Forging Attacks on Two Authenticated Encryption Schemes COBRA and POET

Abstract

In FSE 2014, an authenticated encryption mode COBRA [4], based on pseudorandom permutation (PRP) blockcipher, and POET [3], based on Almost XOR-Universal (AXU) hash and strong pseudorandom permutation (SPRP), were proposed. Few weeks later, COBRA mode and a simple variant of the original proposal of POET (due to a forging attack [13] on the original proposal) with AES as an underlying blockcipher, were submitted to CAESAR, a competition [1] of authenticated encryption (AE). In this paper, we show a forging attack on the mode COBRA based on any n-bit blockcipher. Our attack on COBRA requires about O(n) queries with success probability of about 1/2. This disproves the claim proved in the FSE 2014 paper. We also show both privacy and forging attack on the parallel version of POET, denoted POET-m. In case of the modes POET and POE (the underlying modes for encryption), we demonstrate a distinguishing attack making only one encryption query when we instantiate the underlying AXU hash function with some other AXU hash function, namely a uniform random involution. Thus, our result violates the designer's main claim (Theorem 8.1 in [1]). However, the attacks can not be extended to the specifications of POET submitted to the CAESAR competition.

Combiners for AEAD

“…A prime example of where the security argument of an intricate AEAD scheme turned out to be fatally flawed, and this went unnoticed for a rather long period of time, is given by the recent results on OCB2 that completely broke the scheme [IIMP19]. There are several similar cases to report on, including the flawed EAX' scheme [MLMI14], a flawed argument in the security proof of GCM [IOM12], and flaws in some of the CAESAR submissions [Nan14,BS16,SMAP16].…”

Avalanche Effect in Improperly Initialized CAESAR Candidates

“…For example, R. Ankele in his Ph.D. thesis [2] analyses the COPA authenticated encryption composition scheme used in several CAESAR candidates. M. Nandi in his 2014 paper [13] demonstrates a forging attack on COBRA and POET ciphers.…”

Survey on cyberspace security

“…Since then, many authentication encryption schemes have been proposed, such as ALE, FIDES, and AEZ [36][37][38][39][40][41][42]. However, no one has yet completely mastered all the security issues in this emerging field, and a number of security problems [43][44][45][46] have emerged. Research on authentication encryption is likely to become one of the most popular research directions in the coming years.…”