Authenticated Encryption with Variable Stretch Reza Reyhanitabar 1 - - PowerPoint PPT Presentation

▶
authenticated encryption with variable stretch
SMART_READER_LITE
LIVE PREVIEW

Authenticated Encryption with Variable Stretch Reza Reyhanitabar 1 - - PowerPoint PPT Presentation

Feb 03, 2024 250 likes •696 views

Authenticated Encryption with Variable Stretch Reza Reyhanitabar 1 Serge Vaudenay 2 Damian Vizr 2 1 NEC Laboratories Europe, Germany 2 EPFL, Switzerland DIAC 2016: Directions in Authenticated Ciphers 2016 This work was partially supported by

slide-1
SLIDE 1

Authenticated Encryption with Variable Stretch

Reza Reyhanitabar1 Serge Vaudenay2 Damian Vizár2

1 NEC Laboratories Europe, Germany 2 EPFL, Switzerland

DIAC 2016: Directions in Authenticated Ciphers 2016

This work was partially supported by Microsoft Research

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 1 / 22

slide-2
SLIDE 2

Authenticated Encryption

E

K M

D

K M *G%FS ??!! #RJ%K ⊥ A A

◮ Confidentiality+Authenticity/Integrity for M

[Bellare,Namprempre 00],[Katz,Yung 00]

◮ Authenticity for A

[Rogaway 02]

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 2 / 22

slide-3
SLIDE 3

Authenticated Encryption

E

K M

D

K M *G%FS ??!! #RJ%K ⊥ A A

Need redundancy

◮ Confidentiality+Authenticity/Integrity for M

[Bellare,Namprempre 00],[Katz,Yung 00]

◮ Authenticity for A

[Rogaway 02]

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 2 / 22

slide-4
SLIDE 4

Ciphertext Epxansion

a.k.a. Stretch

Redundancy in AE: ciphertext expansion

M EK C τ bits

Ciphertext expanded by τ bits ⇒ Expected cost of forgery: ≈ 2τ queries

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 3 / 22

slide-5
SLIDE 5

How to Stretch?

w.r.t. the Syntax of Security Notions

Group 1: (Mostly) constant τ, parameter of the scheme

nAE [Rogaway, Bellare, Black, Krovetz 01] AEAD [Rogaway 02] DAE and MRAE [Rogaway, Shrimpton 06] OAE [Fleischmann, Forler, Lucks 12] AE-RUP [Andreeva, Bogdanov, Luykx, Mennink, Mouha, Yasuda 14] OAE2 [Hoang, Reyhanitabar, Rogaway, V 15]

Group 2: User-selectable τ per query

RAE [Hoang, Krovetz, Rogaway 15]

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 4 / 22

slide-6
SLIDE 6

How to Stretch?

w.r.t. the Syntax of Security Notions

Group 1: (Mostly) constant τ, parameter of the scheme

nAE [Rogaway, Bellare, Black, Krovetz 01] AEAD [Rogaway 02] DAE and MRAE [Rogaway, Shrimpton 06] OAE [Fleischmann, Forler, Lucks 12] AE-RUP [Andreeva, Bogdanov, Luykx, Mennink, Mouha, Yasuda 14] OAE2 [Hoang, Reyhanitabar, Rogaway, V 15]

◮ Different tag lengths ⇒ independent keys

Group 2: User-selectable τ per query

RAE [Hoang, Krovetz, Rogaway 15]

◮ “Best possible security”, hard to achieve ◮ Cannot be “online” ◮ Complicated, difficult to implement

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 4 / 22

slide-7
SLIDE 7

Stretch-Misuse

Group 1: Constant τ, parameter of the scheme

nAE AEAD DAE and MRAE OAE AE-RUP OAE2

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 5 / 22

slide-8
SLIDE 8

Stretch-Misuse

Group 1: Constant τ, parameter of the scheme

nAE AEAD DAE and MRAE OAE AE-RUP OAE2

What happens if stretch is (mis)treated as a user input?

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 5 / 22

slide-9
SLIDE 9

Stretch-Misuse

Why Should we Consider It?

