[PPT] - Counter-in-Tweak: Authenticated Encryption Modes for Tweakable PowerPoint Presentation

SLIDE 1

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Counter-in-Tweak: Authenticated Encryption Modes for Tweakable Block Ciphers

Thomas Peyrin1 Yannick Seurin2

1NTU, Singapore 2ANSSI, France

August 15, 2016 — CRYPTO 2016

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 1 / 32

SLIDE 2

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 3

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 4

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 5

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 6

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 7

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 8

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 9

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Context

starting point: CAESAR competition for Authenticated

Encryption (AE)

more precisely, candidates Deoxys, Joltik and KIASU (Jean,

Nikolic, Peyrin)

each is based on a tweakable block cipher (Deoxys-BC,

Joltik-BC, or KIASU-BC) and two modes of operation:

ΘCB for the nonce-respecting setting
COPA for the nonce-misuse setting
problems with COPA:
provides only online nonce-misuse resistance [FFL12, HRRV15]
for fractional messages, relied on XLS which has been

broken [Nan14]

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 2 / 32

SLIDE 10

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 11

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 12

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 13

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 14

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 15

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 16

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 17

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 18

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Our Goal

in replacement of COPA, design an AE mode of operation for

tweakable block ciphers which provides:

1. (full, not online) nonce-misuse resistance up to the birthday

bound

2. beyond-birthday-bound (BBB) security in the nonce-respecting

setting

existing (TBC ⇒ AE) modes:
ΘCB [KR11] is perfectly secure in the nonce-respecting scenario,

but not secure at all in the nonce-misuse scenario

COPA [ABL+13] provides only online nonce-misuse resistance
AEZ [HKR15] provides birthday-security even in the

nonce-respecting scenario

PIV [ST13] requires a very long tweak-length (size of the

maximal message length)

our new mode = SCT (Synthetic Counter in Tweak)
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 3 / 32

SLIDE 19

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Outline

TBCs and AE Generic Composition: the NSIV Method Authentication: the EPWC Mode Encryption: the CTRT Mode Conclusion

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 4 / 32

SLIDE 20

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Outline

TBCs and AE Generic Composition: the NSIV Method Authentication: the EPWC Mode Encryption: the CTRT Mode Conclusion

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 5 / 32

SLIDE 21

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 22

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 23

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 24

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 25

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 26

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 27

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 28

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 29

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Building Block: Tweakable Block Ciphers (TBCs)

EK

Y X T

tweak T: brings variability to the block cipher
T assumed public or even adversarially controlled
each tweak should give an “independent” permutation
few “natively tweakable” BCs:
Hasty Pudding Cipher [Sch98]
Mercy [Cro00]
Threefish [FLS+10]
CAESAR proposals KIASU, Deoxys, Joltik, (i)SCREAM,

Minalpher

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 6 / 32

SLIDE 30

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Goal: Nonce-Based Authenticated Encryption (nAE)

Syntax

A nAE scheme Π is a pair of algorithms (Π.Enc, Π.Dec) where

algorithm Π.Enc takes
(a key K)
a nonce N
associated data A
a message M

and returns a ciphertext C.

algorithm Π.Dec takes K and (N, A, C) and returns M or ⊥.
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 7 / 32

SLIDE 31

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Goal: Nonce-Based Authenticated Encryption (nAE)

EncK(·, ·, ·) DecK(·, ·, ·) A 0/1 (N, A, M) (N, A, C) $(·, ·, ·) ⊥(·, ·, ·) A 0/1 (N, A, M) (N, A, C)

Security (all-in-one definition)

The scheme Π is secure if adversary A cannot distinguish

(EncK, DecK) and ($, ⊥).

A cannot ask a decryption query (N, A, C) if it received C from

an encryption query (N, A, M)

A is said nonce-respecting if it never repeats a nonce in

encryption queries.

