POEx: A Beyond-Birthday-Bound-Secure On-Line Cipher ArcticCrypt 2016 Christian Forler 1 Eik List 2 Stefan Lucks 2 Jakob Wenzel 2 1 Hochschule Schmalkalden, 2 Bauhaus-Universität Weimar eik.list (at) uni-weimar.de 18 July 2016 18 July 2016 1/27 Eik List POEx
Agenda 1 Motivation 2 POEx 3 Proof Ideas 4 Instantiation 5 Summary 18 July 2016 2/27 Eik List POEx
Section 1 Motivation 18 July 2016 3/27 Eik List POEx
On-Line Ciphers [Bellare et al., 2001] M p M ′ M ′ M 1 M p +1 M p +2 M 1 M p p +1 p +2 . . . . . . . . . . . . E K E K E K E K E K E K E K E K . . . . . . C p C p +1 C p +2 C p C ′ C ′ C 1 C 1 p +1 p +2 On-line cipher: Every C i depends only on M 1 , . . . , M i [Boldyreva and Taesombut, 2004]: Constant latency and memory 18 July 2016 4/27 Eik List POEx
On-Line Ciphers [Bellare et al., 2001] M p M ′ M ′ M 1 M p +1 M p +2 M 1 M p p +1 p +2 . . . . . . . . . . . . E K E K E K E K E K E K E K E K . . . . . . C p C p +1 C p +2 C p C ′ C ′ C 1 C 1 p +1 p +2 On-line cipher: Every C i depends only on M 1 , . . . , M i [Boldyreva and Taesombut, 2004]: Constant latency and memory Length-preserving 18 July 2016 4/27 Eik List POEx
On-Line Ciphers [Bellare et al., 2001] M p M ′ M ′ M 1 M p +1 M p +2 M 1 M p p +1 p +2 . . . . . . . . . . . . E K E K E K E K E K E K E K E K . . . . . . C p C p +1 C p +2 C p C ′ C ′ C 1 C 1 p +1 p +2 On-line cipher: Every C i depends only on M 1 , . . . , M i [Boldyreva and Taesombut, 2004]: Constant latency and memory Length-preserving Prefix-preserving p ← LLCP n ( M, M ′ ) : Length (in blocks) of longest common prefix C i = C ′ i , for all 1 ≤ i ≤ p C p +1 � = C ′ p +1 C i , C ′ i independent for all i > p + 1 18 July 2016 4/27 Eik List POEx
Notions: SOPRP -Security [Bellare et al., 2001] E K D K P P − 1 A P և OPerm n K և K 18 July 2016 5/27 Eik List POEx
Limitation: Birthday Bound M 1 M 2 M m M 1 M 2 M m 0 n C 0 . . . E K H L E K E K . . H L E K H L E K E K . 0 n C 1 C 2 C m C 1 C 2 C m HCBC1 MHCBC M 1 M 2 M m M 1 M 2 M m 0 n E K E K . . . 0 n � � � E K E K E K . E K E K E K . E K . E K E K K 1 K 1 K 1 1 C 1 C 2 C m TC3 C 1 C 2 C m MHCBC M 1 M 2 M m 0 n (S) OPRP security requires dependency of previous block = ⇒ chaining . E K E K . E K H L H L . All of the above: n -bit chaining value (bottleneck: collision) Birthday bound: security lost after 2 n/ 2 blocks encrypted under 0 n the same key C 1 C 2 C m Interesting problem in practice and theory HPCBC 18 July 2016 6/27 Eik List POEx
Application: On-Line Authenticated Encryption Schemes Relevance: High-throughput/low-latency requirements, e. g. Optical Transport Networks [ITU-T, 2009] Stream-oriented interfaces in implementations, e. g. EVP_DecryptUpdate in OpenSSL [Young and Hudson, 2011] Output (part of) the result before all input parts are fully processed 18 July 2016 7/27 Eik List POEx
Application: On-Line Authenticated Encryption Schemes Relevance: High-throughput/low-latency requirements, e. g. Optical Transport Networks [ITU-T, 2009] Stream-oriented interfaces in implementations, e. g. EVP_DecryptUpdate in OpenSSL [Young and Hudson, 2011] Output (part of) the result before all input parts are fully processed 2nd-Round BC-Based Robust On-Line CAESAR Candidates: AES-JAMBU, COLM (AES-COPA + ELmD), POET, SHELL 18 July 2016 7/27 Eik List POEx
Application: On-Line Authenticated Encryption Schemes Relevance: High-throughput/low-latency requirements, e. g. Optical Transport Networks [ITU-T, 2009] Stream-oriented interfaces in implementations, e. g. EVP_DecryptUpdate in OpenSSL [Young and Hudson, 2011] Output (part of) the result before all input parts are fully processed 2nd-Round BC-Based Robust On-Line CAESAR Candidates: AES-JAMBU, COLM (AES-COPA + ELmD), POET, SHELL Inherit birthday-bound limitation 18 July 2016 7/27 Eik List POEx
Approaches for Higher (Provable) Security 1 Instantiation with wide-block primitive 2 Sponges 3 BBB-secure design 18 July 2016 8/27 Eik List POEx
Alternative Approaches 1. Instantiation with Wide-Block Primitive M 1 M 2 M m . . . � � � 0 n E K E K E K C 1 C 2 C m Example: TC3 [Rogaway and Zhang, 2011] with Prøst permutation or BLAKE2b , keyed and tweaked using Even-Mansour [Even and Mansour, 1991] + Efficient + Simple description and analysis – Technically not beyond-birthday-bound (BBB) (our approach guarantees significantly higher security) 18 July 2016 9/27 Eik List POEx
Alternative Approaches 2. Sponge . . . M C IV . . . . . . π π π π π K E.g. Keyak, Ketje, NORX, PRIMATEs, StriBOB, . . . + High security margin ◦ Not fully as efficient as block-cipher-based on-line ciphers – Technically not BBB 18 July 2016 10/27 Eik List POEx
