Deck-Based Wide Block Cipher Modes and an Exposition of the Blinded Keyed Hashing Model Aldo Gunsing, Joan Daemen and Bart Mennink FSE 2020 1 / 15
Block cipher K n n P B C ◮ Plaintext P encrypted to ciphertext C with secret key K ◮ Fixed block size 2 / 15
Block cipher K n n P B C ◮ Plaintext P encrypted to ciphertext C with secret key K ◮ Fixed block size ◮ In order to encrypt variable sized messages, we need a mode of operation ◮ These modes require a nonce, which has to be stored 2 / 15
Wide block cipher K ∗ ∗ P B C ◮ Alternatively, we can design a wide block cipher ◮ A wide block cipher is a block cipher with a variable block size 3 / 15
Wide block cipher K ∗ ∗ P B C ◮ Alternatively, we can design a wide block cipher ◮ A wide block cipher is a block cipher with a variable block size ◮ No nonce needed, as every part of the output ideally depends on every part of the input 3 / 15
Tweakable wide block cipher K W ∗ ∗ P B C ◮ A tweakable wide block cipher additionally has a tweak ◮ Tweak W public, ciphertext completely changes with a different tweak 4 / 15
Tweakable wide block cipher K W ∗ ∗ P B C ◮ A tweakable wide block cipher additionally has a tweak ◮ Tweak W public, ciphertext completely changes with a different tweak ◮ Useful for e.g. disk encryption, where every sector gets its own tweak 4 / 15
Our contribution We build two tweakable wide block ciphers based on two primitives: 5 / 15
Our contribution We build two tweakable wide block ciphers based on two primitives: ◮ Doubly-extendable cryptographic keyed (deck) functions: ◮ Input: any size ◮ Output: arbitrarily long 5 / 15
Our contribution We build two tweakable wide block ciphers based on two primitives: ◮ Doubly-extendable cryptographic keyed (deck) functions: ◮ Input: any size ◮ Output: arbitrarily long ◮ Keyed hashes: ◮ Input: any size ◮ Output: fixed size 5 / 15
Our contribution We build two tweakable wide block ciphers based on two primitives: ◮ Doubly-extendable cryptographic keyed (deck) functions: ◮ Input: any size ◮ Output: arbitrarily long ◮ Keyed hashes: ◮ Input: any size ◮ Output: fixed size In contrast to block ciphers, these primitives are not necessarily invertible, which allows for a more flexible design 5 / 15
Double-decker U L U R V L V R H K F K 1 W F K 2 H K X L X R Y L Y R 6 / 15
Double-decker U L U R V L V R H K ◮ Generalization of Farfalle-WBC by Bertoni et al. (2017) F K 1 ◮ Feistel-like structure W F K 2 H K X L X R Y L Y R 6 / 15
Double-decker U L U R V L V R H K ◮ Generalization of Farfalle-WBC by Bertoni et al. (2017) F K 1 ◮ Feistel-like structure ◮ Two keyed hashes on the outside, two deck W functions on the inside – hence the name F K 2 H K X L X R Y L Y R 6 / 15
Double-decker U L U R V L V R n ∗ ∗ n H K ◮ Generalization of Farfalle-WBC by Bertoni et al. (2017) F K 1 ◮ Feistel-like structure ◮ Two keyed hashes on the outside, two deck W functions on the inside – hence the name F K 2 ◮ Outer lanes of fixed size ◮ Inner lanes of variable size H K n ∗ ∗ n X L X R Y L Y R 6 / 15
Docked-double-decker T U V H K F K 1 W F K 2 H K X Y Z 7 / 15
Docked-double-decker T U V H K ◮ Variant of double-decker ◮ One lane less F K 1 W F K 2 H K X Y Z 7 / 15
Docked-double-decker T U V n ∗ n H K ◮ Variant of double-decker ◮ One lane less F K 1 ◮ Outer lanes of fixed size W ◮ Inner lane of variable size F K 2 H K n ∗ n X Y Z 7 / 15
Docked-double-decker T U V n ∗ n H K ◮ Variant of double-decker ◮ One lane less F K 1 ◮ Outer lanes of fixed size W ◮ Inner lane of variable size F K 2 ◮ Deck functions get fixed sized input, so they conceptually become stream ciphers H K n ∗ n X Y Z 7 / 15
XOR-universality ◮ A keyed hash H is ε -XOR-universal if for all x � = x ′ and y P [ H K ( x ) ⊕ H K ( x ′ ) = y ] � ε 8 / 15
XOR-universality ◮ A keyed hash H is ε -XOR-universal if for all x � = x ′ and y P [ H K ( x ) ⊕ H K ( x ′ ) = y ] � ε ◮ This conventional property only considers the XOR-difference between a single query pair 8 / 15
XOR-universality ◮ A keyed hash H is ε -XOR-universal if for all x � = x ′ and y P [ H K ( x ) ⊕ H K ( x ′ ) = y ] � ε ◮ This conventional property only considers the XOR-difference between a single query pair � q ◮ For q queries the bound becomes � ε 2 8 / 15
