How to Incorporate Associated Data in Sponge-Based Authenticated Encryption

Sasaki, Yu; Yasuda, Kan

doi:10.1007/978-3-319-16715-2_19

Cited by 14 publications

(15 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…AD denotes data that is authenticated, but not encrypted. It has been shown by Mennink et al [35] as well as Sasaki and Yasuda [38] that it is secure to absorb AD into the capacity of a keyed sponge. Considering that the construction in Figure 6 is a keyed full-state duplex sponge construction, it is therefore secure to inject the patch values into the capacity.…”

Section: Constructionsmentioning

confidence: 98%

Sponge-Based Control-Flow Protection for IoT Devices

Werner

Unterluggauer

Schaffenrath

et al. 2018

2018 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

Embedded devices in the Internet of Things (IoT) face a wide variety of security challenges. For example, software attackers perform code injection and code-reuse attacks on their remote interfaces, and physical access to IoT devices allows to tamper with code in memory, steal confidential Intellectual Property (IP), or mount fault attacks to manipulate a CPU's control flow.In this work, we present Sponge-based Control Flow Protection (SCFP). SCFP is a stateful, sponge-based scheme to ensure the confidentiality of software IP and its authentic execution on IoT devices. At compile time, SCFP encrypts and authenticates software with instruction-level granularity. During execution, an SCFP hardware extension between the CPU's fetch and decode stage continuously decrypts and authenticates instructions. Sponge-based authenticated encryption in SCFP yields fine-grained control-flow integrity and thus prevents code-reuse, code-injection, and fault attacks on the code and the control flow. In addition, SCFP withstands any modification of software in memory. For evaluation, we extended a RISC-V core with SCFP and fabricated a real System on Chip (SoC). The average overhead in code size and execution time of SCFP on this design is 19.8 % and 9.1 %, respectively, and thus meets the requirements of embedded IoT devices.

show abstract

Section: Constructionsmentioning

confidence: 98%

Sponge-Based Control-Flow Protection for IoT Devices

Werner

Unterluggauer

Schaffenrath

et al. 2018

2018 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

show abstract

“…From a more general perspective, the work has triggered analysis in the direction of high-efficiency full-state keyed Duplexes [31,60,89]. The result of Mennink et al [60] on the full-state keyed Duplex has triggered the designers of Keyak to perform a major revision to their scheme.…”

Section: Publication History and Subsequent Workmentioning

confidence: 99%

Beyond Conventional Security in Sponge-Based Authenticated Encryption Modes

et al. 2018

Self Cite

View full text Add to dashboard Cite

Abstract. The Sponge function is known to achieve 2 c/2 security, where c is its capacity. This bound was carried over to its keyed variants, such as SpongeWrap, to achieve a min{2 c/2 , 2 κ } security bound, with κ the key length. Similarly, many CAESAR competition submissions were designed to comply with the classical 2 c/2 security bound. We show that Sponge-based constructions for authenticated encryption can achieve the significantly higher bound of min{2 b/2 , 2 c , 2 κ }, with b > c the permutation size, by proving that the CAESAR submission NORX achieves this bound. The proof relies on rigorous computation of multi-collision probabilities, which may be of independent interest. We additionally derive a generic attack based on multi-collisions that matches the bound. We show how to apply the proof to five other Sponge-based CAESAR submissions: Ascon, CBEAM/STRIBOB, ICEPOLE, Keyak, and two out of the three PRIMATEs. A direct application of the result shows that the parameter choices of some of these submissions are overly conservative. Simple tweaks render the schemes considerably more efficient without sacrificing security. We finally consider the remaining one of the three PRIMATEs, APE, and derive a blockwise adaptive attack in the noncerespecting setting with complexity 2 c/2 , therewith demonstrating that the techniques cannot be applied to APE.

show abstract

“…The recent line of research on improving bounds of spongeinspired authenticated encryption schemes, set by Jovanovic et al [35], Sasaki and Yasuda [46], and Reyhanitabar et al [44], can be seen as an analysis of a specific use case of the keyed duplex. The Full-State SpongeWrap [38], an authenticated encryption scheme designed from the full-state keyed duplex, improves over these results.…”

Section: Introductionmentioning

confidence: 99%

Full-State Keyed Duplex with Built-In Multi-user Support

Daemen

Mennink

Assche

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The keyed duplex construction was introduced by Bertoni et al. (SAC 2011) and recently generalized to full-state absorption by Mennink et al. (ASIACRYPT 2015). We present a generalization of the full-state keyed duplex that natively supports multiple instances by design, and perform a security analysis that improves over that of Mennink et al. in terms of a more modular security analysis and a stronger and more adaptive security bound. Via the introduction of an additional parameter to the analysis, our bound demonstrates a significant security improvement in case of nonce-respecting adversaries. Furthermore, by supporting multiple instances by design, instead of adapting the security model to it, we manage to derive a security bound that is largely independent of the number of instances.

show abstract

How to Incorporate Associated Data in Sponge-Based Authenticated Encryption

Cited by 14 publications

References 10 publications

Sponge-Based Control-Flow Protection for IoT Devices

Sponge-Based Control-Flow Protection for IoT Devices

Beyond Conventional Security in Sponge-Based Authenticated Encryption Modes

Full-State Keyed Duplex with Built-In Multi-user Support

Contact Info

Product

Resources

About