Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal - PowerPoint PPT Presentation

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee , Byeonghak Lee KAIST

Tweakable Block Cipher • A tweakable block cipher 𝐹 accepts an additional input "tweak ” - Tweaks are publicly used (like IVs and nonces in modes of operation) - Changing tweaks should be efficient (compared to changing keys)

Motivation: why do we need tweaks  Provide variability to the block cipher  Can be used to construct various cryptographic schemes Vs.

Application: Authenticated Encryption  Tweakable Authenticated Encryption (Liskov, Rivest, Wagner) - TAE can be proved to be secure if the underlying TBC is secure - Typically, the TBC is replaced by a block cipher-based construction (e.g., OCB modes of operation)

Construction of Tweakable Block Ciphers  Dedicated construction - Hasty Pudding, Mercy, Threefish, etc.  Block cipher-based construction - LRW1, LRW2, XEX, XHX, etc.  Permutation-based construction - TEM, XPX, etc.

Block cipher-based Construction  Using fixed keys (independent of tweaks) - Security is proved in the standard model - The underlying BC is replaced by an ideal random permutation (up to the security of TBC)  Using tweak-dependent keys - Security is proved in the ideal cipher model - An adversary is allowed oracle access to the primitive

Security Notion  How should we model secure tweakable block ciphers? - When a secret key is chosen uniformly at random, each tweak should make the keyed block cipher behave like an independent random permutation - This model is similar to the ideal cipher model, but an adversary is not allowed oracle access to the underlying tweakable block cipher Vs.

Security Notion  A tweakable block cipher on {0,1} 𝑜 with key space 𝒧 and tweak space 𝒰 is a function 𝒧 × 𝒰 × {0,1} 𝑜 → {0,1} 𝑜 𝐹: such that 𝐹 (𝐿, 𝑈,∙) (also denoted 𝐹 𝐿 (𝑈,∙) ) is a permutation on {0,1} 𝑜 for each pair of key and tweak (𝐿, 𝑈) .  A tweakable permutation on {0,1} 𝑜 with tweak space 𝒰 is a function 𝒰 × {0,1} 𝑜 → {0,1} 𝑜 𝑄: such that 𝑄 (𝑈,∙) is a permutation on {0,1} 𝑜 for each tweak 𝑈 .

Security Notion  An ideal tweakable permutation is a tweakable permutation that has been chosen uniformly at random from the set of all possible tweakable permutations.  Any distinguisher should not be able to distinguish a tweakable block cipher with a secret random key and an ideal tweakable permutation by making a certain number of oracle queries. Real? or Ideal? 𝐿 𝐹 𝑄 Real world Ideal world

Security Notion for Ideal Cipher-based Construction  An (information-theoretic) adversary is allowed oracle access to both the construction and the ideal cipher Real? or Ideal? 𝑕(𝑢) ℎ(𝑢) 𝐹 𝐹 𝑄 𝐹 x y 𝐹 Real world Ideal world

Security Notion for Ideal Cipher-based Construction  For a distinguisher 𝒠 , its distinguishing advantage is defined by 𝐿 ,𝐹 ,𝐹 − Pr 1 $ 𝒠 𝑄 𝒠 𝐹 𝐁𝐞𝐰 𝐹 𝒠 = Pr 1 $ where 𝑄 is an ideal random tweakable permutation and a key 𝐿 is uniform random  For positive integers 𝑞 and 𝑟 , , 𝐁𝐞𝐰 𝐹 𝑞, 𝑟 = max 𝒠 𝐁𝐞𝐰 𝐹 𝒠 where the maximum is taken over all the distinguishers making 𝑞 block cipher queries and 𝑟 construction queries

1 , 𝐺 2 (Mennink, FSE 2015) 𝐺 When it is based on an 𝑜 -bit block block 1 𝐺 cipher using 𝑜 -bit keys, 1 is secure up to 2 2𝑜/3 queries  𝐺 - BBB-secure with one BC calls [2] is secure up to 2 𝑜 queries  𝐺 - Fully secure with two BC calls 2 𝐺

(Wang, et. al., Aisacrypt 2016) , … , 𝐹32 𝐹1 When it is based on an 𝑜 -bit block block cipher using 𝑜 -bit keys, is secure up to 2 𝑜 queries  𝐹i  Make two block cipher calls (or a single block cipher call by precomputation)  Only xor operation is used

