A New Look at Counters: Dont Run Like Marathon in a Hundred Meter - PowerPoint PPT Presentation

A New Look at Counters: Don’t Run Like Marathon in a Hundred Meter Race Directions in Authenticated Ciphers ’16, Nagoya Avijit Dutta, Ashwin Jha and Mridul Nandi September 27, 2016 Indian Statistical Institute Kolkata

Counters in Cryptography Classical View: • Prevents collisions on the inputs to the underlying primitive. • Encoded within message blocks: HAIFA , XORMAC , LightMAC . 1 ⟨ 0 ⟩ s , ⟨ 1 ⟩ s , ⟨ 2 ⟩ s , ⟨ 3 ⟩ s , . . . , ⟨ 2 s − 1 ⟩ s where ⟨ i ⟩ s is the s -bits binary representation of i for some fixed s . • Standalone input: CTR mode, HAIFA , GCM , SIV .

log 2 L , L being Counter-Based Input Encoding Injective: X j X i j i Blockwise Collision-free: Security Needs M t n n f 2 n n M X n X Rate signifies Efficiency rate STD n s n where s the maximum permissible message length. Example For n 128 and s 64, the rate is 0 5 for any message lengths. Can we have better rate for smaller messages? M 2 X 1 n X 2 X b n f 1 f 1 n f 1 CTR n n − ℓ − n − n − n ⟨ 1 ⟩ s ∥ M 1 ⟨ 2 ⟩ s ∥ M 2 ⟨ b ⟩ s ∥ M b · · · X := � �� � � �� � � �� � − − − − − − | · · · | | |

Counter-Based Input Encoding Security Needs n M n n n n f 2 n n t Blockwise Collision-free: n Injective: Rate signifies Efficiency n the maximum permissible message length. Example For n 128 and s 64, the rate is 0 5 for any message lengths. Can we have better rate for smaller messages? n n 2 f 1 X b X 1 X 2 CTR f 1 f 1 − ℓ ∀ i ̸ = j , X i ̸ = X j . − n − n − n ∀ M ̸ = M ′ , X ̸ = X ′ . ⟨ 1 ⟩ s ∥ M 1 ⟨ 2 ⟩ s ∥ M 2 ⟨ b ⟩ s ∥ M b · · · X := � �� � � �� � � �� � − − − rate STD = n − s where s = log 2 L , L being − − − | · · · | | |

Counter-Based Input Encoding n n M n n n n n f 2 n t n Security Needs Blockwise Collision-free: Injective: Rate signifies Efficiency n the maximum permissible message length. Example Can we have better rate for smaller messages? n 2 f 1 CTR X 2 X b X 1 f 1 f 1 − ℓ ∀ i ̸ = j , X i ̸ = X j . − n − n − n ∀ M ̸ = M ′ , X ̸ = X ′ . ⟨ 1 ⟩ s ∥ M 1 ⟨ 2 ⟩ s ∥ M 2 ⟨ b ⟩ s ∥ M b · · · X := � �� � � �� � � �� � − − − rate STD = n − s where s = log 2 L , L being − − − | · · · | | | For n = 128 and s = 64, the rate is 0 . 5 for any message lengths.

approximation of STD opt in this case? STD opt : Length Dependent Counter Scheme n Comparison Catch What if we don’t know the length? Can we have a close 3 • Computes the optimal counter size ( ≈ log 2 ℓ ) for the given message length ℓ . rate STD opt = n − log 2 ℓ • For ℓ < L , rate STD opt > rate STD . For n = 128 bits and ℓ = 2 10 bits, the rate is 0 . 92.

STD opt : Length Dependent Counter Scheme n Comparison Catch What if we don’t know the length? Can we have a close 3 • Computes the optimal counter size ( ≈ log 2 ℓ ) for the given message length ℓ . rate STD opt = n − log 2 ℓ • For ℓ < L , rate STD opt > rate STD . For n = 128 bits and ℓ = 2 10 bits, the rate is 0 . 92. approximation of STD opt in this case?

