Short Variable Length Domain Extenders With Beyond Birthday Bound - PowerPoint PPT Presentation

Short Variable Length Domain Extenders With Beyond Birthday Bound Security Yu Long Chen 1 Bart Mennink 2 Mridul Nandi 3 imec-COSIC, KU Leuven Digital Security Group, Radboud University, Nijmegen Indian Statistical Institute, Kolkata December 3, 2018 1 / 23

Modes of Operation ◮ Block cipher: fixed-input-length (FIL) 2 / 23

Modes of Operation ◮ Block cipher: fixed-input-length (FIL) ◮ Apply block cipher iteratively CBC mode . . . M 1 M 2 M l − 1 M l + + + + IV E K E K E K E K . . . C l − 1 C l C 1 C 2 2 / 23

Modes of Operation Fractional data = ⇒ padding CBC+padding M ∗ . . . M 1 M 2 M l − 1 l 3 / 23

Modes of Operation Fractional data = ⇒ padding CBC+padding M ∗ 10 ∗ . . . M 1 M 2 M l − 1 l 3 / 23

Modes of Operation Fractional data = ⇒ padding CBC+padding M ∗ 10 ∗ . . . M 1 M 2 M l − 1 l + + + + IV E K E K E K E K . . . C 1 C 2 C l − 1 C l 3 / 23

Modes of Operation Fractional data = ⇒ padding CBC+padding M ∗ 10 ∗ . . . M 1 M 2 M l − 1 l + + + + IV E K E K E K E K . . . C 1 C 2 C l − 1 C l Ciphertext expansion: | C | > | M | 3 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 4 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 2. Non-generic methods: EME, TET, HEH, HCTR, HCH, XCB 4 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 2. Non-generic methods: EME, TET, HEH, HCTR, HCH, XCB 3. Ciphertext stealing: . . . M ∗ M 1 M 2 M l − 1 l 4 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 2. Non-generic methods: EME, TET, HEH, HCTR, HCH, XCB 3. Ciphertext stealing: . . . M ∗ 10 ∗ M 1 M 2 M l − 1 l 4 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 2. Non-generic methods: EME, TET, HEH, HCTR, HCH, XCB 3. Ciphertext stealing: . . . M ∗ 10 ∗ M 1 M 2 M l − 1 l + + + + IV E K E K E K E K C l − 1 C l . . . C 1 C 2 4 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 2. Non-generic methods: EME, TET, HEH, HCTR, HCH, XCB 3. Ciphertext stealing: . . . M ∗ 10 ∗ M 1 M 2 M l − 1 l + + + + IV E K E K E K E K C l − 1 C l . . . C 1 C 2 4 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 2. Non-generic methods: EME, TET, HEH, HCTR, HCH, XCB 3. Ciphertext stealing: . . . M ∗ 10 ∗ M 1 M 2 M l − 1 l + + + + IV E K E K E K E K C l − 1 C l . . . C ∗ C 1 C 2 C l l − 1 4 / 23

Avoiding Ciphertext Expansion 1. CTR: turns block cipher into stream cipher = ⇒ not suitable for some applications 2. Non-generic methods: EME, TET, HEH, HCTR, HCH, XCB 3. Ciphertext stealing: . . . M ∗ 10 ∗ M 1 M 2 M l − 1 l + + + + IV E K E K E K E K C l − 1 C l . . . C ∗ C 1 C 2 C l l − 1 ◮ Condition: C i ’s need to be decrypted independently 4 / 23

Length Doublers M 1 M 2 length doubler [ n -bit enciphering scheme] C 1 C 2 ◮ | M 1 | = | C 1 | = n = block size ◮ | M 2 | = | C 2 | ∈ [ 0 , n − 1 ] 5 / 23

Beyond Birthday Bound Length Doubler ◮ Format-preserving encryption ◮ Electronic product code tag encryption 6 / 23

Beyond Birthday Bound Length Doubler ◮ Format-preserving encryption ◮ Electronic product code tag encryption M � 80 2 n / 2 doubler [64-bit BC] � 80 C 32-bits security 6 / 23

