Salvaging Weak Security Bounds for Blockcipher-Based Constructions

Shrimpton, Thomas; Terashima, R. Seth

doi:10.1007/978-3-662-53887-6_16

Cited by 15 publications

(9 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is for instance the case for Men2, where the ideal-model results seem more representative than the standard-model ones. A similar observation was made by Shrimpton and Terashima [55], who introduce the ideal model under key-oblivious access as a weakened version of the ideal cipher model. As a general rule, it is always wise to interpret security results in any of the models with care.…”

Section: Generalizedsupporting

confidence: 64%

See 1 more Smart Citation

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Mennink

2017

Advances in Cryptology – CRYPTO 2017

View full text Add to dashboard Cite

Abstract. Two types of tweakable blockciphers based on classical blockciphers have been presented over the last years: non-tweak-rekeyable and tweak-rekeyable, depending on whether the tweak may influence the key input to the underlying blockcipher. In the former direction, the best possible security is conjectured to be 2 σn/(σ+1) , where n is the size of the blockcipher and σ is the number of blockcipher calls. In the latter direction, Mennink and Wang et al. presented optimally secure schemes, but only in the ideal cipher model. We investigate the possibility to construct a tweak-rekeyable cipher that achieves optimal security in the standard cipher model. As a first step, we note that all standard-model security results in literature implicitly rely on a generic standard-to-ideal transformation, that replaces all keyed blockcipher calls by random secret permutations, at the cost of the security of the blockcipher. Then, we prove that if this proof technique is adopted, tweak-rekeying will not help in achieving optimal security: if 2 σn/(σ+1) is the best one can get without tweak-rekeying, optimal 2 n provable security with tweak-rekeying is impossible.

show abstract

Section: Generalizedsupporting

confidence: 64%

“…For different schemes, it may be the other way around. A potential approach to go is to weaken the ideal-model, an approach for instance followed by Shrimpton and Terashima [55], yet, this approach is ultimately still an ideal-model approach.…”

Section: How Do the Standard And Ideal Model Compare And What Are Thmentioning

confidence: 99%

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Mennink

2017

Advances in Cryptology – CRYPTO 2017

View full text Add to dashboard Cite

show abstract

“…This mode works with an n-bit key that is then used to generate a fresh key for the second cipher. It is known that BBB proofs for such rekeying-based modes have to rely on the Ideal Cipher Model (ICM) [BKR98,ST16,Men17]. Therefore, we follow this and prove RHM H,E unforgeable against leakage up to asymptotically optimal 2 n /n queries.…”

Section: Introductionmentioning

confidence: 89%

Efficient Side-Channel Secure Message Authentication with Better Bounds

Guo

Standaert²,

Wang

et al. 2020

ToSC

View full text Add to dashboard Cite

We investigate constructing message authentication schemes from symmetric cryptographic primitives, with the goal of achieving security when most intermediate values during tag computation and verification are leaked (i.e., mode-level leakage-resilience). Existing efficient proposals typically follow the plain Hash-then-MAC paradigm T = TGenK(H(M)). When the domain of the MAC function TGenK is {0, 1}128, e.g., when instantiated with the AES, forgery is possible within time 264 and data complexity 1. To dismiss such cheap attacks, we propose two modes: LRW1-based Hash-then-MAC (LRWHM) that is built upon the LRW1 tweakable blockcipher of Liskov, Rivest, and Wagner, and Rekeying Hash-then-MAC (RHM) that employs internal rekeying. Built upon secure AES implementations, LRWHM is provably secure up to (beyond-birthday) 278.3 time complexity, while RHM is provably secure up to 2121 time. Thus in practice, their main security threat is expected to be side-channel key recovery attacks against the AES implementations. Finally, we benchmark the performance of instances of our modes based on the AES and SHA3 and confirm their efficiency.

show abstract

“…This term comes from the construction of XKX, where q-blockcipher's keys are defined via the first tweak function. As mentioned in [ST16], the hybrid factor is not real, but rather an artifact of the proof technique, and this term might be improved by analyzing the term in the ideal cipher model (ICM). On the other hand, the ICM analysis provides only a security heuristic, and seems particularly inappropriate when the underlying blockcipher is know to have obvious non-ideal behavior for certain weak-key class matters, or to suffer from related-key attack.…”

Section: Study Of the Key Terms Q • Adv Sprp E (A E ) And Adv Prf F (mentioning

confidence: 99%

Tweakable Blockciphers for Efficient Authenticated Encryptions with Beyond the Birthday-Bound Security

Naito¹

2017

ToSC

View full text Add to dashboard Cite

Modular design via a tweakable blockcipher (TBC) offers efficient authenticated encryption (AE) schemes (with associated data) that call a blockcipher once for each data block (of associated data or a plaintext). However, the existing efficient blockcipher-based TBCs are secure up to the birthday bound, where the underlying keyed blockcipher is a secure strong pseudorandom permutation. Existing blockcipher-based AE schemes with beyond-birthday-bound (BBB) security are not efficient, that is, a blockcipher is called twice or more for each data block. In this paper, we present a TBC, XKX, that offers efficient blockcipher-based AE schemes with BBB security, by combining with efficient TBC-based AE schemes such as ΘCB3 and

show abstract

Salvaging Weak Security Bounds for Blockcipher-Based Constructions

Cited by 15 publications

References 16 publications

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

Efficient Side-Channel Secure Message Authentication with Better Bounds

Tweakable Blockciphers for Efficient Authenticated Encryptions with Beyond the Birthday-Bound Security

Contact Info

Product

Resources

About