ELmE: A Misuse Resistant Parallel Authenticated Encryption

Abstract

Abstract. The authenticated encryptions which resist misuse of initial value (or nonce) at some desired level of privacy are two-pass or Macthen-Encrypt constructions (inherently inefficient but provide full privacy) and online constructions, e.g., McOE, sponge-type authenticated encryptions (such as duplex, AEGIS) and COPA. Only the last one is almost parallelizable with some bottleneck in processing associated data. In this paper, we design a new online secure authenticated encryption, called ELmE or Encrypt-Linear mix-Encrypt, which is completely (twostage) parallel (even in associated data) and pipeline implementable. It also provides full privacy when associated data (which includes initial value) is not repeated. The basic idea of our construction and COPA are based on EME, an Encrypt-Mix-Encrypt type SPRP constructions (secure against chosen plaintext and ciphertext). Unlike EME, we consider online computable efficient linear mixing. Our construction optionally supports intermediate tags, which can be verified faster with less buffer size to provide security against block-wise adversaries which is meaningful in low-end device implementation.

Connecting tweakable and multi-key blockcipher security

“…5.4, establishing a 2 rn/(r +1) bound for any r , as long as the universal hash function is replaced by a uniform random function, and the adversaries use a limited number of tweaks. In applications where the number of tweaks can be limited to a small number, as might, for example, be the case in certain authenticated encryption schemes [2,26,68], our newly obtained bound on TEM[r ] improves over the state of the art, and even solves the conjecture by Cogliati et al in 2015 [21] for the specific case of uniformly random masking. The replacement of the universal hash function by a uniform random function may in certain settings by a burden, but this condition allows us to make a first step towards solving this conjecture for general masking.…”

“…On the one hand, the parameter often plays a significant role in the security bounds, while on the other hand, the values and are often close to each other, and differ at most by a multiplicative constant. For example, for COPA [2], ELmE [26], and SCT [68], we have ≈ 2 .…”

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

“…This step usually costs Adv srkprp Φ,E (D), where D is some strong related-key PRP distinguisher with a certain amount of resources, usually q queries to the keyed oracle E φ(k) and τ time, and Φ is the set of related-key deriving functions φ that D is allowed to choose. This reduction is in fact also broadly used beyond the area of tweakable blockciphers, such as in authenticated encryption schemes [1,3,11,21,28,33,37,44,50,51] and message authentication codes [4,13,16,24,29,30,41,47,[57][58][59], and in fact, we are not aware of any security result of a construction based on a standard-model blockcipher that uses a structurally different approach. Inspired by this, we investigate what level of tweakable blockcipher security can be achieved if this proof technique is employed.…”

Characterization of EME with Linear Mixing

“…Such constructions are very efficient as it doesn't use any non-linear functions and the mode is parallelizable. Infact some of the existing constructions like ELmE [2] and COPA [1] uses this kind of structure (EME with Olmix) as the underlying structure to make the construction online, fully pipelined implementable.…”