23 publications

References 13 publications

How to Build Pseudorandom Functions from Public Random Permutations

How to Build Pseudorandom Functions from Public Random Permutations

Machine-Checked Proofs for Cryptographic Standards

A Unified Framework for Trapdoor-Permutation-Based Sequential Aggregate Signatures

Contact Info

Product

Resources

About