Because it is tempting: Handling multiple keys is annoying “Sliding-scale” authenticity as a feature

(τ bits of stretch ⇒ τ bits of authenticity for individual messages) E.g. moderate τ1 for most messages and huge τ2 for critical

Saving resources in constrained systems

E.g. sensor nodes: wireless communication is expensive Reducing security to increase battery life (key exchange way too

expensive)

M EK C

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 6 / 22

slide-10
SLIDE 10

Stretch-Misuse

Why Should we Consider It?

Because it is easy to do: Most often: a default authentication tag that is truncated

trunc

M C-core T

EncK

n bits τ bits N A

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 6 / 22

slide-11
SLIDE 11

Stretch-Misuse

Why Should we Consider It?

Because it is easy to do: Most often: a default authentication tag that is truncated

trunc

M C-core T

EncK

n bits τ bits N A

Because it is a matter of “when”, not “if” a misuse occurs Past examples of this for other misuses

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 6 / 22

slide-12
SLIDE 12

Stretch-Misuse

Why Should we Consider It?

Because it is easy to do: Most often: a default authentication tag that is truncated

trunc

M C-core T

EncK

n bits τ bits N A

Because it is a matter of “when”, not “if” a misuse occurs Past examples of this for other misuses . . . and because there are attacks

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 6 / 22

slide-13
SLIDE 13

Nonce-based AE with Associated Data (AEAD)

Enc N A C M Dec N A C M

  • r ⊥

K K

Enc, Dec: deterministic algorithms N: Nonce (public message number) that must not repeat A: Associated Data that must be authenticated, but not encrypted M: Plaintext that must be encrypted and authenticated C: Ciphertext (stretched by τ bits) K: Secret key

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 7 / 22

slide-14
SLIDE 14

Nonce-based AE with Associated Data (AEAD)

Enc N A C M Dec N A C M

  • r ⊥

K K

Enc, Dec: deterministic algorithms N: Nonce (public message number) that must not repeat A: Associated Data that must be authenticated, but not encrypted M: Plaintext that must be encrypted and authenticated C: Ciphertext (stretched by τ bits) K: Secret key

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 7 / 22

slide-15
SLIDE 15

Nonce-based AE with Associated Data (AEAD)

Enc N A C M Dec N A C M

  • r ⊥

K K

Enc, Dec: deterministic algorithms N: Nonce (public message number) that must not repeat A: Associated Data that must be authenticated, but not encrypted M: Plaintext that must be encrypted and authenticated C: Ciphertext (stretched by τ bits) K: Secret key

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 7 / 22

slide-16
SLIDE 16

Nonce-based AE with Associated Data

N never repeats, (N, A, C) not trivially correct:

EncK(·, ·, ·)

A

N, A, M C C $(·, ·, ·) DecK(·, ·, ·) M/⊥ ⊥ ⊥(·, ·, ·) N, A, C

Advaead

Π

(A) = Pr

  • AEncK (·,·,·),DecK (·,·,·) ⇒ 1
  • − Pr
  • A$(·,·,·),⊥(·,·,·) ⇒ 1
  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 8 / 22

slide-17
SLIDE 17

Nonce-based AE with Associated Data

N never repeats, (N, A, C) not trivially correct:

EncK(·, ·, ·)

A

N, A, M C C $(·, ·, ·) DecK(·, ·, ·) M/⊥ ⊥ ⊥(·, ·, ·) N, A, C

. . . and the ciphertext expansion is assumed to be constant Advaead

Π

(A) = Pr

  • AEncK (·,·,·),DecK (·,·,·) ⇒ 1
  • − Pr
  • A$(·,·,·),⊥(·,·,·) ⇒ 1
  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 8 / 22

slide-18
SLIDE 18

Trivial Tag Length-Variation Attack on AEAD

“Versions of OCB with different tag lengths exist, tag truncation trivially correct if used under same key” [Manger 13, CFRG discussion]

trunc

M C-core T

EncK

n bits τ bits N A 1

Query CT ←OCB[128]K(N, A, M) for target (N, A, M)