XHX (Jha, et. al., Latincrypt 2017)  XHX uses two types of hash functions - 𝑕: 𝜀 -almost xor-universal and uniform hash function - ℎ: 𝜀′ -almost universal and uniform hash function  When it is based on an 𝑜 -bit block block cipher using 𝑛 -bit keys, 𝑜+𝑛 𝑕(𝑢) ℎ(𝑢) 2 queries XHX is secure up to 2 𝑦 𝑧 𝐹

Uniform/Universal Hash Functions For (small) 𝜀 > 0 ,  A keyed function ℎ is 𝜀 -almost uniform if for any 𝑦 and 𝑧 , Pr[ℎ 𝑦 = 𝑧] ≤ 𝜀.  A keyed function ℎ is 𝜀 -almost universal if for any 𝑦 and 𝑦′ , Pr[ℎ 𝑦 = ℎ(𝑦′)] ≤ 𝜀.  A keyed function ℎ is 𝜀 -almost xor-universal if for any 𝑦 and 𝑧 , Pr[ℎ 𝑦 ⊕ ℎ 𝑦 ′ = 𝑧] ≤ 𝜀.  These functions can be defined as polynomials over a finite field. Cryptology Laboratory @ GSIS, KAIST 15

XHX2: Motivation  The input size of an 𝑜 -bit block block cipher using 𝑛 -bit key is 𝑜 + 𝑛 bits.  In the ideal cipher model, its information-theoretic security cannot go beyond 𝑜 + 𝑛 bits. (due to key exhaustive search) 𝑜+𝑛  With respect to this size, the birthday bound should be 2 .  Can we go beyond the birthday bound?

XHX2: Construction  Cascade of two independent copies of XHX - 𝐹 1 and 𝐹 2 are 𝑜 -bit block ciphers using 𝑛 -bit keys - 𝑕 1 and 𝑕 2 are 𝜀 -almost uniform and universal hash functions - ℎ 1 and ℎ 2 is 𝜀′ -almost uniform and xor-universal hash functions ℎ 1 (𝑢) 𝑕 1 (𝑢) 𝑕 2 (𝑢) ℎ 2 (𝑢) 𝑦 𝑧 𝐹 1 𝐹 2

Provable Security of XHX2 When 𝑕 1 and 𝑕 2 are 𝑜 -bit 𝜀 -almost uniform and universal hash functions, and ℎ 1 and ℎ 2 are 𝑛 -bit 𝜀′ -almost uniform and xor-universal hash functions, one has 𝐁𝐞𝐰 𝑌𝐼𝑌2 𝑞, 𝑟 3 𝜀𝜀 ′ + 256 8𝑟 3 + 2𝑞𝑟 2 1 1 1 + 160 16𝑟 3 + 8𝑞𝑟 2 + 𝑞 2 𝑟 2 𝜀 ′ 2 𝜀 ′ 2 𝜀 2 2 ≤ 64𝑞 3 𝑟 𝑜 2 𝑜 2 2 + 256 16𝑟 3 + 8𝑞𝑟 2 + 2𝑟 2 + 3𝑞 2 𝑟 𝜀 2 (𝜀 ′ ) 2 + 131072𝑜 2 𝑟 2 𝜀 ′ , 2 2𝑜 1 1 where 𝜀 ≈ 2 𝑜 , 𝜀′ ≈ 2 𝑛

Comparison Efficiency Construction Key size Security Ref. E ⨂ / H LRW 2𝑜 𝑜/2 1 1 [LRW02] LRW[2] 4𝑜 2𝑜/3 2 2 [LST12] LRW[s] 2𝑡𝑜 𝑡𝑜/(𝑡 + 2) 𝑡 𝑡 [LS13] [1] 𝑜 2𝑜/3 1 1 [Men15] 𝐺 [2] 𝑜 𝑜 2 0 [Men15] 𝐺 , ⋯ , 𝐹32 𝑜 𝑜 2 0 [Lei + 16] 𝐹1 XHX 𝑜 + 𝑛 (𝑜 + 𝑛)/2 1 1 [Jha + 17] XHX2 2𝑜 + 2𝑛 𝑛𝑗𝑜(2(𝑜 + 𝑛)/3, 𝑜 + 𝑛/2) 2 2 Our work Cryptology Laboratory @ GSIS, KAIST 19

