Tweakable Blockciphers for Efficient Authenticated Encryptions with Beyond the Birthday-Bound Security

Naito, Yoshiro

doi:10.46586/tosc.v2017.i2.1-26

Cited by 20 publications

(8 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From the perspective of the design idea, at the beginning, COPA-PIC is designed in terms of tweakable blockciphers (TBCs), as TBC-based AE modes have more advantages than AE modes based on other primitives; particularly, their structure is clear and their proof is simple [19,22,[28][29][30][31]. In addition, TBCs can also be constructed by distinct primitives.…”

Section: Our Contributionsmentioning

confidence: 99%

Polynomial Intermediate Checksum for Integrity under Releasing Unverified Plaintext and Its Application to COPA

Zhang

2024

Mathematics

View full text Add to dashboard Cite

COPA, introduced by Andreeva et al., is the first online authenticated encryption (AE) mode with nonce-misuse resistance, and it is covered in COLM, which is one of the final CAESAR portfolios. However, COPA has been proven to be insecure in the releasing unverified plaintext (RUP) setting. This paper mainly focuses on the integrity under RUP (INT-RUP) defect of COPA. Firstly, this paper revisits the INT-RUP security model for adaptive adversaries, investigates the possible factors of INT-RUP insecurity for “Encryption-Mix-Encryption”-type checksum-based AE schemes, and finds that these AE schemes with INT-RUP security vulnerabilities utilize a common poor checksum technique. Then, this paper introduces an improved checksum technique named polynomial intermediate checksum (PIC) for INT-RUP security and emphasizes that PIC is a sufficient condition for guaranteeing INT-RUP security for “Encryption-Mix-Encryption”-type checksum-based AE schemes. PIC is generated by a polynomial sum with full terms of intermediate internal states, which guarantees no information leakage. Moreover, PIC ensures the same level between the plaintext and the ciphertext, which guarantees that the adversary cannot obtain any useful information from the unverified decryption queries. Again, based on PIC, this paper proposes a modified scheme COPA-PIC to fix the INT-RUP defect of COPA. COPA-PIC is proven to be INT-RUP up to the birthday-bound security if the underlying primitive is secure. Finally, this paper discusses the properties of COPA-PIC and makes a comparison for AE modes with distinct checksum techniques. The proposed work is of good practical significance. In an interactive system where two parties communicate, the receiver can effectively determine whether the information received from the sender is valid or not, and thus perform the subsequent operation more effectively.

show abstract

Section: Our Contributionsmentioning

confidence: 99%

Polynomial Intermediate Checksum for Integrity under Releasing Unverified Plaintext and Its Application to COPA

Zhang

2024

Mathematics

View full text Add to dashboard Cite

show abstract

“…Here, K is an intermediate block cipher key determined by all but the last eight bits of the nonce, and Y is generated using K with the tweakable block cipher of Liskov, Rivest and Wagner used in counter mode with the last eight bits of the nonce as the initialization vector [7]. This is essentially using Naito's XKX beyond-birthday bound tweakable block cipher construction in counter-mode with a performance enhancement [8]. The XKX construction rekeys the block cipher for every nonce.…”

Section: Hashstream Constructionsmentioning

confidence: 99%

“…This construction, however, suffers too badly from a birthday bound. To improve security, we adopt the strategy, reported by Naito, of changing the block cipher key with changes in the nonce [8]. To avoid updating the internal block cipher key with every application of Hashstream, we only update it when there are changes to the nonce outside the low eight bits.…”

Section: Hashstream Securitymentioning

confidence: 99%

“…#include <stdint.h> #include <stdlib.h> #include <string.h> #include "hashstream.h" /* - -----------------------------------------------------------------------* [16]); void ChaCha20_ctr32(unsigned char *out, const unsigned char *inp, size_t len, const uint32_t key [8], const uint32_t counter [4]); /* ------------------------------------------------------------------------*/ /* Each field is at least 8B aligned for both stack and malloc allocation. */ struct _hs_ctx { uint64_t nonce [2]; /* mem order, uint64_t forces 8B align */ uint8_t hashkey [16];…”

Section: Appendix B Sample Implementation: Hashstream/pcmentioning

confidence: 99%

See 1 more Smart Citation

The Definition and Software Performance of Hashstream, a Fast Length-Flexible PRF

Krovetz

2018

Cryptography

View full text Add to dashboard Cite

Two of the fastest types of cryptographic algorithms are the stream cipher and the almost-universal hash function. There are secure examples of each that process data in software using less than one CPU cycle per byte. Hashstream combines the two types of algorithms in a straightforward manner yielding a PRF that can both consume inputs of and produce pseudorandom outputs of any desired length. The result is an object useful in many contexts: authentication, encryption, authenticated encryption, random generation, mask generation, etc. The HS1-SIV authenticated-encryption algorithm—a CAESAR competition second round selection—was based on Hashstream and showed the promise of such an approach by having provable security and topping the speed charts in several test configurations.

show abstract

“…In addition, on-the-fly key scheduling should be implemented in resource-constrained devices because offline key scheduling implementation requires additional memory to store expanded round keys. Moreover, on-thefly key scheduling is sometimes more important when implementing block cipher with a tweak [4] (e.g., used in authenticated encryption), in some of which temporal key is generated using a master key and a tweak unique for each block [5], [6]. Thus, it would be valuable to develop efficient AES architectures with on-the-fly key scheduling without block-wise pipelining techniques.…”

Section: Introductionmentioning

confidence: 99%

High Throughput/Gate AES Hardware Architectures Based on Datapath Compression

Ueno

Homma²,

Morioka

et al. 2020

IEEE Trans. Comput.

View full text Add to dashboard Cite

This article proposes highly efficient Advanced Encryption Standard (AES) hardware architectures that support encryption and both encryption and decryption. New operation-reordering and register-retiming techniques presented in this article allow us to unify the inversion circuits in SubBytes and InvSubBytes without any delay overhead. In addition, a new optimization technique for minimizing linear mappings, named multiplicative-offset, further enhances the hardware efficiency. We also present a shared key scheduling datapath that can work on-the-fly in the proposed architecture. To the best of our knowledge, the proposed architecture has the shortest critical path delay and is the most efficient in terms of throughput per area among conventional AES encryption/decryption and encryption architectures with tower-field S-boxes. The proposed round-based architecture can perform AES encryption where block-wise parallelism is unavailable (e.g., cipher block chaining (CBC) mode); thus, our techniques can be globally applied to any type of architecture including pipelined ones. We evaluated the performance of the proposed and some conventional datapaths by logic synthesis with the NanGate 45-nm open-cell library. As a result, we can confirm that our proposed architectures achieve approximately 51-64 percent higher efficiency (i.e., higher bps/GE) and lower power/energy consumption than the other conventional counterparts.

show abstract

Tweakable Blockciphers for Efficient Authenticated Encryptions with Beyond the Birthday-Bound Security

Cited by 20 publications

References 26 publications

Polynomial Intermediate Checksum for Integrity under Releasing Unverified Plaintext and Its Application to COPA

Polynomial Intermediate Checksum for Integrity under Releasing Unverified Plaintext and Its Application to COPA

The Definition and Software Performance of Hashstream, a Fast Length-Flexible PRF

High Throughput/Gate AES Hardware Architectures Based on Datapath Compression

Contact Info

Product

Resources

About