2

Compute T ′ ← trunc(T, 64)

3

“Forge” CT ′ ←OCB[64]−1

K (N, A, CT ′)

Obvious property, but . . . . . . contradicts the intuition of τ-bit resistance to forgery

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 9 / 22

slide-19
SLIDE 19

Trivial Tag Length-Variation Attack on AEAD

“Would it be better if the algorithms with different tag lengths could not affect each other?” Probably! Ad-hoc solutions proposed: OCB adopts fix proposed by Manger: “just drop the tag length into the nonce” Nandi proposes to do the same with AD CLOC&SILC, OTR and OMD heuristically tweaked for round 2 of CAESAR competition

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 9 / 22

slide-20
SLIDE 20

Gradual Forgery for Ciphertext Translation

Ciphertext Translation

Message-only core + AD-“hash”

EK

N M A

HK

CM

0|M|

C

τ bits

|M| + τ bits

n bits

message-ciphertext already “looks random” HK can be AXU

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 10 / 22

slide-21
SLIDE 21

Gradual Forgery for Ciphertext Translation

The Attack

Original attack: gradual forgery on OMD [Dobraunig, Eichlseder, Mendel,

Schläffer 14]

Access to Enc and Dec oracles with stretch τ1 < τ2 < . . . < τg using the same key, scheme with ciphertext translation structure Forgery for N, A∗, M with τg bits of stretch

EncK[τ1](·, ·, ·)

A

DecK[τ1](·, ·, ·) EncK[τ2](·, ·, ·) DecK[τ2](·, ·, ·)

b b b

EncK[τg](·, ·, ·) DecK[τg](·, ·, ·) EncK[τg−1](·, ·, ·) DecK[τg−1](·, ·, ·)

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 11 / 22

slide-22
SLIDE 22

Gradual Forgery for Ciphertext Translation

The Attack

1

Pick some A = A∗

2

Get CT ← Enc[τ 1](N, A, M)

3

Find δ ∈ {0, 1}τ 1 s.t. Dec[τ 1](N, A∗, C(T ⊕ δ)) succeeds

4

Set ∆A ← δ

⊲ ∆A = trunc(HK(A) ⊕ HK(A∗), τ1)

EK

N M A

HK

CM

0|M|

C

τ1 bits n bits

EK

N M A∗

HK

CM

0|M|

C

∆A

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 11 / 22

slide-23
SLIDE 23

Gradual Forgery for Ciphertext Translation

The Attack

5

Get CT ← Enc[τ 2](N, A, M)

6

Find δ ∈ {0, 1}τ 2−τ 1 s.t. Dec[τ g](N, A∗, C(T ⊕ ∆Aδ)) succeeds

7

Set ∆A ← ∆Aδ

EK

N M A

HK

CM

0|M|

C

τ1,τ2 − τ1 bits n bits

EK

N M A∗

HK

CM

0|M|

C

∆Aδ

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 11 / 22

slide-24
SLIDE 24

Gradual Forgery for Ciphertext Translation

The Attack

  • • •

f Get CT ← Enc[τ g](N, A, M) i Find δ ∈ {0, 1}τ g−1−τ g s.t. Dec[τ g](N, A∗, C(T ⊕ δ)) succeeds n Output forgery N, A∗, C(∆Aδ)

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 11 / 22

slide-25
SLIDE 25

Gradual Forgery for Ciphertext Translation

Complexity

single encryption query per stretch 2τi−τi−1 decryption queries stretched by τi bits for 1 < i ≤ ℓ 2τ1 decryption queries stretched by τ1 Forgery for τg bits of stretch with 2τg−τg−1 decryption queries stretched by τg bits versus the intuition of τg bit security E.g. if IT = {32, 64, 96, 128}, then forging a 128-bit tag takes 4 · 232 decryption queries in total

