Boosting Authenticated Encryption Robustness with Minimal Modifications

Abstract

Abstract. Secure and highly efficient authenticated encryption (AE) algorithms which achieve data confidentiality and authenticity in the symmetric-key setting have existed for well over a decade. By all conventional measures, AES-OCB seems to be the AE algorithm of choice on any platform with AES-NI: it has a proof showing it is secure assuming AES is, and it is one of the fastest out of all such algorithms. However, algorithms such as AES-GCM and ChaCha20+Poly1305 have seen more widespread adoption, even though they will likely never outperform AES-OCB on platforms with AES-NI. Given the fact that changing algorithms is a long and costly process, some have set out to maximize the security that can be achieved with the already deployed algorithms, without sacrificing efficiency: ChaCha20+Poly1305 already improves over GCM in how it authenticates, GCM-SIV uses GCM's underlying components to provide nonce misuse resistance, and TLS1.3 introduces a randomized nonce in order to improve GCM's multi-user security. We continue this line of work by looking more closely at GCM and ChaCha20+Poly1305 to see what robustness they already provide over algorithms such as OCB, and whether minor variants of the algorithms can be used for applications where defense in depth is critical. We formalize and illustrate how GCM and ChaCha20+Poly1305 offer varying degrees of resilience to nonce misuse, as they can recover quickly from repeated nonces, as opposed to OCB, which loses all security. More surprisingly, by introducing minor tweaks such as an additional XOR, we can create a GCM variant which provides security even when unverified plaintext is released.

Universal Forgery Attack Against GCM-RUP

“…In this paper we describe a universal forgery attack against GCM-RUP with time and data complexity close to 2 n/2 , where n denotes the block size of the underlying block cipher. This attack matches the security proof given in [2], showing that it is tight. However, our main result is not only about tightness of the (birthday) security bound, but rather about how badly the construction of GCM-RUP breaks when the bound is reached: a universal forgery attack is much stronger than a distinguishing attack.…”

“…This paper shows a birthday-bound attack against GCM-RUP [2] using inner collisions to recover the output difference of the function GHASH K2 . Hence, K 2 can be retrieved by solving a polynomial equation, and this directly leads to a universal forgery attack against GCM-RUP.…”

“…Ashur, Dunkelman and Luykx proposed a generic construction of an efficient separated AE scheme at CRYPTO'17 [2]. Their construction uses an encryption scheme and a TBC, and achives security in the RUP setting, assuming that the encryption scheme is strongly indistinguishable-from-random-bits (SRND) [13,30], and the TBC is a strong pseudorandom permutation (SPRP) [30].…”

“…In 2015, Gueron et al presented GCM-SIV [12] combining GCM's underlying components with the SIV paradigm designed by Rogaway and Shrimpton [29], to provide nonce-misuse resistance. Later, at CRYPTO'17, Ashur et al introduced a generic construction of AE scheme using a tweakable block cipher (TBC), which resists attacks in the RUP setting [2] (with Release of Unverified Plaintext). Based on the generic AE scheme, an instantiation GCM-RUP with highefficiency is put forward using AES-GCM's components.…”

Release of Unverified Plaintext: Tight Unified Model and Application to ANYDAE

“…In the model of RUP security, the adversary turns out to have significantly more power: since the introduction of the model, various schemes have been forged in the RUP model [CDN16,DLMN17,IMI18], and schemes that have been proven to achieve RUP authenticity often come at a cost [ZWH + 17, HSY17,ADL17]. For plaintext awareness, the situation is even more poignant: the model is often ignored, which arguably comes from the fact that the model is more complicated (it requires the description of a simulator).…”