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 8 / 32

SLIDE 32

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Misuse-Resistant AE (MRAE)

Nonce-misuse resistance (informal) [RS06]

A nAE scheme is said nonce-misuse resistant if repeating a nonce in encryption queries:

does not harm authenticity
hurts confidentiality only insofar as repetitions of triplets

(N, A, M) are detectable

≃ deterministic authenticated encryption
MRAE schemes cannot be online (each ciphertext bit must

depend on each input bit)

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 9 / 32

SLIDE 33

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Misuse-Resistant AE (MRAE)

Nonce-misuse resistance (informal) [RS06]

A nAE scheme is said nonce-misuse resistant if repeating a nonce in encryption queries:

does not harm authenticity
hurts confidentiality only insofar as repetitions of triplets

(N, A, M) are detectable

≃ deterministic authenticated encryption
MRAE schemes cannot be online (each ciphertext bit must

depend on each input bit)

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 9 / 32

SLIDE 34

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Misuse-Resistant AE (MRAE)

Nonce-misuse resistance (informal) [RS06]

A nAE scheme is said nonce-misuse resistant if repeating a nonce in encryption queries:

does not harm authenticity
hurts confidentiality only insofar as repetitions of triplets

(N, A, M) are detectable

≃ deterministic authenticated encryption
MRAE schemes cannot be online (each ciphertext bit must

depend on each input bit)

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 9 / 32

SLIDE 35

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Outline

TBCs and AE Generic Composition: the NSIV Method Authentication: the EPWC Mode Encryption: the CTRT Mode Conclusion

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 10 / 32

SLIDE 36

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Generic Composition

Starting from two building blocks:

a MAC (or a PRF) FK1(·, ·, ·)
an encryption scheme EncK2(·, ·)

combine them to obtain a nAE scheme [BN00, NRS14]. Two types of encryption schemes:

(random) IV-based encryption (ivE):

C = EncK2(IV , M), IV randomly chosen by the encryption

racle (ex: CBC)
nonce-based encryption (nE):

C = EncK2(N, M), N chosen by the adversary but non-repeating (ex: nonce-based CTR mode, GCM)

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 11 / 32

SLIDE 37

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Generic Composition

Starting from two building blocks:

a MAC (or a PRF) FK1(·, ·, ·)
an encryption scheme EncK2(·, ·)

combine them to obtain a nAE scheme [BN00, NRS14]. Two types of encryption schemes:

(random) IV-based encryption (ivE):

C = EncK2(IV , M), IV randomly chosen by the encryption

racle (ex: CBC)
nonce-based encryption (nE):

C = EncK2(N, M), N chosen by the adversary but non-repeating (ex: nonce-based CTR mode, GCM)

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 11 / 32

SLIDE 38

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Generic Composition

Starting from two building blocks:

a MAC (or a PRF) FK1(·, ·, ·)
an encryption scheme EncK2(·, ·)

combine them to obtain a nAE scheme [BN00, NRS14]. Two types of encryption schemes:

(random) IV-based encryption (ivE):

C = EncK2(IV , M), IV randomly chosen by the encryption

racle (ex: CBC)
nonce-based encryption (nE):

C = EncK2(N, M), N chosen by the adversary but non-repeating (ex: nonce-based CTR mode, GCM)

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 11 / 32

SLIDE 39

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Generic Composition

Starting from two building blocks:

a MAC (or a PRF) FK1(·, ·, ·)
an encryption scheme EncK2(·, ·)

combine them to obtain a nAE scheme [BN00, NRS14]. Two types of encryption schemes:

(random) IV-based encryption (ivE):

C = EncK2(IV , M), IV randomly chosen by the encryption

racle (ex: CBC)
nonce-based encryption (nE):

C = EncK2(N, M), N chosen by the adversary but non-repeating (ex: nonce-based CTR mode, GCM)

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 11 / 32

SLIDE 40

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

From SIV to NSIV

FK1 Π.EncK2 N M A

SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

provides nonce-misuse resistance up to the birthday-bound from

birthday-secure components (e.g. CMAC + CTR encryption)

what about BBB-security in the nonce-respecting case?
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 12 / 32

SLIDE 41

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

From SIV to NSIV

FK1 Π.EncK2 N M A tag

SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

provides nonce-misuse resistance up to the birthday-bound from

birthday-secure components (e.g. CMAC + CTR encryption)

what about BBB-security in the nonce-respecting case?
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 12 / 32

SLIDE 42

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

From SIV to NSIV

FK1 Π.EncK2 N M A tag Conv IV

SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

provides nonce-misuse resistance up to the birthday-bound from

birthday-secure components (e.g. CMAC + CTR encryption)

what about BBB-security in the nonce-respecting case?
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 12 / 32