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 12 / 22

slide-26
SLIDE 26

Gradual Forgery for Ciphertext Translation

Applicability

◮ If no countermeasures OR τ in nonce ⇒ works for arbitrary HK

⊲ OTR

◮ If τ in AD (or in both AD and nonce) ⇒ works for HK like below

⊲ Deoxys, OCB, GCM

H(1)

K

HK(A) A1 A2 Aa

H(2)

K

H(a)

K

b b b b b b

τ only here

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 13 / 22

slide-27
SLIDE 27

Capturing AEAD Security with Variable Tags

Π = (Enc, Dec, K) defined with τ ∈ IT = {τ1, τ2, . . . , τℓ} Distinguishing all instances: not capturing intuition

A

EncK[τ1](·, ·, ·) $[τ1](·, ·, ·) EncK[τ2](·, ·, ·) $[τ2](·, ·, ·) EncK[τℓ](·, ·, ·) $[τℓ](·, ·, ·) EncK[τℓ−1](·, ·, ·) $[τℓ−1](·, ·, ·)

b b b

DecK[τ1](·, ·, ·) DecK[τ2](·, ·, ·) DecK[τℓ](·, ·, ·) DecK[τℓ−1](·, ·, ·) ⊥(·, ·, ·)

b b b

⊥(·, ·, ·) ⊥(·, ·, ·) ⊥(·, ·, ·) ⊥(·, ·, ·) ⊥(·, ·, ·) ⊥(·, ·, ·)

◮ A can always win with 2min IT queries (conservative evaluation) ◮ Interactions between stretches not captured

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 14 / 22

slide-28
SLIDE 28

Capturing AEAD Security with Variable Tags: nvae(τc)

fixed but arbitrary “challenge” stretch τc:

Unique nonces for (nonce,stretch) pairs Only non-trivial forgeries stretched by τc bits

A

EncK[τ1](·, ·, ·) EncK[τ2](·, ·, ·) EncK[τℓ](·, ·, ·) EncK[τℓ−1](·, ·, ·)

b b b

DecK[τ1](·, ·, ·) DecK[τ2](·, ·, ·) DecK[τℓ](·, ·, ·) DecK[τℓ−1](·, ·, ·)

b b b

DecK[τc](·, ·, ·) EncK[τc](·, ·, ·) $[τc](·, ·, ·) ⊥(·, ·, ·)

b b b b b b

EncK[τ1](·, ·, ·) EncK[τ2](·, ·, ·) DecK[τ1](·, ·, ·) DecK[τ2](·, ·, ·) EncK[τℓ](·, ·, ·) EncK[τℓ−1](·, ·, ·) DecK[τℓ](·, ·, ·) DecK[τℓ−1](·, ·, ·) EncK[τ2](·, ·, ·)

Advnvae(τc)

Π

(A) = Pr

  • Atop system ⇒ 1
  • − Pr
  • Alower system ⇒ 1
  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 15 / 22

slide-29
SLIDE 29

nvae(τc)

Adversarial Resources

Default resources: Time t For every value of stretch τ ∈ IT watch:

Number of encryption queries qτ

e

Number of decryption queries qτ

d

Amount of data στ

Fine granularity, flexibility and generality

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 16 / 22

slide-30
SLIDE 30

nvae(τc)

Adversarial Resources

Default resources: Time t For every value of stretch τ ∈ IT watch:

Number of encryption queries qτ

e

Number of decryption queries qτ

d

Amount of data στ

Fine granularity, flexibility and generality Coarser granularity best in most cases: Total number of encryptions qe =

τ∈IT qτ e

Total number of decryptions qd =

τ∈IT qdτ

Total amount of data σ =

τ∈IT σdτ

Keep qτc

e , qτc d , στc apart

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 16 / 22

slide-31
SLIDE 31

nvae(τc)

Capturing AEAD Security with Variable tags?

Only distinguishable by queries stretched by τc

E.g. forging with min IT bits of stretch alone does not help

Queries stretched by τ = τc bits can still help

Both truncation and gradual forgery attacks advantage= 1 Truncation: single decryption with stretch τc Gradual: resources depend on other stretch values

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 17 / 22

slide-32
SLIDE 32

nvae(τc)

Capturing AEAD Security with Variable tags?

