Introduction Idealized Combined Feedback Construction : iCOFB Specification for COFB Hardware Implimentation Results of COFB Conclusion Blockcipher-based Authentcated Encryption: How Small Can We Go? Avik Chakraborti (Indian Statistical Institute, Kolkata) Tetsu Iwata (Nagoya University, Japan) Kazuhiko Minematsu (NEC Corporation, Japan) Mridul Nandi (Indian Statistical Institute, Kolkata) September, 2016 COFB
Introduction Idealized Combined Feedback Construction : iCOFB Specification for COFB Hardware Implimentation Results of COFB Conclusion Introduction 1 Idealized Combined Feedback Construction : iCOFB 2 Specification for COFB 3 Hardware Implimentation Results of COFB 4 Conclusion 5 COFB
Introduction Idealized Combined Feedback Construction : iCOFB Specification for COFB Hardware Implimentation Results of COFB Conclusion Authenticated Encryption (AE) More Formally.... AE . enc : M×D×N ×K → C AE . dec : C × D × N × K → M∪ ⊥ Goal Primitive Security Privacy Symmetric Encryption IND-CPA Integrity MAC/Others INT-CTXT Table: Security Properties COFB
Introduction Idealized Combined Feedback Construction : iCOFB Specification for COFB Hardware Implimentation Results of COFB Conclusion IND-CPA Security for Privacy E k ( . ) $( . ) ( N i , A i , M i ) ( N i , A i , M i ) i = 1 . . . q A i = 1 . . . q ( C i , T i ) ( C i , T i ) Simulate E k ( . ) Simulate $( . ) 0 / 1 ∆ A ( O 1 ; O 2 ) = | Pr[ A O 1 = 1] − Pr[ A O 2 = 1] | . Adv PRIV ( A ) := ∆ A ( E K ; $) AE Adv PRIV ( q , σ, t ) = max A Adv PRIV ( A ) AE AE t : Time, q : #queries , σ : # blocks in all queries COFB
Introduction Idealized Combined Feedback Construction : iCOFB Specification for COFB Hardware Implimentation Results of COFB Conclusion INT-CTXT Security for Integrity E k ( · ) V k ( · ) ( N ∗ j , A ∗ j , C ∗ j , T ∗ j ) ( N i , A i , M i ) i = 1 . . . q e A j = 1 . . . q f forge attempts ( C i , T i ) 0 / 1 A forges if ∃ ( N ∗ j , A ∗ j , C ∗ j , T ∗ j ) ∋ V k ( N ∗ j , A ∗ j , C ∗ j , T ∗ j ) = 1 AE ( A ) := Pr [ A E k forges ] Adv INT Adv INT AE (( q e , q f ) , ( σ e , σ f ) , t ) = max A Adv INT AE ( A ) COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion Introduction 1 Idealized Combined Feedback Construction : iCOFB 2 Motivation Idealized Combined-Feedback Authenticated Encryption : iCOFB Security of iCOFB Specification for COFB 3 Hardware Implimentation Results of COFB 4 Conclusion 5 COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion Current State of the Art Structural Properties Schemes CLOC-SILC AES-JAMBU iFEED State 2n + k 1.5n + k 3n + k 1 1 Rate 1 2 2 Yes Yes (integrity only) Yes (wrong) Proofs Here n is the blocksize of blockcipher COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion Main Idea and Motivation Behind the Construction Very small cipher state Provably Security in terms of both Privacy and Integrity COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion Introduction 1 Idealized Combined Feedback Construction : iCOFB 2 Motivation Idealized Combined-Feedback Authenticated Encryption : iCOFB Security of iCOFB Specification for COFB 3 Hardware Implimentation Results of COFB 4 Conclusion 5 COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion iCOFB Construction Generic Combined Feedback Mode Instantiated by COFB AE scheme Easy to Understand COFB COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion iCOFB Construction 0 n X [1] X [2] X [3] X [4] R N,A, (0 , 0) R N,A, (1 , 0) R N,A, (2 , 0) R N,A, (3 , 0) R N,A, (4 , 1) Y [0] Y [1] Y [2] Y [3] M [1] ρ M [2] ρ M [3] ρ M [4] ρ Y [4] C [1] C [2] C [3] C [4] Powered by TCPDF (www.tcpdf.org) R N , A , ( a , b ) : Tweakable random function ∀ N , A , ( a , b ), R N , A , ( a , b ) : B → B COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion iCOFB Construction 0 n X [1] X [2] X [3] X [4] R N,A, (0 , 0) R N,A, (1 , 0) R N,A, (2 , 0) R N,A, (3 , 0) R N,A, (4 , 1) Y [0] Y [1] Y [2] Y [3] ρ ρ ρ ρ Y [4] M [1] M [2] M [3] M [4] C [1] C [2] C [3] C [4] Powered by TCPDF (www.tcpdf.org) ρ : Linear Feedback Function COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion iCOFB Construction 0 n X [1] X [2] X [3] X [4] R N,A, (0 , 0) R N,A, (1 , 0) R N,A, (2 , 0) R N,A, (3 , 0) R N,A, (4 , 1) Y [0] Y [1] Y [2] Y [3] M [1] ρ M [2] ρ M [3] ρ M [4] ρ Y [4] C [1] C [2] C [3] C [4] Powered by TCPDF (www.tcpdf.org) CT = ( C [1] , C [2] , C [3] , C [4]), Tag = Y [4] COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion Linear Feedback Function : ρ ′ For ρ : B × B → B × B , ∃ ρ Correctness Condition for encryption, ′ ( Y , C ) = ( X , M ) ∀ Y , M ∈ B , ρ ( Y , M ) = ( X , C ) ⇒ ρ ρ ensures given ( Y , C ): M should be uniquely computable � G � � I + G � I ′ = I Example : ρ = , ρ , G is invertible I I I I COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion ′ ρ and ρ ρ : During Encryption � X [ i ] � � E 1 , 1 � � Y [ i − 1] � E 1 , 2 = C [ i ] E 2 , 1 E 2 , 2 M [ i ] If ρ Satisfies the correctness condition then E 2 , 2 must be inv ′ : During Decryption ρ � X [ i ] � � D 1 , 1 � � Y [ i − 1] � D 1 , 2 = M [ i ] D 2 , 1 D 2 , 2 C [ i ] D 1 , 1 = E 1 , 1 + E 1 , 2 . E − 1 2 , 2 . E 2 , 1 , D 1 , 2 = E 1 , 2 D 2 , 1 = E − 1 2 , 2 . E 2 , 1 , D 2 , 2 = E − 1 2 , 2 ρ is Valid if both ( C 1) E 2 , 1 , ( C 2) D 1 , 2 and ( C 3) D 1 , 1 invertible COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion Introduction 1 Idealized Combined Feedback Construction : iCOFB 2 Motivation Idealized Combined-Feedback Authenticated Encryption : iCOFB Security of iCOFB Specification for COFB 3 Hardware Implimentation Results of COFB 4 Conclusion 5 COFB
Introduction Idealized Combined Feedback Construction : iCOFB Motivation Specification for COFB Idealized Combined-Feedback Authenticated Encryption : iCOFB Hardware Implimentation Results of COFB Security of iCOFB Conclusion Privacy and Authencity for iCOFB ( C 2) ⇒ ∀ Y , C � = C ′ , D 1 , 1 . Y + D 1 , 2 . C � = D 1 , 1 . Y + D 1 , 2 . C ′ ( C 3) ⇒ ρ is invertible (for correctness E − 1 2 , 2 is invertible). Hence, ← B : D 1 , 1 . Y + D 1 , 2 . C = X ] = 2 − n , ∀ ( C , X ) ∈ B 2 $ Pr[ Y Theorem If ρ is valid then for adversary A making q encryption queries and q f forging attempts having at most ℓ f many blocks, we have iCOFB ( A ) ≤ q f ( ℓ f + 1) Adv priv Adv auth iCOFB ( A ) = 0 , . 2 n COFB
Introduction Idealized Combined Feedback Construction : iCOFB Underlying Mathematical Components for COFB Specification for COFB Security Bounds Hardware Implimentation Results of COFB Properties Conclusion Introduction 1 Idealized Combined Feedback Construction : iCOFB 2 Specification for COFB 3 Underlying Mathematical Components for COFB Security Bounds Properties Hardware Implimentation Results of COFB 4 Conclusion 5 COFB
Introduction Idealized Combined Feedback Construction : iCOFB Underlying Mathematical Components for COFB Specification for COFB Security Bounds Hardware Implimentation Results of COFB Properties Conclusion Design Rationale and Challenges COFB : An instantiation of iCOFB Instatiation of iCOFB is possible by standard method (like XE mode) But results in 2 state memories Here, we considered half tweak (only Half-bit mask) Sufficient for standard security bound The proof for COFB is not the same as XE based iCOFB Proof based on specific design (w/o iCOFBs security bound) COFB
Recommend
More recommend
