CLOC: Authenticated Encryption for Short Input

Iwata, Tetsu; Minematsu, Kazuhiko; Guo, Jian; Morioka, Sumio

doi:10.1007/978-3-662-46706-0_8

Cited by 33 publications

(38 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section we give a very brief description of CLOC and we follow the same notations and variable names as described in [25]. As described by the author, CLOC has several variants based on three parameters, the underlying block cipher E k of length n bits, nonce length N bits and tag length τ bits.…”

Section: Description Of Clocmentioning

confidence: 99%

“…We purposefully ignored the ozp, msb, h, g 1 , g 2 , and f 2 functions in [25], as they have no effect on attack and are not needed. We also assume that i, f 1 , f ix0, and f ix1 are public reversible permutations.…”

Section: Description Of Clocmentioning

confidence: 99%

“…The description of SILC described in [24] is almost the same as that of CLOC except the H ash k algorithm. The algorithm is described in Fig.…”

Section: Description Of Silcmentioning

confidence: 99%

“…CLOC [25] and SILC [24] are two of the candidates in the CAESAR [1] competition, a competition which attempts to standardize some efficient AEAD schemes. CLOC is an online authenticated encryption scheme which uses CFB block cipher mode of operation with the underlying block ciphers AES-128 [14,15] and TWINE-80 [32].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Two Efficient Fault-Based Attacks on CLOC and SILC

et al. 2017

View full text Add to dashboard Cite

CLOC and SILC are two block cipher-based authenticated encryption schemes, submitted to the CAE-SAR competition, that aims to use low area buffer and handle short input efficiently. The designers of CLOC and SILC claimed n 2 -bit integrity security against nonce-reusing adversaries, where n is the blockcipher state size in bits. In this paper, we present single fault-based almost universal forgeries on both CLOC and SILC with only one single bit fault at a fixed position of a specific blockcipher input. In the case of CLOC, the forgery can be done for almost any nonce, associated data and message triplet, except some nominal restrictions on associated data. In the case of SILC, the forgery can be done for almost any associated data and message, except some nominal restrictions on associated data along with a fixed nonce. Both the attacks on CLOC and SILC require several nonce-misusing encryption queries This attack is independent of the underlying block cipher and works on the encryption mode. In this paper, we also validate the proposed fault-based forgery methodology by performing actual fault attacks by electromagnetic pulse injection which shows practicality of the proposed forgery procedure. Next, we provide updated constructions that can resist the fault-based forgery on the mode assuming the underlying block cipher is fault resistant. Finally, we show that, if the underlying block cipher is not fault resistant, then for both CLOC and SILC, the key recovery can be done by injecting fault into the block cipher operations. We have considered the example with AES as the underlying block cipher. We would like to note that our attacks do not violate the designers' claims as our attacks require fault. However, it shows some vulnerability of the schemes when fault is feasible.

show abstract

Section: Description Of Clocmentioning

confidence: 99%

Section: Description Of Clocmentioning

confidence: 99%

“…The description of SILC described in [24] is almost the same as that of CLOC except the H ash k algorithm. The algorithm is described in Fig.…”

Section: Description Of Silcmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Two Efficient Fault-Based Attacks on CLOC and SILC

et al. 2017

View full text Add to dashboard Cite

show abstract

“…Some of the recent works on AEAD schemes are the proposals CLOC [32], SILC [33] and OTR [46]. Another recent proposal is COBRA [2], but, a serious flaw has been pointed out in the construction by Nandi [49].…”

Section: Aead Schemesmentioning

confidence: 99%

On modes of operations of a block cipher for authentication and authenticated encryption

Chakraborty

Sarkar

2015

Cryptogr. Commun.

View full text Add to dashboard Cite

Abstract. This work deals with the various requirements of encryption and authentication in cryptographic applications. The approach is to construct suitable modes of operations of a block cipher to achieve the relevant goals. A variety of schemes suitable for specific applications are presented. While none of the schemes are built completely from scratch, there is a common unifying framework which connects them. All the schemes described have been implemented and the implementation details are publicly available. Performance figures are presented when the block cipher is the AES and the Intel AES-NI instructions are used. These figures suggest that the constructions presented here compare well with previous works such as the famous OCB mode of operation. In terms of features, the constructions provide several new offerings which are not present in earlier works. This work significantly widens the range of choices of an actual designer of cryptographic system.

show abstract