COBRA: A Parallelizable Authenticated Online Cipher Without Block Cipher Inverse

Abstract

Abstract. We present a new, misuse-resistant scheme for online authenticated encryption, following the framework set forth by Fleischmann et al. (FSE 2012). Our scheme, COBRA, is roughly as efficient as the GCM mode of operation for nonce-based authenticated encryption, performing one block cipher call plus one finite field multiplication per message block in a parallelizable way. The major difference from GCM is that COBRA preserves privacy up to prefix under nonce repetition. However, COBRA only provides authenticity against nonce-respecting adversaries. As compared to COPA (ASIACRYPT 2013), our new scheme requires no block cipher inverse and hence enjoys provable security under a weaker assumption about the underlying block cipher. In addition, COBRA can possibly perform better than COPA on platforms where finite field multiplication can be implemented faster than the block cipher in use, since COBRA essentially replaces half of the block cipher calls in COPA with finite field multiplications.

Forging Attacks on Two Authenticated Encryption Schemes COBRA and POET

“…In fact, the attack works for the mode COBRA based on any blockcipher. Thus it disproves the claim stated in [4]. The authenticity advantage of our proposed algorithm is about 1/2 and it makes about 2n encryption queries where n is the plaintext size of the underlying blockcipher.…”

“…In this paper, we demonstrate forging attack on COBRA with practical complexity. Hence the theorem proved in [4] is wrong. We also demonstrate forging and distinguishing attack on POET-m for one particular recommended choice of AXU hash function.…”

“…COBRA is an authenticated encryption mode based on blockcipher. It was originally published in FSE 2014 [4]. Later the same mode with AES as the underlying blockcipher, called AES-COBRA, was submitted to CAESAR [1].…”

“…We simply denote the tag by T (N, U, S). One can find the details of the construction of T in [1,4]. The verified decryption algorithm takes a tagged ciphertext (C 1 , .…”

Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance

“…However it also renders a compliant scheme vulnerable to CCA, CPSS, and NM attacks even if AD values are unique. Schemes1: COBRA [11] OAE1c Leaks equality of any blocks at the same position. E.g., if ciphertexts and ′ arise from 4-block plaintexts = A ‖ B ‖ C ‖ D and…”