Only distinguishable by queries stretched by τc

E.g. forging with min IT bits of stretch alone does not help

Queries stretched by τ = τc bits can still help

Both truncation and gradual forgery attacks advantage= 1 Truncation: single decryption with stretch τc Gradual: resources depend on other stretch values

Good advantage? Advnvae(τc)

Π

≤ “small” + c · (qτc

d )α/2τc

“small” due to construction, no direct dependence on τc E.g. “small”= Advprp

B (t, σ) + σ2/2n with B an n-bit blockcipher

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 17 / 22

slide-33
SLIDE 33

Achieving nvAE Modularly

Key-Equivalent Separation by Stretch

◮ Working with stretch space IT = {τ1, τ2, . . . , τℓ} ◮ Encryptions with fresh nonces per stretch

A

EncK[τ1](·, ·, ·) EncK[τ2](·, ·, ·) EncK[τℓ](·, ·, ·) EncK[τℓ−1](·, ·, ·)

b b b

DecK[τ1](·, ·, ·) DecK[τ2](·, ·, ·) DecK[τℓ](·, ·, ·) DecK[τℓ−1](·, ·, ·) EncK1[τ1](·, ·, ·) EncK2[τ2](·, ·, ·) EncKℓ[τℓ](·, ·, ·) EncKℓ−1[τℓ−1](·, ·, ·)

b b b

DecK1[τ1](·, ·, ·) DecK2[τ2](·, ·, ·) DecKℓ[τℓ](·, ·, ·) DecKℓ−1[τℓ−1](·, ·, ·)

Advkess

Π

(A) = Pr

  • Atop system ⇒ 1
  • − Pr
  • Alower system ⇒ 1
  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 18 / 22

slide-34
SLIDE 34

Achieving nvAE Modularly

Key-Equivalent Separation by Stretch

Low kess advantage = AE security, but for any AEAD scheme Π with stretch space IT = {τ1, τ2, . . . , τℓ}: Advnvae(τc)

Π

(t, qe, qd, σ) ≤ Advkess

Π

(t′, qe, qd, σ)+Advaead

Π[τc](t′′, qτc e , qτc d , στc)

where Π[τc] is Π used with τc-bit stretch, and qe the encryption query complexities (qτ

e|τ ∈ IT)

qd the decryption query complexities (qτ

d|τ ∈ IT)

σ the data complexities (στ|τ ∈ IT) ◮ Easier analysis if AEAD security already established!

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 18 / 22

slide-35
SLIDE 35

Achieving nvAE Security

Proof of concept: vOCB, OCB modified to be nvAE secure Add τ as tweak component in all tweaks Show kess security (easy with TBC!) AE security inherited Beyond proof of concept: Modification independent of scheme kess security easy to show nvAE security automatic Can treat also OTR, Deoxys etc.

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 19 / 22

slide-36
SLIDE 36

Achieving nvAE security

vΘCB

  • EN,τ,1,0

K

  • EN,τ,2,0

K

  • EN,τ,4,0

K

  • EN,τ,4,2

K

M1 M2 M4

Checksum

C1 C2 C4 T

Auth

τ Tag Final

  • EN,τ,3,0

K

M3 C3

  • EN,τ,1,0

K

  • EN,τ,2,0

K

  • EN,τ,3,1

K

  • EN,τ,3,3

K

M1 M2 M∗

Checksum

C1 C2 C∗ T

Auth

Tag Final

  • EN,τ,3,0

K

M3 C3 0n

Pad

0∗

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 20 / 22

slide-37
SLIDE 37

Achieving nvAE security

vΘCB

  • Eτ,1,0

K

  • Eτ,2,0

K

A1 A2

  • Eτ,3,0

K

A3

Auth

  • Eτ,1,0

K

  • Eτ,2,0

K

A1 A2

  • Eτ,2,1

K

A∗

Auth

10∗

With a suitable tweakable blockcipher E ◮ With modified XEX (small impact on performance):

