Pipelineable On-Line Encryption with Tag (POET) Farzaneh Abed 2 Scott - PowerPoint PPT Presentation

Pipelineable On-Line Encryption with Tag (POET) Farzaneh Abed 2 Scott Fluhrer 1 John Foley 1 Christian Forler 2 Eik List 2 Stefan Lucks 2 David McGrew 1 Jakob Wenzel 2 1 Cisco Systems, 2 Bauhaus-Universität Weimar DIAC 2014 Santa Barbara, CA Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 1

Outline Motivation 1 Case Study: OTN Decryption Misuse CAESAR Submission POET 2 Security of POET 3 Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 2

Motivation Section 1 Motivation Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 3

Motivation Case Study: OTN Case Study: Optical Transport Network (OTN) Task: Secure network traffic . . . Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

Motivation Case Study: OTN Case Study: Optical Transport Network (OTN) Task: Secure network traffic . . . . . . of real-time applications . . . Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

Motivation Case Study: OTN Case Study: Optical Transport Network (OTN) Task: Secure network traffic . . . . . . of real-time applications . . . . . . in an Optical Transport Network (OTN) Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

Motivation Case Study: OTN Case Study: Optical Transport Network (OTN) Task: Secure network traffic . . . . . . of real-time applications . . . . . . in an Optical Transport Network (OTN) High throughput (40 - 100 Gbit/s) Low latency (few clock cycles) Large message frames (64 KB) (usually consist of multiple TCP/IP or UDP/IP packages) Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

Motivation Case Study: OTN Requirements for OTNs Security requirements: Data privacy (IND-CPA), and Data integrity (INT-CTXT) Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 5

Motivation Case Study: OTN Requirements for OTNs Security requirements: Data privacy (IND-CPA), and Data integrity (INT-CTXT) Functional requirements: On-line encryption/decryption Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 5

Motivation Case Study: OTN Problem and Workarounds Problem: High Latency of Authenticated Decryption 1 Decryption of the entire message 2 Verification of the authentication tag For 64-kB frames we have 4,096 ciphertext blocks (128 bits) Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 6

Motivation Case Study: OTN Problem and Workarounds Problem: High Latency of Authenticated Decryption 1 Decryption of the entire message 2 Verification of the authentication tag For 64-kB frames we have 4,096 ciphertext blocks (128 bits) Workarounds: Decrypt-then-mask? [Fouque et al. 03] ⇒ latency again Pass plaintext beforehand and hope. . . Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 6

Motivation Case Study: OTN Problem and Workarounds Problem: High Latency of Authenticated Decryption 1 Decryption of the entire message 2 Verification of the authentication tag For 64-kB frames we have 4,096 ciphertext blocks (128 bits) Workarounds: Decrypt-then-mask? [Fouque et al. 03] ⇒ latency again Pass plaintext beforehand and hope. . . Drawbacks: Plaintext information would leak if authentication tag invalid Literature calls this setting decryption-misuse [Fleischmann, Forler, and Lucks 12] Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 6

Motivation Decryption Misuse How Severe is Decryption-Misuse? Puts security at high risk CCA-adversary may inject controlled manipulations Particularly, CTR-mode based AE schemes C ⊕ ∆ → Dec M ⊕ ∆ Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 7

Motivation Decryption Misuse How Severe is Decryption-Misuse? Puts security at high risk CCA-adversary may inject controlled manipulations Particularly, CTR-mode based AE schemes C ⊕ ∆ → Dec M ⊕ ∆ Decryption-misuse is not covered by existing CCA3-security proofs Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 7

Motivation Decryption Misuse Decryption Misuse Resistance Best to wish for: Manipulation of ciphertext block C i ⇒ completely random plaintext Contradiction to on-line requirement Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 8

Motivation Decryption Misuse Decryption Misuse Resistance Best to wish for: Manipulation of ciphertext block C i ⇒ completely random plaintext Contradiction to on-line requirement What can we achive with an on-line encryption scheme? Manipulation of C i ⇒ M i , M i + 1 , . . . random garbage Adversary sees at best common message prefixes Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 8

Motivation Decryption Misuse Decryption Misuse Resistance Best to wish for: Manipulation of ciphertext block C i ⇒ completely random plaintext Contradiction to on-line requirement What can we achive with an on-line encryption scheme? Manipulation of C i ⇒ M i , M i + 1 , . . . random garbage Adversary sees at best common message prefixes The security notion of OPRP-CCA covers this behaviour [Bellare et al. 01] Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 8

