Improved Masking for Tweakable Blockciphers with Applications to Authenticated Encryption

Granger, Robert; Jovanovic, Philipp; Mennink, Bart; Neves, Samuel

doi:10.1007/978-3-662-49890-3_11

Cited by 66 publications

(72 citation statements)

References 61 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These constructions only achieve birthday bound security. A novel approach is to build tweakable blockciphers from public permutations, as is done by Sasaki et al [52], Cogliati et al [17,18], Granger et al [27], and Mennink [40]. This approach achieves comparable levels of security to the nontweak-rekeyable schemes of above, but the security analysis is inherently done in the ideal permutation model.…”

Section: Other Ways Of Tweakable Blockcipher Designmentioning

confidence: 99%

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Mennink

2017

Advances in Cryptology – CRYPTO 2017

Self Cite

View full text Add to dashboard Cite

Abstract. Two types of tweakable blockciphers based on classical blockciphers have been presented over the last years: non-tweak-rekeyable and tweak-rekeyable, depending on whether the tweak may influence the key input to the underlying blockcipher. In the former direction, the best possible security is conjectured to be 2 σn/(σ+1) , where n is the size of the blockcipher and σ is the number of blockcipher calls. In the latter direction, Mennink and Wang et al. presented optimally secure schemes, but only in the ideal cipher model. We investigate the possibility to construct a tweak-rekeyable cipher that achieves optimal security in the standard cipher model. As a first step, we note that all standard-model security results in literature implicitly rely on a generic standard-to-ideal transformation, that replaces all keyed blockcipher calls by random secret permutations, at the cost of the security of the blockcipher. Then, we prove that if this proof technique is adopted, tweak-rekeying will not help in achieving optimal security: if 2 σn/(σ+1) is the best one can get without tweak-rekeying, optimal 2 n provable security with tweak-rekeying is impossible.

show abstract

Section: Other Ways Of Tweakable Blockcipher Designmentioning

confidence: 99%

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Mennink

2017

Advances in Cryptology – CRYPTO 2017

Self Cite

View full text Add to dashboard Cite

show abstract

“…Further constructions related to TEM[r ], and to which our findings can be applied as well, are XPX [59], MEM [37], and a variant of TEM [4] with linear mixing [20].…”

Section: Note That Tem[r ] Is In Fact the Em[r ] Construction Where Tmentioning

confidence: 99%

“…, P r . This step costs at most r · Adv Further constructions related to LRW [1] include the XEX construction [71] and its generalizations [18,37,62], tweakable Feistel schemes [36,60], and tweakable blockciphers with tweak-dependent rekeying [58,61,63].…”

Section: Iterated Lrwmentioning

confidence: 99%

Connecting tweakable and multi-key blockcipher security

Lee

Luykx

Mennink

et al. 2017

Des. Codes Cryptogr.

Self Cite

View full text Add to dashboard Cite

The significance of understanding blockcipher security in the multi-key setting is highlighted by the extensive literature on attacks, and how effective key size can be significantly reduced. Nevertheless, little attention has been paid in formally understanding the design of multi-key secure blockciphers. In this work, we formalize the multi-key security of tweakable blockciphers in case of general key derivation functions. We show an equivalence between blockcipher multi-key security and tweakable blockcipher security. Our equivalence connects two objects of study, the iterated Even-Mansour (EUROCRYPT 2012) and the iterated Tweakable Even-Mansour (CRYPTO 2015), which establishes that results in both areas are, to a certain extent, transferable. Using our novel equivalence relation, we derive new bounds for both constructions, pave the path towards the solution of two wellstudied conjectures, and show that, contrary to common knowledge, key derivation functions need not necessarily be pseudorandom functions in order to provide security: for the iterated Even-Mansour universal hash functions suffice.

show abstract

“…The most important difference between [31,60] and our work is that we explicitly target nonce-based designs, and this allows for beyond 2 c/2 security. The work has, to certain extent, furthermore triggered the use of permutations for nonce-reuse secure authenticated encryption schemes [29,44,59] beyond APE.…”

Section: Publication History and Subsequent Workmentioning

confidence: 99%

Beyond Conventional Security in Sponge-Based Authenticated Encryption Modes

et al. 2018

Self Cite

View full text Add to dashboard Cite

Abstract. The Sponge function is known to achieve 2 c/2 security, where c is its capacity. This bound was carried over to its keyed variants, such as SpongeWrap, to achieve a min{2 c/2 , 2 κ } security bound, with κ the key length. Similarly, many CAESAR competition submissions were designed to comply with the classical 2 c/2 security bound. We show that Sponge-based constructions for authenticated encryption can achieve the significantly higher bound of min{2 b/2 , 2 c , 2 κ }, with b > c the permutation size, by proving that the CAESAR submission NORX achieves this bound. The proof relies on rigorous computation of multi-collision probabilities, which may be of independent interest. We additionally derive a generic attack based on multi-collisions that matches the bound. We show how to apply the proof to five other Sponge-based CAESAR submissions: Ascon, CBEAM/STRIBOB, ICEPOLE, Keyak, and two out of the three PRIMATEs. A direct application of the result shows that the parameter choices of some of these submissions are overly conservative. Simple tweaks render the schemes considerably more efficient without sacrificing security. We finally consider the remaining one of the three PRIMATEs, APE, and derive a blockwise adaptive attack in the noncerespecting setting with complexity 2 c/2 , therewith demonstrating that the techniques cannot be applied to APE.

show abstract

Improved Masking for Tweakable Blockciphers with Applications to Authenticated Encryption

Cited by 66 publications

References 61 publications

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Connecting tweakable and multi-key blockcipher security

Beyond Conventional Security in Sponge-Based Authenticated Encryption Modes

Contact Info

Product

Resources

About