Revisiting Key-alternating Feistel Ciphers for Shorter Keys and - PowerPoint PPT Presentation

Revisiting Key-alternating Feistel Ciphers for Shorter Keys and Multi-user Security Chun Guo and Lei Wang ICTEAM/ELEN/Crypto Group, Universit´ e catholique de Louvain Shanghai Jiao Tong University Presented by Yaobin Shen, Shanghai Jiao Tong University December 3 AISACRYPT 2018 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 1 / 36

Outline Feistel Cipher 1 Our Results 2 Key Issues in Security Proofs 3 Conclusion 4 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 2 / 36

Block Ciphers • Usually iterative designs • Fall into two paradigms: K i − 1 K i G K i ⊕ ⊕ ⊕ P i Feistel Cipher substitution-permutation networks (Even-Mansour Cipher) C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 3 / 36

Feistel cipher v.s. Even-Mansour cipher • Consider constructing a cipher with 2 n -bit blocks. • Feistel: underlying primitives have - smaller size, i.e. , half block size; and - less construction properties, i.e. no need for invertibility K i − 1 K i G K i ⊕ ⊕ P i ⊕ Feistel Cipher Even-Mansour Cipher C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 4 / 36

Feistel cipher v.s. Even-Mansour cipher • Consider constructing a cipher with 2 n -bit blocks. • Feistel: underlying primitives have - smaller size, i.e. , half block size; and - less construction properties, i.e. no need for invertibility • Even-Mansour: larger primitives for higher provable (lower) bound. - O ( n ) rounds for 2 2 n security. - In comparison, for Feistel security is at most 2 n . K i − 1 K i G K i ⊕ ⊕ P i ⊕ Feistel Cipher Even-Mansour Cipher C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 4 / 36

Luby-Rackoff Feistel Cipher • Use a keyed PRF G K for the round function: ( L , R ) �→ ( L ⊕ G K ( R ) , L ) • Long-term research since [Luby and Rackoff, 1988], consists of - provable security lower bound; - cryptanalytic: generic attacks; - bridge abstract model and dedicated ciphers, e.g. practical key size, less round functions; L R ⊕ G K L ′ R ′ C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 5 / 36

Gap between Generic Feistel and Dedicated Cipher • (Recall) the general model: independent round-keys. • In reality: round-keys are derived from a short main-key, thus correlated . - Using identical round-keys: 5 rounds [Pie91] - Using two independent round-keys: [NR99, PRG+99] • Besides, how to design the keyed PRF G K ? L i R i G K i ⊕ L i +1 R i +1 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 6 / 36

Keyed Functions from Keyless Functions • Important and popular research direction: constructing the keyed function from public keyless random functions F i • This turns Luby-Rackoff into key-alternating Feistel [Lampe and Seurin, FSE 2014] L i R i L i R i K i F K i ⊕ ⊕ F i ⊕ L i +1 R i +1 L i +1 R i +1 Luby-Rackoff Feistel = ⇒ Key-Alternating Feistel C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 7 / 36

Key-Alternating Feistel: Provable Security • General case using independent public round functions F i independent round keys K i . rn r +1 security with r = ⌊ t / 6 ⌋ [Lampe and Seurin, FSE • t rounds has 2 2014] (asymptotically optimal) Security #rounds Reference 2 n / 2 6 [Lampe and Seurin] 2 2 n / 3 12 2 3 n / 4 18 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 8 / 36

Key-Alternating Feistel: Generic Attacks • Known as Feistel-2 schemes in the cryptanalytic community [Isobe and Shibutani, ASIACRYPT 2013] Attacks # Rounds Key size Complexity Reference 2 3 n / 2 Key-Recovery 6 2 n [Guo et al, 2 8 n / 3 8 3 n ASIACRYPT 2014] 2 11 n / 3 10 4 n C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 9 / 36

Outline Feistel Cipher 1 Our Results 2 Key Issues in Security Proofs 3 Conclusion 4 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 10 / 36

In Short We revisit the information-theoretic security of key-alternating Feistel in the ideal model. • We prove security for correlated round-keys. • We prove non-degradating multi-user security. L i R i K i ⊕ F i ⊕ L i +1 R i +1 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 11 / 36

Recapitulating Previous Result • Assume independent round-keys K i In reality: correlated round-keys. • Assume (mostly) independent public round functions F i In reality: identical round functions. Security #rounds Reference 2 n / 2 4 [Gentry and Ramzan, ASIACRYPT 2004] 2 n / 2 6 [Lampe and Seurin, FSE 2014] 2 2 n / 3 12 2 3 n / 4 18 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 12 / 36

Our First Result for Birthday 2 n / 2 Security K 1 ⊕ ⊕ F • Uses 4 rounds with single public round function K 2 ⊕ ⊕ F • Uses Suitable Round Key Vec- tors − → K = ( K 1 , K 2 , K 3 , K 4 ): K 3 - K 1 is uniformly distributed; ⊕ ⊕ F - K 4 is uniformly distributed; - K 1 ⊕ K 4 is uniformly dis- K 4 tributed; ⊕ ⊕ F C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 13 / 36