Motivation Decryption Misuse On-Line Permutation P 1 P 2 P 3 P 4 P 5 Encrypt C 3 C 4 C 5 C 1 C 2 C' 3 C' 4 C' 5 Encrypt P 1 P 2 P' 3 P 4 P 5 On-Line Pseudo Random Permutation (OPRP) Like a PRP with the following property: Plaintexts with common prefix → ciphertexts with common prefix (Bellare et al.; “Online Ciphers and the Hash-CBC Construction”; CRYPTO’01) Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 9

Motivation Decryption Misuse OPRP-CCA Definition (OPRP-CCA Advantage) Let P be a random on-line permutation, Π = ( K , E , D ) an on-line $ encryption scheme, k ← K () , and A be an adversary. Then we have � � A E k ( . ) , D k ( . ) = � � A P ( . ) , P − 1 ( . ) = �� Adv OPRP-CCA ( A ) = � Pr ⇒ 1 − ⇒ 1 � � Π � Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 10

Motivation Decryption Misuse Intermediate (Authentication) Tags Assume an OPRP-CCA secure encryption scheme Recap: Modifying C i = ⇒ M i , M i + 1 , . . . , M M random garbage Redundancy in the plaintext (e.g., checksum) Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 11

Motivation Decryption Misuse Intermediate (Authentication) Tags Assume an OPRP-CCA secure encryption scheme Recap: Modifying C i = ⇒ M i , M i + 1 , . . . , M M random garbage Redundancy in the plaintext (e.g., checksum) = ⇒ intermediate authentication tags Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 11

Motivation Decryption Misuse Intermediate (Authentication) Tags Assume an OPRP-CCA secure encryption scheme Recap: Modifying C i = ⇒ M i , M i + 1 , . . . , M M random garbage Redundancy in the plaintext (e.g., checksum) = ⇒ intermediate authentication tags Common network packets (TCP/IP , UDP/IP) have a checksum = ⇒ OTN: 16-bit integrity for free (per packet) Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 11

CAESAR Submission POET Section 2 CAESAR Submission POET Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 12

CAESAR Submission POET Pipeline On-Line Encryption (POE) M b − 1 M 1 M 2 τ X b − 2 F K 1 F K 1 X 2 F K 1 ... E E E τ Y 2 Y b − 2 F K 2 F K 2 F K 2 C 1 C 2 C b − 1 POE is a OPRP-CCA secure enc scheme [Abed et al. 14] Actually, it provides birthday bound security POE is used to process a message or ciphertext Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 13

CAESAR Submission POET POET Header Processing H a − 1 H a || 10 ∗ H 1 H 2 H a L 2 L 2 a − 2 L 2 a − 2 3 L 2 a − 2 5 L K K K E E E ... ... K K E E τ τ We just borrowed the PMAC design [Black & Rogaway 02] Nonce is (part of) the header Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 14

CAESAR Submission POET POET M b − 1 M b || τ α M 1 M 2 τ L T E K ( | M | ) F K 1 F K 1 F K 1 F K 1 F K 1 τ X 2 X b − 2 ... E E E E E F K 2 F K 2 F K 2 F K 2 F K 2 τ Y 2 Y b − 2 L T E K ( | M | ) T β || Z C 1 C 2 C b − 1 C b || T α Well pipelineable 1 BC + 2 AXU hash-function ( F ) calls per block Borrows tag-splitting procedure from McOE Robust against nonce- and decryption-misuse Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 15

CAESAR Submission POET Requirements for F Basic Assumption ( F is AXU) F : { 0 , 1 } k × { 0 , 1 } n → { 0 , 1 } n is ǫ -AXU Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 16

CAESAR Submission POET Requirements for F Basic Assumption ( F is AXU) F : { 0 , 1 } k × { 0 , 1 } n → { 0 , 1 } n is ǫ -AXU Further Assumption (Cascade F b is AXU) F b κ ( X ) := F κ ( . . . ( F κ ( X 1 ) ⊕ X 2 ) , . . . ) ⊕ X b ) is b · ǫ -AXU Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 16

CAESAR Submission POET Requirements for F Basic Assumption ( F is AXU) F : { 0 , 1 } k × { 0 , 1 } n → { 0 , 1 } n is ǫ -AXU Further Assumption (Cascade F b is AXU) F b κ ( X ) := F κ ( . . . ( F κ ( X 1 ) ⊕ X 2 ) , . . . ) ⊕ X b ) is b · ǫ -AXU Thanks to Mridul Nandi for pointing out this implicit assumption for F in our inital version Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 16