XOR-universality ◮ A keyed hash H is ε -XOR-universal if for all x � = x ′ and y P [ H K ( x ) ⊕ H K ( x ′ ) = y ] � ε ◮ This conventional property only considers the XOR-difference between a single query pair � q ◮ For q queries the bound becomes � ε 2 ◮ However: ◮ ε is the worst-case bound on all possible x � = x ′ ◮ For some functions not all query pairs have similar probabilities 8 / 15
Blinded keyed hash ◮ We consider blinded keyed hash (bkh) security to achieve a more accurate estimate when multiple queries are taken into account 9 / 15
Blinded keyed hash ◮ We consider blinded keyed hash (bkh) security to achieve a more accurate estimate when multiple queries are taken into account ◮ The keyed hash function H is bkh secure if it is indistinguishable in the following setup ∆ X H K RO 1 RO 2 X ∆ 9 / 15
Example: Xoofffie Xoofffie XOR-universal bkh 2 − 127 2 − 127 single query tuple � q � · 2 − 127 q · 2 − 128 q queries 2 ◮ Red bounds are claimed, black bound follows from XOR-universality 10 / 15
Example: Xoofffie Xoofffie XOR-universal bkh 2 − 127 2 − 127 single query tuple � q � · 2 − 127 q · 2 − 128 q queries 2 ◮ Red bounds are claimed, black bound follows from XOR-universality ◮ Using Xoofffie as XOR-universal hash: claimed security guarantee of 64 bits ◮ Using Xoofffie as bkh: claimed security guarantee of 128 bits 10 / 15
Security results ◮ We cannot apply the bkh model directly to our construction ◮ The real difficulty is to reduce to the bkh model ◮ For XOR-universality this was trivial 11 / 15
Security results ◮ We cannot apply the bkh model directly to our construction ◮ The real difficulty is to reduce to the bkh model ◮ For XOR-universality this was trivial ◮ We show that the double-deckers are secure when: ◮ The keyed hash H is bkh secure ◮ The deck function F is prf secure 11 / 15
Security results ◮ We cannot apply the bkh model directly to our construction ◮ The real difficulty is to reduce to the bkh model ◮ For XOR-universality this was trivial ◮ We show that the double-deckers are secure when: ◮ The keyed hash H is bkh secure ◮ The deck function F is prf secure ◮ Furthermore, by applying the tweak to the deck functions the bound of H becomes tweak-separated ◮ Deck functions behave independently for different tweaks ◮ Significantly improves security bound for certain settings 11 / 15
Power of tweak-separation ◮ Consider a ε -XOR-universal keyed hash function H ◮ Consider q queries and q W queries with tweak W loss on H naive actual � q � general bound ε 2 � q � one tweak ε 2 � q � no tweak repetitions ε 2 12 / 15
Power of tweak-separation ◮ Consider a ε -XOR-universal keyed hash function H ◮ Consider q queries and q W queries with tweak W loss on H naive actual � q � q W � � � general bound ε ε 2 W 2 � q � q � � one tweak ε ε 2 2 � q � no tweak repetitions 0 ε 2 12 / 15
Applying to disk encryption on SSDs ◮ Double-decker is very suitable for disk encryption ◮ Disks are separated in sectors ◮ Block size is equal to the sector size ◮ Physical sector number used as tweak 13 / 15
Applying to disk encryption on SSDs ◮ Double-decker is very suitable for disk encryption ◮ Disks are separated in sectors ◮ Block size is equal to the sector size ◮ Physical sector number used as tweak ◮ The sectors in SSDs have a limited lifetime as they get damaged every time data is written ◮ The Kingston UV500 960 GB has N = 2 28 sectors, where every sector can be written at most ≈ 500 times 13 / 15
Applying to disk encryption on SSDs ◮ Double-decker is very suitable for disk encryption ◮ Disks are separated in sectors ◮ Block size is equal to the sector size ◮ Physical sector number used as tweak ◮ The sectors in SSDs have a limited lifetime as they get damaged every time data is written ◮ The Kingston UV500 960 GB has N = 2 28 sectors, where every sector can be written at most ≈ 500 times � 500 N ε ≈ 2 74 ε ≪ 1 ◮ Without tweak-separation secure when 2 � 2 � 500 ε ≈ 2 46 ε ≪ 1 ◮ With tweak-separation this improves to 2 N � 2 13 / 15
Comparison with Adiantum U V T U V n ∗ n ∗ n H K H K F K 1 B K 1 W W F K 2 F K 2 H K H K n ∗ n ∗ n X Y Z X Y Adiantum (FSE 2019) Docked-double-decker 14 / 15
Conclusion ◮ We introduced (docked-)double-decker, two tweakable wide block ciphers based on deck functions and keyed hash functions 15 / 15
Conclusion ◮ We introduced (docked-)double-decker, two tweakable wide block ciphers based on deck functions and keyed hash functions ◮ We also introduced the security model bkh for keyed hashes as a generalization of XOR-universality 15 / 15
Recommend
More recommend
