Sponges Resist Leakage: The Case of Authenticated Encryption

Abstract

In this work we advance the study of leakage-resilient Authenticated Encryption with Associated Data (AEAD) and lay the theoretical groundwork for building such schemes from sponges. Building on the work of Barwell et al. (ASIACRYPT 2017), we reduce the problem of constructing leakage-resilient AEAD schemes to that of building fixed-input-length function families that retain pseudorandomness and unpredictability in the presence of leakage. Notably, neither property is implied by the other in the leakage-resilient setting. We then show that such a function family can be combined with standard primitives, namely a pseudorandom generator and a collision-resistant hash, to yield a nonce-based AEAD scheme. In addition, our construction is quite efficient in that it requires only two calls to this leakage-resilient function per encryption or decryption call. This construction can be instantiated entirely from the T-sponge to yield a concrete AEAD scheme which we call Slae. We prove this sponge-based instantiation secure in the non-adaptive leakage setting. Slae bears many similarities and is indeed inspired by Isap, which was proposed by Dobraunig et al. at FSE 2017. However, while retaining most of the practical advantages of Isap, Slae additionally benefits from a formal security treatment. A.1 Standard Cryptographic PrimitivesWe make use of the following definition of a pseudorandom generator. Note that our syntax defines a pseudorandom generator with variable output length, where the output length (in bits) is specified as part of the input. In addition, in our security definition we allow the adversary to make multiple queries to the challenge oracle G.Definition 6 (Pseudorandom Generators). Let G : S × N → {0, 1} * be a pseudorandom generator with an associated seed space S, and let the PRG game be as defined in Fig. 16. Then for any adversary A, its corresponding PRG advantage is given by:We define collision-resistant hash functions over a generic domain X . Letting X = {0, 1} * results in the usual syntax but we can also, for instance, model a vector hash function over a triple of strings by setting X = {0, 1} * × {0, 1} * × {0, 1} * . For simplicity we only consider the random transformation model. Definition 7 (Collision-Resistant Hash Functions).Let H : X → {0, 1} w be a hash function constructed from a random transformation ρ, with domain X and output length w . Then for any adversary A with oracle access to ρ, its corresponding advantage is given by:Adv cr H (A) = 2 Pr[(X 0 , X 1 ) ← A ρ : H(X 0 ) = H(X 1 ) ∧ X 0 = X 1 ∧ X 0 , X 1 ∈ X ] .

Retrofitting Leakage Resilient Authenticated Encryption to Microcontrollers

“…For our use case, we use a composition scheme that can be instantiated using existing hardware accelerators and make use of the results of Krämer and Struck [KS20]. In their work they revisit the so called F GHF construction that was proposed by Degabriele et al [DJS19] in the context of sponge based constructions. The F GHF construction is an LR-AEAD scheme and comprises four building blocks: Two functions F and F , a PRG G and a hash function H. In order for the construction to be leakage resilient, the security analysis of Degabriele et al originally requires both F and F to be pseudorandom under leakage and F to be unpredictable under leakage in addition 2 .…”

“…We specifically describe the partitioning between software and hardware accelerators. Second, we describe how to use this protected building block together with an LR-PRG and hash function in the LR-AEAD scheme of Degabriele et al [DJS19]. We provide pseudo code for all operations and point out the security critical operations which we analyze in the side-channel evaluation in Sec.…”

SCA secure and updatable crypto engines for FPGA SoC bitstream decryption: extended version

“…To assess the suitability of the PUF architecture for our side-channel protected secure boot design, a 256-bit output of the core PUF module was generated for testing prior to error correction being applied 5 . This output was regenerated 1001 times at room temperature for each of 20 Xilinx Zynq-7000 devices.…”

“…While not implemented here, using a simple (3, 1, 3) repetition code concatenated with the Golay encoder brings P total down to 3.26 × 10 −8 , trading off additional hardware requirements for the increased reliability. Alternatively, multiple PUF readouts could be taken with a 5 The 256-bit output is for testing purposes only, the full design requires 498 PUF cells. majority vote applied to determine the PUF response.…”

“…Instead, we implement a LR-AEAD scheme based on the results of Krämer and Struck [21] who propose that a LR-AEAD scheme can be built using a LR-PRF, a leakage resilient PRG (LR-PRG) and a hash function. In reference to the introduction of this scheme in [5] we refer to it as FG H F -based LR-AEAD and to our original scheme as AES-OFB-based LR-AEAD. Figure 7 shows the hardware/software partitioning and the building blocks for the proposed FG H F -based LR-AEAD scheme.…”