Security of the 2-round XTX  XTX is a tweak-length extension scheme (Minematsu and Iwata, IMACC 2015) 𝑕(𝑢) ℎ(𝑢) 𝑦 𝑧 𝐹  Without allowing block cipher queries ( 𝑞 = 0 ), we can prove beyond- birthday-bound security for the cascade of two independent XTX ℎ 1 (𝑢) constructions. 𝑕 1 (𝑢) 𝑕 2 (𝑢) ℎ 2 (𝑢) 𝑦 𝑧 𝐹 1 𝐹 2

XHX2 from a Practical Viewpoint  In the ideal cipher model, each key should define an independent random permutation  The BBB bound might be useful when the underlying block cipher is relatively small (lightweight)  Such a small block cipher might be vulnerable to related key attacks (i.e., does not fit the ideal cipher model)  XHX2 is suitable for a block cipher with the small block size (with a strong key schedule): - when 𝑜 = 64 and 𝑛 = 128 , XHX2 provides 128 bit security

Transcripts 𝑕 1 (𝑢) ℎ 1 (𝑢) 𝑕 2 (𝑢) ℎ 2 (𝑢) Real? or Ideal? 𝑄 𝐹 1 /𝐹 2 𝐹 1 /𝐹 2 𝑦 𝑧 𝐹 1 𝐹 2 Real world Ideal world Adversary tries to distinguish two worlds by making oracle queries • All the information obtained during the attack is represented by a transcript: • , 𝑕 1 , 𝑕 2 , ℎ 1 , ℎ 1 𝜐 = 𝑅 𝐷 = 𝑢 1 , 𝑦 1 , 𝑧 1 , ⋯ , 𝑢 𝑟 , 𝑦 𝑟 , 𝑧 𝑟 , 𝑅 𝐹 𝑘 = 𝑘, 𝑙 1 , 𝑣 1 , 𝑤 1 , ⋯ , 𝑘, 𝑙 𝑞 , 𝑣 𝑞 , 𝑤 𝑞 Cryptology Laboratory @ GSIS, KAIST 22

Upper Bounding the Distinguishing Advantage 1) T id : Probability distribution of τ in the ideal world 2) T re : Probability distribution of τ in the real world T id − T re 𝐁𝐞𝐰 𝐹 𝒠 ≤ Probability to appear 1 real ideal 0 Transcripts Cryptology Laboratory @ GSIS, KAIST 23

H-Coefficient Lemma We can use following lemma to upper bound the statistical distance. Let Θ = Θ good ⊔ Θ bad be a partition of the set of transcripts. Assume that there exist ϵ 1 , ϵ 2 > 0 such that Pr T id ∈ Θ bad ≤ ϵ 2 , and for any 𝜐 ∈ Θ good , Pr T re = 𝜐 Pr T id = 𝜐 ≥ 1 − ϵ 1 . Then one has ∥ T id − T re ∥ ≤ ϵ 1 + ϵ 2 . Cryptology Laboratory @ GSIS, KAIST 24

Security Proof of XHX2 (Sketch) 1) Define bad transcripts 2) Lower bounding the ratio of probabilities of obtaining a good transcript in the real world and in the ideal world - Pr T id = 𝜐 is easy to compute, while Pr T re = 𝜐 is challenging 3) Apply the H-coefficients Lemma Cryptology Laboratory @ GSIS, KAIST 25

Representation of Construction Queries ℎ 1 (𝑢) 𝑕 1 (𝑢) 𝑕 2 (𝑢) ℎ 2 (𝑢) 𝑦 𝑧 𝐹 1 𝐹 2  Reduced query: combine keys and construction queries 𝑢, 𝑦, 𝑧 ↦ ℎ 1 𝑢 , ℎ 2 𝑢 , 𝑦⨁𝑕 1 𝑢 , 𝑧⨁𝑕 2 𝑢 , 𝑕 1 (𝑢)⨁𝑕 2 𝑢  Black dots represent values fixed by block cipher queries, while white dots are “free” Cryptology Laboratory @ GSIS, KAIST 26