Our First Result for Birthday 2 n / 2 Security • Denote q e the number of cipher queries • Denote q f the number of function queries Theorem For the 4-round idealized Key-Alternating Feistel with a Single public round Function (SF) and a suitable round-key vector, in single-user (su) setting it holds KAFSF ( q f , q e ) ≤ 9 q 2 e + 4 q e q f Adv su . N In the multi-user (mu) setting it holds KAFSF ( q f , q e ) ≤ 50 q 2 e + 8 q e q f Adv mu . N C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 14 / 36

Minimalism • Derive round-keys from an n -bit main-key K • Key-schedule function π is a public and fixed orthomorphism of F n 2 , e.g., π ( K L � K R ) = K L ⊕ K R � K L K ⊕ ⊕ F ⊕ F π ⊕ F ⊕ ⊕ F C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 15 / 36

Minimalism No round-key in middle rounds. • But of course you can add any round-keys, they won’t reduce security. • On the other hand, the “unprotected” middle two rounds match Ramzan and Reyzin (CRYPTO 2000), who showed that the middle two round functions of 4-round Luby-Rackoff scheme can be public. K ⊕ ⊕ F ⊕ F π ⊕ F ⊕ ⊕ F C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 16 / 36

Our Second Result for Beyond-Birthday Security • We consider independent round functions for simplicity. • We prove 6 rounds have 2 (2 n − r ) / 3 security, when using Suitable Round Key Vectors − → K = ( K 1 , K 2 , K 3 , K 4 , K 5 , K 6 ) such that - K 1 , K 3 , K 5 are uniform in { 0 , 1 } n , K 2 , K 4 , K 6 are uniform in 2 n − r possibilities - for ( i , j ) ∈ { (1 , 2) , (2 , 3) , (4 , 5) , (5 , 6) , (1 , 6) } , K i and K j are independent This means “adjacent” round-keys are independent. This is easily ensured by the common FSR-based key-schedules. C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 17 / 36

Our Second Result for Beyond-Birthday Security Theorem For the 6-round idealized Key-Alternating Feistel with a suitable round-key vector, in single-user (su) setting it holds KAF ( q f , q e ) ≤ 7 q 3 e + 13 q e q 2 f + 22 q 2 + 2 r (8 q e q 2 f + 2 q 2 e q f e q f ) Adv su . N 2 N 2 In multi-user (mu) setting it holds KAF ( q f , q e ) ≤ 1214 q 3 e + 26 q e q 2 f + 356 q 2 + 2 r (600 q 3 e + 16 q e q 2 f + 196 q 2 e q f e q f ) Adv mu . N 2 N 2 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 18 / 36

The Simplest Example Alternating two main-keys | K 1 | = n , | K 2 | = n − r . K 1 K 2 k 1 y 1 x 1 F 1 y 1 F 1 x 1 k 2 y 2 x 2 F 2 y 2 F 2 x 2 X k 3 y 3 x 3 F 3 y 3 x 3 F 3 Y k 4 y 4 F 4 x 4 y 4 x 4 F 4 Z k 5 y 5 F 5 x 5 y 5 x 5 F 5 A k 6 y 6 F 6 x 6 y 6 F 6 x 6 S K 2 K 1 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 19 / 36

Collapses to Partial-key Even-Mansour (PKEM) This means the permutation in PKEM can be instantiated with a 6-round keyless Feistel for beyond-birthday security. K 2 K 1 k 1 y 1 F 1 x 1 y 1 F 1 x 1 k 2 y 2 F 2 x 2 y 2 F 2 x 2 X k 3 y 3 F 3 x 3 y 3 F 3 x 3 Y k 4 y 4 F 4 x 4 y 4 F 4 x 4 Z k 5 y 5 F 5 x 5 y 5 x 5 F 5 A k 6 y 6 F 6 x 6 y 6 x 6 F 6 S K 2 K 1 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 20 / 36

Application: Instantiating Keyed Sponges Keyed sponges can be used for MACs and authenticated encryption. M [1] M [2] M [ ℓ ] z trunc r 0 ... π π π π π c K K [1] K [ w ] M [1] M [2] M [ ℓ ] z trunc r 0 ... ... L π π π π π π c 0 C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 21 / 36

Application: Instantiating Keyed Sponges Many (inner and outer) keyed sponges have their security reduce to the PKEM cipher. We show PKEM can be instantiated with the 6-round keyless Feistel Ψ 6 . So (inner and outer) keyed sponges can also be instantiated with the 6-round keyless Feistel Ψ 6 . M [1] M [2] M [3] M [1] M [2] M [3] ... ... Ψ 6 Ψ 6 Ψ 6 π π π ... ... K K K K K K K K K K K K PKEM C. Guo, L. Wang (SJTU) Revisiting KAF December 3, 2018 22 / 36