Advnvae(τc)

vOCB[E](t, qe, qd, σ) ≤ (|IT| + 2) · Adv±prp E

(t′, 2q) + 28.5q2 2n + qτc

d · 2n−τc

2n − 1

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 20 / 22

slide-38
SLIDE 38

Achieving nvAE security

vΘCB

  • Eτ,1,0

K

  • Eτ,2,0

K

A1 A2

  • Eτ,3,0

K

A3

Auth

  • Eτ,1,0

K

  • Eτ,2,0

K

A1 A2

  • Eτ,2,1

K

A∗

Auth

10∗

With a suitable tweakable blockcipher E ◮ With modified XEX (small impact on performance):

Advnvae(τc)

vOCB[E](t, qe, qd, σ) ≤ (|IT| + 2) · Adv±prp E

(t′, 2q) + 28.5q2 2n + qτc

d · 2n−τc

2n − 1

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 20 / 22

slide-39
SLIDE 39

Achieving nvAE security

vΘCB

  • Eτ,1,0

K

  • Eτ,2,0

K

A1 A2

  • Eτ,3,0

K

A3

Auth

  • Eτ,1,0

K

  • Eτ,2,0

K

A1 A2

  • Eτ,2,1

K

A∗

Auth

10∗

With a suitable tweakable blockcipher E ◮ With modified XEX (small impact on performance):

Advnvae(τc)

vOCB[E](t, qe, qd, σ) ≤ (|IT| + 2) · Adv±prp E

(t′, 2q) + 28.5q2 2n + qτc

d · 2n−τc

2n − 1

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 20 / 22

slide-40
SLIDE 40

Conclusions

AEAD schemes “insecure” with variable stretch

◮ Even with ad-hoc counter measures

We define what it means to be secure We determine relations with existing notions (backup slide!) We show that

nvAE security can be achieved Schemes based on tweakable primitives easily patched

Other schemes?

Other classes of schemes easily fixed, e.g. encoding τ in nonce

works for sponges

Generic transformation: open problem

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 21 / 22

slide-41
SLIDE 41

Questions? Thank you for your attention!

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 22 / 22

slide-42
SLIDE 42

Relations among Notions

nae priv ∧ auth ind − cca nvae(τc) priv(τc) ∧ auth(τc) ind − cca(τc) kess∧nae

Variable-stretch AE notions Conventional AE notions

rae

a b c d e f g h i

Previous works: a [Rogaway, Shrimpton 06] b [Bellare, Namprempre 00] This work: c, d, e, f, g, h, i

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 23 / 22

slide-43
SLIDE 43

Extending XEX

Label every τ ∈ IT bijectively with λ : IT → {0, 1, . . . , |IT| − 1}. Compute m = ⌈log2 |IT|⌉ and

L∗ = EK(0n) Lτ = λ(τ) · 22 · L∗ for τ ∈ IT L(0) = 22+m · L∗ L(ℓ) = 2 · L(ℓ − 1) for ℓ > 0.

Compute ∆-values:

∆N,0,0,0 = H(K, N), ∆N,τ,0,0 = ∆N,0,0,0 ⊕ Lτ, ∆N,τ,i+1,0 = ∆N,τ,i,0 ⊕ L(ntz(i + 1)) for i ≥ 0, ∆N,τ,i,j = ∆N,τ,i,0 ⊕ j · L∗ for j ∈ {0, 1, 2, 3}, ∆τ,0,0 = Lτ, ∆τ,i+1,0 = ∆τ,i,0 ⊕ L(ntz(i + 1)) for i ≥ 0, ∆τ,i,j = ∆τ,i,0 ⊕ j · L∗ for j ∈ {0, 1, 2, 3}.

A call to E is evaluated as follows:

  • EN,τ,i,j

K

(X) =EK(X ⊕ ∆N,τ,i,j) ⊕ ∆N,τ,i,j, or Eτ,i,j

K

(X) = EK(X ⊕ ∆τ,i,j).

  • D. Vizár (EPFL)

Variable Stretch-AE DIAC 2016 24 / 22