Beyond Birthday Bound Length Doubler ◮ Format-preserving encryption ◮ Electronic product code tag encryption M M � 80 � 80 2 n / 2 doubler 2 3 n / 4 doubler [64-bit BC] [64-bit BC] � 80 � 80 C C 32-bits security 48-bits security 6 / 23

Security Definition E ± ρ ± K adversary A ◮ Adversary A makes q queries to oracle ( E K or ρ ) 7 / 23

Security Definition E ± ρ ± K adversary A ◮ Adversary A makes q queries to oracle ( E K or ρ ) ◮ Strong length-preserving pseudorandom permutation ⇐ ⇒ A cannot determine which world it is interacting with 7 / 23

Round Function F [˜ E K ] M 1 M 2 � n � s T 1 ˜ E K 1 � 10 ∗ right s ( Y ) left n − s ( Y ) � n − s � n � s C 1 C 2 8 / 23

2-LDT Security upper bound: ◮ 2 n − ( s / 2 ) Security lower bound ◮ 2 n / 2 (ToSC 2017(3)) 9 / 23

2-LDT Security upper bound: ◮ 2 n − ( s / 2 ) Security lower bound ◮ 2 n / 2 (ToSC 2017(3)) ◮ “New bound” 9 / 23

3-LDT Security lower bound ◮ “New bound” ◮ Better bound than 2-LDT 10 / 23

Security Analysis of 3-LDT security n 11 n / 12 7 n / 8 s min ≈ 5 n / 6 s max s max ≈ ( n + s min ) / 2 3 n / 4 2 n / 3 5 n / 8 n / 2 s min const n / 4 n / 2 3 n / 4 n − 2 log 2 ( n ) s min ≤ s max ≤ ( n + s min ) / 2 11 / 23

Security Bound of 2-LDT and 3-LDT security ◦ = 2-LDT ⋆ = 3-LDT n ⋆ 11 n / 12 ⋆ 5 n / 6 ⋆ 3 n / 4 ⋆ 2 n / 3 ⋆ ◦ 7 n / 12 ◦ n / 2 ◦ ◦ ◦ input size n 5 n / 4 3 n / 2 7 n / 4 2 n − 1 12 / 23

Harmonic Permutation Primitives (Tweakable) pseudorandom permutation G a , b and H a , b ◮ a , b ∈ { 0 , 1 } ◮ a = forward, b = inverse ◮ 0 = random permutation, 1 = special 13 / 23

Harmonic Permutation Primitives (Tweakable) pseudorandom permutation G a , b and H a , b ◮ a , b ∈ { 0 , 1 } ◮ a = forward, b = inverse ◮ 0 = random permutation, 1 = special a = 0 b = 0 13 / 23

Harmonic Permutation Primitives (Tweakable) pseudorandom permutation G a , b and H a , b ◮ a , b ∈ { 0 , 1 } ◮ a = forward, b = inverse ◮ 0 = random permutation, 1 = special a = 0 ideal primitive b = 0 13 / 23

Harmonic Permutation Primitives (Tweakable) pseudorandom permutation G a , b and H a , b ◮ a , b ∈ { 0 , 1 } ◮ a = forward, b = inverse ◮ 0 = random permutation, 1 = special a = 0 a = 1 ideal primitive b = 0 b = 0 a = 0 a = 1 b = 1 b = 1 13 / 23

Harmonic Permutation Primitives If a = 1 or b = 1, then part of permutation random 14 / 23

Harmonic Permutation Primitives If a = 1 or b = 1, then s -bits part of permutation random 14 / 23

Harmonic Permutation Primitives If a = 1 or b = 1, then s -bits part of permutation random ( n − s ) -bits ( n − s ) -bits ⇓ permutation 14 / 23

Harmonic Permutation Primitives If a = 1 or b = 1, then s -bits part of permutation random part of permutation random ( n − s ) -bits ( n − s ) -bits ⇓ permutation 14 / 23

