Tweakable Blockciphers with Beyond Birthday-Bound Security

Abstract

Abstract. Liskov, Rivest and Wagner formalized the tweakable blockcipher (TBC) primitive at CRYPTO'02. The typical recipe for instantiating a TBC is to start with a blockcipher, and then build up a construction that admits a tweak. Almost all such constructions enjoy provable security only to the birthday bound, and the one that does achieve security beyond the birthday bound (due to Minematsu) severely restricts the tweak size and requires per-invocation blockcipher rekeying. This paper gives the first TBC construction that simultaneously allows for arbitrarily "wide" tweaks, does not rekey, and delivers provable security beyond the birthday bound. Our construction is built from a blockcipher and an -AXU2 hash function. As an application of the TBC primitive, LRW suggest the TBC-MAC construction (similar to CBC-MAC but chaining through the tweak), but leave open the question of its security. We close this question, both for TBC-MAC as a PRF and a MAC. Along the way, we find a nonce-based variant of TBC-MAC that has a tight reduction to the security of the underlying TBC, and also displays graceful security degradation when nonces are misused. This result is interesting on its own, but it also serves as an application of our new TBC construction, ultimately giving a variable input-length PRF with beyond birthday-bound security.Keywords: tweakable blockcipher, beyond birthday bound, pseudorandom function, message authentication code, unforgeability. sectionIntroduction A blockcipher E : {0, 1} k × {0, 1} n → {0, 1} n is typically viewed as a family of permutations E K over {0, 1} n , where the index into the family is the key K ∈ {0, 1} k . A tweakable blockcipher (TBC) extends this viewpoint by adding a second "dimension" to the function family, called a tweak. In particular, a TBC E : {0, 1} k × T × {0, 1} n → {0, 1} n is a family of permutations indexed by a pair (K, T ) ∈ {0, 1} k × T . There is, however, a semantic asymmetry between the key and the tweak: the key is secret and gives rise to security, while the tweak may be public and gives rise to variability.Liskov, Rivest and Wagner [21] formalized the TBC primitive. Their thesis was that primitives with inherent variability are a more natural starting point for building modes of operation, whereas classical constructions would use a blockcipher (deterministic once the key is fixed) and induce variability by using a per-message IV or nonce. Subsequent papers have delivered tweakable enciphering schemes (e.g. [14-16, 34, 8] and others), message authentication codes (e.g. [30]), and authenticated encryption (e.g. [29, 30,20]) modes of operation. The Skein [32] hash function has a TBC at its core. TBC-based constructions have found widespread practical application for full-disk encryption.BUILDING TBCS. There are few dedicated TBC designs: the Hasty Pudding [31] and Mercy [10] ciphers natively admit tweaks. The more common approach is to start from a blockcipher and build up a TBC, incorporating support for a tweak without (one hopes) sacrificing whatever s...

Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security

“…. , h σ ) instantiations of a universal hash function family H. Landecker et al [35] and Procter [48] showed that this construction achieves approximately 2 2n/3 security for two rounds, and Lampe and Seurin [34] proved security up to about 2 σn/(σ+2) for an arbitrary even number of rounds. It is conjectured that this scheme achieves 2 σn/(σ+1) security for any σ ≥ 1 [34].…”

“…All results on tweakable blockciphers in the standard cipher model [15,[34][35][36]42,43,48,50], implicitly rely on a generic standard-to-ideal reduction, where the keyed blockcipher calls are replaced with secret ideal permutations. This step usually costs Adv srkprp Φ,E (D), where D is some strong related-key PRP distinguisher with a certain amount of resources, usually q queries to the keyed oracle E φ(k) and τ time, and Φ is the set of related-key deriving functions φ that D is allowed to choose.…”

A Modular Framework for Building Variable-Input-Length Tweakable Ciphers

“…These constructions overcome the birthday bound by using 2n-bit blockciphers as primitives, which are in turn constructed from an n-bit TBC. To our knowledge, CLRW2 [23] is the most efficient n-bit TBC with beyond-birthday-bound security that supports the necessary tweakspace (Minematsu's TBC [28] limits tweak lengths to fewer than n/2 bits). Compared to TCT 2 , instantiating the LargeBlock constructions with this primitive ultimately requires an extra six finite field multiplications for each n bits of input.…”

“…For the FIL component, we can use Coron et al's [15] CDMS construction to get a 2n-bit TBC from an n-bit TBC, and implement the latter using the CLRW2, a recent beyond-birthday-bound secure construction by Landecker, Shrimpton, and Terashima [23]. Table 10 describes both constructions.…”

“…(K,L) (T, X) = EK (X ⊕ HL(T )) ⊕ HL(T ) CLRW2 [23]: TBC with beyond-birthday-bound security. Requires blockcipher E and -AXU2 function H.…”