Section 2 POEx 18 July 2016 11/27 Eik List POEx
POE M 1 M 2 M L H L H L · · · X 0 E K E K E K H L H L · · · Y 0 C 1 C 2 C L On-line cipher under POET [Abed et al., 2014] 1 BC call + 2 calls to ǫ -AXU hash function H per block SOPRP -secure POE + PMAC + Tag Splitting: Decryption-misuse-resistant on-line AE scheme POET 18 July 2016 12/27 Eik List POEx
XTX M W [Minematsu and Iwata, 2015] Tweak-domain extender for n tweakable block cipher � T H L V E K E : K×{ 0 , 1 } τ ×{ 0 , 1 } n → { 0 , 1 } n � τ ǫ -AXU hash function H : L×{ 0 , 1 } ∗ → { 0 , 1 } τ ×{ 0 , 1 } n C E − 1 ,H ] − 1 ( A ) ≤ ǫ · q 2 + Adv STPRP Adv STPRP E − 1 ( ℓ, O ( t )) . XTX [ � E,H ] , XTX [ � E, � � 18 July 2016 13/27 Eik List POEx
POEx M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 E K H L V 2 E K H L V 3 E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 XTX chained H : ǫ -AXU hash function � E : tweakable block cipher SOPRP -secure on-line secure up to about O (2 n + τ/ 2 ) blocks encrypted under same key BBB-secure 18 July 2016 14/27 Eik List POEx
Section 3 Proof Ideas 18 July 2016 15/27 Eik List POEx
Proof Ideas Steps M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 H L V 2 H L V 3 E K E K E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 Steps: 1 Replace � E by ideal primitive � π և TPerm ( τ, n ) 18 July 2016 16/27 Eik List POEx
Proof Ideas Steps M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 H L V 2 H L V 3 E K E K E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 Steps: 1 Replace � E by ideal primitive � π և TPerm ( τ, n ) 2 Identify bad events 18 July 2016 16/27 Eik List POEx
Proof Ideas Steps M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 H L V 2 H L V 3 E K E K E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 Steps: 1 Replace � E by ideal primitive � π և TPerm ( τ, n ) 2 Identify bad events 3 Study difference between POEx / POEx − 1 and P / P − 1 w/o bad events: In, directly after , and beyond common prefix 18 July 2016 16/27 Eik List POEx
Proof Ideas Steps M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 H L V 2 H L V 3 E K E K E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 Steps: 1 Replace � E by ideal primitive � π և TPerm ( τ, n ) 2 Identify bad events 3 Study difference between POEx / POEx − 1 and P / P − 1 w/o bad events: In, directly after , and beyond common prefix 4 Bound probability of bad events 18 July 2016 16/27 Eik List POEx
Proof Ideas Bad Events M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 H L V 1 � π H L V 2 π � H L V 3 � π Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 Bad Events: Consider distinct queries: ( M, C ) � = ( M ′ , C ′ ) , p = LLCP n ( M, M ′ ) Enc. queries: tweak+input collision: ( V i , X i ) = ( V ′ j , X ′ j ) Enc. queries: chaining-value collision: ( X i , Y i ) = ( X ′ j , Y ′ j ) Collisions beyond longest common prefix Two similar bad events for decryption queries 18 July 2016 17/27 Eik List POEx
Proof Ideas Bound M i W i X i X i − 1 Assuming independent keys K and L � H L V i E K Y i − 1 ǫ -AXU hash function H Y i C 1 � � 2 τ E − 1 ,H ] − 1 ( A ) ≤ 2 ℓ 2 ǫ · Adv SOPRP + 2 · Adv STPRP 2 + E − 1 ( ℓ, O ( t )) . POEx [ � E,H ] , POEx [ � 2 n − ℓ � E, � 18 July 2016 18/27 Eik List POEx
Section 4 Instantiation 18 July 2016 19/27 Eik List POEx
Instantiation of � E M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 H L V 2 H L V 3 E K E K E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 TWEAKEY constructions [Jean et al., 2014] Deoxys-BC-128-128 as � E AES-based, software-efficient 128-bit tweak and state 18 July 2016 20/27 Eik List POEx
Instantiation of � E M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 H L V 2 H L V 3 E K E K E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 TWEAKEY constructions [Jean et al., 2014] Deoxys-BC-128-128 as � E AES-based, software-efficient 128-bit tweak and state Various application-specific alternatives possible: Joltik-BC, Mennink’s designs [Mennink, 2015], ThreeFish [Ferguson et al., 2010], . . . 18 July 2016 20/27 Eik List POEx
Instantiation of H M 1 M 2 M 3 W 1 W 2 W 3 X 1 X 2 X 3 n X 0 � � � H L V 1 E K H L V 2 E K H L V 3 E K Y 0 τ Y 3 Y 1 Y 2 C 1 C 2 C 3 GF multiplications for H : � m L m +1 − i · M i mod p n ( x ) , Poly [ n ] L ( M ) := i =1 m/ 2 n -AXU for GF (2 n ) , p n ( x ) : irreducible polynomial in GF (2 n ) For L = GF (2 n ) × GF (2 τ ) : Poly [ n, τ ] L 1 ,L 2 ( M ) := ( Poly [ n ] L 1 ( M ) , Poly [ τ ] L 2 ( M )) . 18 July 2016 21/27 Eik List POEx
Recommend
More recommend