Proof Idea M 1 M 2 M 1 M 2 � n � s � n � s T 1 ˜ E K 1 � 10 ∗ right s ( Y 1 ) left n − s ( Y 1 ) n – s � � s T 2 ˜ ρ E K 2 � 10 ∗ right s ( Y 2 ) left n − s ( Y 2 ) n – s � T 3 ˜ E K 3 � 10 ∗ � s � s � n � n C 1 C 2 C 1 C 2 15 / 23

Proof Idea − � $ π 1 , ˜ ˜ π 2 , ˜ π 3 ← Perm ( n , n ) M 1 M 2 M 1 M 2 � n � s � n � s T 1 ˜ π 1 � 10 ∗ right s ( Y 1 ) left n − s ( Y 1 ) n – s � � s T 2 ρ π 2 ˜ � 10 ∗ right s ( Y 2 ) left n − s ( Y 2 ) n – s � T 3 π 3 ˜ � 10 ∗ � s � n � s � n C 1 C 2 C 1 C 2 16 / 23

Proof Idea M 1 M 2 M 1 M 2 � n � s � n � s T 1 G 0 , 0 � 10 ∗ right s ( Y 1 ) left n − s ( Y 1 ) n – s � � s T 2 G 0 , 0 H 0 , 0 � 10 ∗ right s ( Y 2 ) left n − s ( Y 2 ) n – s � T 3 G 0 , 0 � 10 ∗ � s � s � n � n C 1 C 2 C 1 C 2 17 / 23

Proof Idea [Reduction] ≤ 18 / 23

Proof Idea [Step 1] M 1 M 2 M 1 M 2 � n � s � n � s T 1 T 1 G 0 , 0 G 0 , 1 � 10 ∗ � 10 ∗ right s ( Y 1 ) right s ( Y 1 ) left n − s ( Y 1 ) left n − s ( Y 1 ) n – s � n – s � � s � s T 2 T 2 G 0 , 0 G 1 , 1 � 10 ∗ � 10 ∗ right s ( Y 2 ) right s ( Y 2 ) left n − s ( Y 2 ) left n − s ( Y 2 ) n – s � n – s � T 3 T 3 G 0 , 0 G 1 , 0 � 10 ∗ � 10 ∗ � s � s � n � n C 1 C 2 C 1 C 2 19 / 23

Proof Idea [Step 1] T M C G 0 , 1 T T C C M M G 1 , 1 G 0 , 0 T M C G 1 , 0 20 / 23

Proof Idea [Step 2] M 1 M 2 M 1 M 2 � n � s � n � s T 1 G 0 , 1 � 10 ∗ right s ( Y 1 ) left n − s ( Y 1 ) n – s � � s T 2 G 1 , 1 H 1 , 1 � 10 ∗ right s ( Y 2 ) left n − s ( Y 2 ) n – s � T 3 G 1 , 0 � 10 ∗ � s � s � n � n C 1 C 2 C 1 C 2 21 / 23

Proof Idea [Step 2] M 1 M 2 M 1 M 2 � n � s � n � s T 1 G 0 , 1 � 10 ∗ Indistinguishable right s ( Y 1 ) left n − s ( Y 1 ) n – s � � s T 2 G 1 , 1 H 1 , 1 � 10 ∗ right s ( Y 2 ) left n − s ( Y 2 ) n – s � T 3 G 1 , 0 � 10 ∗ � s � s � n � n C 1 C 2 C 1 C 2 21 / 23

Proof Idea [Step 3] M 1 M 2 M 1 M 2 � n � s � n � s H 1 , 1 H 0 , 0 � s � s � n � n C 1 C 2 C 1 C 2 22 / 23

Conclusion New results ◮ Harmonic primitives ◮ 2-LDT: beyond birthday bound ◮ 3-LDT: better bound 23 / 23

Conclusion New results ◮ Harmonic primitives ◮ 2-LDT: beyond birthday bound ◮ 3-LDT: better bound Further research ◮ 2-LDT and 3-LDT: tight bound? ◮ 3-LDT: optimal security? ◮ Harmonic primitives: tight bound and use for other constructions? 23 / 23