Innovations in permutation-based encryption & authentication . - PowerPoint PPT Presentation

Innovations in permutation-based encryption & authentication . based on joint work with Fast Software Encryption Conference 2017 1 Joan Daemen 1 , 2 Guido Bertoni 1 , Michaël Peeters 1 , Gilles Van Assche 1 and Ronny Van Keer 1 1 STMicroelectronics 2 Radboud University

Outline . Pseudo-random functions PRF modes Sponge Farfalle Kravatte 2

Outline . Pseudo-random functions PRF modes Sponge Farfalle Kravatte 3

Pseudo-random function (PRF) . 4 input …

Stream encryption . 5 nonce plaintext = ciphertext

Message authentication (MAC) . 6 plaintext plaintext

Authenticated encryption . 7 plaintext nonce plaintext = ciphertext

String sequence input and incrementality . F K 8 packet #1 packet #1 ( P ( 1 ) )

String sequence input and incrementality . F K 8 packet #1 packet #2 packet #1 packet #2 ( P ( 2 ) ◦ P ( 1 ) )

String sequence input and incrementality . F K 8 packet #1 packet #2 packet #3 packet #1 packet #2 packet #3 P ( 3 ) ◦ P ( 2 ) ◦ P ( 1 ) ) (

Outline . Pseudo-random functions PRF modes Sponge Farfalle Kravatte 9

Session authenticated encryption (SAE) [Keccak Team, SAC 2011] . Wrap taking metadata A and plaintext P return tag T of length t Initialization taking nonce N 10 A (1) P (1) A (2) P (2) A (3) P (3) K, N 1 T (0) C (1) T (1) C (2) T (3) C (3) T (2) T ← 0 t + F K ( N ) history ← N C ← P + F K ( A ◦ history ) T ← 0 t + F K ( C ◦ A ◦ history ) history ← C ◦ A ◦ history return ciphertext C of length | P | and tag T of length t

Synthetic initialization value (SIV), as in [Keccak Team, eprint 2016/1188] Wrap taking metadata A and plaintext P Variant of SIV of [Rogaway & Shrimpton, EC 2006] Unwrap taking metadata A , ciphertext C and tag T . 11 P A F K F K T C T ← 0 t + F K ( P ◦ A ) C ← P + F K ( T ◦ A ) return ciphertext C of length | P | and tag T P ← C + F K ( T ◦ A ) τ ← 0 t + F K ( P ◦ A ) if τ ̸ = T then return error! else return plaintext P of length | C |

Wide block cipher (WBC), as in [Keccak Team, eprint 2016/1188] L Instance of HHFHFH of [Bernstein, Nandi & Sarkar, Dagstuhl 2016] R C . L 0 R 12 R 0 Encipher P with K and tweak W P ʹ left P ʹ right W ( L , R ) ← split ( P ) H K (... ° 0) ← R 0 + H K ( L ◦ 0 ) ← L + F K ( R ◦ W ◦ 1 ) F K (... ° 1) ← R + F K ( L ◦ W ◦ 0 ) ← L 0 + H K ( R ◦ 1 ) F K (... ° 0) ← L || H K (... ° 1) return ciphertext C of length | P | C left C right

Outline . Pseudo-random functions PRF modes Sponge Farfalle Kravatte 13

Sponge [Keccak Team, Ecrypt 2008] . 14 M pad trunc Z r 0 f f f f f f outer inner c 0 absorbing squeezing ◮ Pre-pending M with K gives PRF

More efficient: donkeySponge [Keccak Team, DIAC 2012] . 15

Incrementality: duplex [Keccak Team, SAC 2011] . 16 σ 0 σ 1 σ 2 Z 0 Z 1 Z 2 pad trunc pad trunc pad trunc r 0 f f f outer … inner c 0 initialize duplexing duplexing duplexing

More efficient: MonkeyDuplex [Keccak Team, DIAC 2012] . Instances: Ketje + half a dozen other CAESAR submissions 17

Consolidation: Full-state keyed duplex . [Mennink, Reyhanitabar, & Vizar, AC 2015], [Keccak Team & Mennink, 2016-2017] 18 Z ¾ Z ¾ Z ¾ K f f f … ± iv

SAE with full-state keyed duplex: Motorist [Keccak Team, Keyak 2015] . 19 P (1) P (2) 0 A (1) A (3) SUV 1 T (0) C (1) T (1) C (2) T (2) T (3)

Outline . Pseudo-random functions PRF modes Sponge Farfalle Kravatte 20

A parallel sponge variant: early attempt [Keccak Team 2014-2016] . Problem: collisions with higher-order differentials if f has low degree Similar to Protected Counter Sums [Bernstein, "stretch", JOC 1999] 21 M 0 k k f f Z 0 0 0 M 1 k k f f Z 1 1 1 … … M i k k f f Z j i j

A parallel sponge variant: early attempt [Keccak Team 2014-2016] . Problem: collisions with higher-order differentials if f has low degree Similar to Protected Counter Sums [Bernstein, "stretch", JOC 1999] 21 M 0 k k f f Z 0 0 0 M 1 k k f f Z 1 1 1 … … M i k k f f Z j i j

Farfalle as in [Keccak Team, eprint 2016/1188] . Problem: generic higher-order differential attack if f at right has low-degree with k derived from arbitrary-length K using compression layer 22 M 0 k k f f Z 0 M 1 k k f f Z 1 … … M i k k f f Z j i j

Farfalle as in [Keccak Team, eprint 2016/1188] . with k derived from arbitrary-length K using compression layer 22 M 0 k k f f Z 0 M 1 k k f f Z 1 … … M i k k f f Z j i j Problem: generic higher-order differential attack if f at right has low-degree

Farfalle now [Keccak Team, eprint 2016/1188, update TODO] . 23 m 0 k k f f z 0 m 1 k k f f z 1 f … … m i k k f f z j i j ◮ Input mask rolling and f against accumulator collisions ◮ State rolling, f and output mask against state retrieval from output ◮ Middle f against higher-order DC ◮ Input-output attacks would span 3 f layers

Outline . Pseudo-random functions PRF modes Sponge Farfalle Kravatte 24

Kravatte = Farfalle with Keccak- p . 25 m 0 k k f f z 0 m 1 k k f f z 1 f … … m i k k f f z j i j ◮ Target security: 128 bits, incl. multi-target (claimed c = 256) ◮ f = Keccak- p [ 1600 , n r ] with n r = 6 , 4 , 4 ◮ Rolling function: operates on 4 lanes only, linear with order 2 256 − 1 • lightweight, taken from [Granger, Jovanonvic, Mennink & Neves, EC 2016] • protects against higher-order DC

Thanks for your attention! . 26