A Race over Unknown Distance 200 m 400 m 10000 m 4

A Race over Unknown Distance 200 m 400 m 10000 m 4

A Race over Unknown Distance 200 m 400 m 10000 m 4

A Race over Unknown Distance 200 m 400 m 10000 m 4

A Race over Unknown Distance 5

A Race over Unknown Distance 5

A Race over Unknown Distance 5

A Candidate Length Independent Counter • Length Independent. • rate rate STD opt . • But, is this blockwise collision-free? Trivial Collision For n 8 and M 0 abcdefghijklmabcdef we have X 1 00 abcdef X 2 1 ghijklm and X 3 00 abcdef . Clearly, X 1 X 3 . 6 0 , 1 , 00 , 01 , 10 , 11 , 000 . . .

A Candidate Length Independent Counter 8 and M X 3 . 00 abcdef . Clearly, X 1 1 ghijklm and X 3 00 abcdef X 2 X 1 0 abcdefghijklmabcdef we have For n Trivial Collision • But, is this blockwise collision-free? rate STD opt . • rate • Length Independent. 6 0 , 1 , 00 , 01 , 10 , 11 , 000 . . . ✓

A Candidate Length Independent Counter 8 and M X 3 . 00 abcdef . Clearly, X 1 1 ghijklm and X 3 00 abcdef X 2 X 1 0 abcdefghijklmabcdef we have For n Trivial Collision • But, is this blockwise collision-free? • Length Independent. 6 0 , 1 , 00 , 01 , 10 , 11 , 000 . . . ✓ • rate > rate STD opt . ✓

A Candidate Length Independent Counter 8 and M X 3 . 00 abcdef . Clearly, X 1 1 ghijklm and X 3 00 abcdef X 2 X 1 0 abcdefghijklmabcdef we have For n Trivial Collision • But, is this blockwise collision-free? • Length Independent. 6 0 , 1 , 00 , 01 , 10 , 11 , 000 . . . ✓ • rate > rate STD opt . ✓ ✗

A Candidate Length Independent Counter • Length Independent. • But, is this blockwise collision-free? Trivial Collision 6 0 , 1 , 00 , 01 , 10 , 11 , 000 . . . ✓ • rate > rate STD opt . ✓ ✗ For n = 8 and M := 0 abcdefghijklmabcdef we have X 1 = 00 abcdef , X 2 = 1 ghijklm , and X 3 = 00 abcdef . Clearly, X 1 = X 3 .

log 2 log 2 L , for L 2 64 bits, and 2 10 bits, the rate is 0.89. VAR: Message Length Independent Counter n 128 bits, L For n Comparison n log 2 2 r n . rate VAR • Add a small fixed length (r) counter that gets updated with the c n 2 n 2 c n • r • Blockwise Collision-free and Injective. • Length Independent. change in counter size. 7 000 , 001 , 0100 , . . . , 0111 , 10000 , . . . , 10111 , 110000 , . . .

log 2 log 2 L , for L 2 64 bits, and 2 10 bits, the rate is 0.89. VAR: Message Length Independent Counter rate VAR 128 bits, L For n Comparison n log 2 2 r n c n n . • Add a small fixed length (r) counter that gets updated with the 2 n 2 c n • r • Blockwise Collision-free and Injective. • Length Independent. change in counter size. 7 000 , 001 , 0100 , . . . , 0111 , 10000 , . . . , 10111 , 110000 , . . . ✓ ✓

VAR: Message Length Independent Counter • Add a small fixed length (r) counter that gets updated with the change in counter size. • Length Independent. • Blockwise Collision-free and Injective. n n Comparison 7 000 , 001 , 0100 , . . . , 0111 , 10000 , . . . , 10111 , 110000 , . . . ✓ ✓ • r ≈ log 2 log 2 L , for L < 2 c ( n ) , 2 ≤ c ( n ) < n . rate VAR ≈ n − r + 2 − log 2 ℓ For n = 128 bits, L = 2 64 bits, and ℓ = 2 10 bits, the rate is 0.89.

Counter Function Family (CFF) Definition: fixed length CFF; variable length CFF otherwise. What can we say about the security relevant properties? 8 CTR is a family of counter functions { ctr ℓ : ℓ ≤ L } where ∀ ℓ ≤ L , ctr ℓ : N → { 0 , 1 } < n . • Length Independent: For STD counter function family std ℓ ( i ) = ⟨ i ⟩ s , ∀ ℓ, i . • Length Dependent: For STD opt counter function family opt ℓ ( i ) = ⟨ i ⟩ log 2 ℓ , ∀ ℓ, i . • For a given ℓ , if ∀ i ̸ = j , | ctr ℓ ( i ) | = | ctr ℓ ( j ) | , we say that CTR is a

Counter Function Family (CFF) Definition: fixed length CFF; variable length CFF otherwise. What can we say about the security relevant properties? 8 CTR is a family of counter functions { ctr ℓ : ℓ ≤ L } where ∀ ℓ ≤ L , ctr ℓ : N → { 0 , 1 } < n . • Length Independent: For STD counter function family std ℓ ( i ) = ⟨ i ⟩ s , ∀ ℓ, i . • Length Dependent: For STD opt counter function family opt ℓ ( i ) = ⟨ i ⟩ log 2 ℓ , ∀ ℓ, i . • For a given ℓ , if ∀ i ̸ = j , | ctr ℓ ( i ) | = | ctr ℓ ( j ) | , we say that CTR is a

M i and b Prefix-free and Injective CFFs b What about injective property? prefix-free CFF. CTR is a blockwise collision-free encoding if and only if it is CTR is a Blockwise Collision-free Lemma: Prefix-free n ctr i n 1 i is the least integer b that satisfies, 1 Prefix-free: ctr i X i , where each X b X 1 length message M , CTR M For any CFF as an Encoding Function: CTR is prefix-free if 9 ∀ ℓ ≤ L , ∀ i ̸ = j ∈ b ( ℓ ) , ctr ℓ ( i ) is not a prefix of ctr ℓ ( j ) .

Prefix-free and Injective CFFs Prefix-free: What about injective property? prefix-free CFF. CTR is a blockwise collision-free encoding if and only if it is CTR is a Blockwise Collision-free Lemma: Prefix-free 9 CFF as an Encoding Function: b CTR is prefix-free if ∀ ℓ ≤ L , ∀ i ̸ = j ∈ b ( ℓ ) , ctr ℓ ( i ) is not a prefix of ctr ℓ ( j ) . For any ℓ length message M , CTR ( M ) = ( X 1 , . . . , X b ( ℓ ) ) , where each X i = ctr ℓ ( i ) ∥ M i and b ( ℓ ) is the least integer b that satisfies, ∑ ℓ + 1 ≤ ( n − | ctr ℓ ( i ) | ) ≤ ℓ + n . i = 1

Prefix-free and Injective CFFs Prefix-free: What about injective property? prefix-free CFF. CTR is a blockwise collision-free encoding if and only if it is CTR is a b CFF as an Encoding Function: CTR is prefix-free if 9 ∀ ℓ ≤ L , ∀ i ̸ = j ∈ b ( ℓ ) , ctr ℓ ( i ) is not a prefix of ctr ℓ ( j ) . For any ℓ length message M , CTR ( M ) = ( X 1 , . . . , X b ( ℓ ) ) , where each X i = ctr ℓ ( i ) ∥ M i and b ( ℓ ) is the least integer b that satisfies, ∑ ℓ + 1 ≤ ( n − | ctr ℓ ( i ) | ) ≤ ℓ + n . i = 1 Lemma: Prefix-free ⇔ Blockwise Collision-free