SLIDE 43

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

From SIV to NSIV

FK1 Π.EncK2 N M A tag Conv IV C

SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

provides nonce-misuse resistance up to the birthday-bound from

birthday-secure components (e.g. CMAC + CTR encryption)

what about BBB-security in the nonce-respecting case?
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 12 / 32

SLIDE 44

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

From SIV to NSIV

FK1 Π.EncK2 N M A tag Conv IV C

SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

provides nonce-misuse resistance up to the birthday-bound from

birthday-secure components (e.g. CMAC + CTR encryption)

what about BBB-security in the nonce-respecting case?
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 12 / 32

SLIDE 45

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

From SIV to NSIV

FK1 Π.EncK2 N M A tag Conv IV C

SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

provides nonce-misuse resistance up to the birthday-bound from

birthday-secure components (e.g. CMAC + CTR encryption)

what about BBB-security in the nonce-respecting case?
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 12 / 32

SLIDE 46

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

From SIV to NSIV

FK1 Π.EncK2 N M A tag Conv IV C

SIV (Synthetic IV) [RS06] combines a PRF FK1(N, A, M) and an

IV-based encryption scheme Π.EncK2(IV , M)

provides nonce-misuse resistance up to the birthday-bound from

birthday-secure components (e.g. CMAC + CTR encryption)

what about BBB-security in the nonce-respecting case?

⇒ Re-use the nonce N in the encryption scheme!

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 12 / 32

SLIDE 47

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Combined Nonce and IV-based (nivE) Encryption

FK1 tag Conv IV C Π.EncK2 N M A

the encryption algorithm Π.Enc takes a nonce and a random IV!
security definition: ciphertexts must be indist. from random,

assuming nonces do not repeat and IV is random

NB: when nonces can be repeated, ≃ (family of) standard

IV-based encryption scheme

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 13 / 32

SLIDE 48

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Combined Nonce and IV-based (nivE) Encryption

FK1 tag Conv IV C Π.EncK2 N M A

the encryption algorithm Π.Enc takes a nonce and a random IV!
security definition: ciphertexts must be indist. from random,

assuming nonces do not repeat and IV is random

NB: when nonces can be repeated, ≃ (family of) standard

IV-based encryption scheme

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 13 / 32

SLIDE 49

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Combined Nonce and IV-based (nivE) Encryption

FK1 tag Conv IV C Π.EncK2 N M A

the encryption algorithm Π.Enc takes a nonce and a random IV!
security definition: ciphertexts must be indist. from random,

assuming nonces do not repeat and IV is random

NB: when nonces can be repeated, ≃ (family of) standard

IV-based encryption scheme

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 13 / 32

SLIDE 50

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Combined Nonce and IV-based (nivE) Encryption

FK1 tag Conv IV C Π.EncK2 N M A

the encryption algorithm Π.Enc takes a nonce and a random IV!
security definition: ciphertexts must be indist. from random,

assuming nonces do not repeat and IV is random

NB: when nonces can be repeated, ≃ (family of) standard

IV-based encryption scheme

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 13 / 32

SLIDE 51

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Combined Nonce and IV-based (nivE) Encryption

FK1 tag Conv IV C Π.EncK2 N M A

the encryption algorithm Π.Enc takes a nonce and a random IV!
security definition: ciphertexts must be indist. from random,

assuming nonces do not repeat and IV is random

NB: when nonces can be repeated, ≃ (family of) standard

IV-based encryption scheme

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 13 / 32

SLIDE 52

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Security Result for NSIV

FK1 tag Conv IV C Π.EncK2 N M A

Theorem

For any adversary A against NSIV[F, Π], AdvnAE

NSIV(A) ≤ AdvnivE Π

(A′) + AdvnPRF

F

(A′′) + AdvnMAC

F

(A′′′). Moreover, if A repeats any nonce at most m times, then A′, A′′, and A′′′ also repeat any nonce at most m times.

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 14 / 32

SLIDE 53

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Instantiating F and Π

FK1 tag Conv IV C Π.EncK2 N M A

Remaining of the talk:

How to instantiate the PRF F and the nivE encryption scheme Π from a TBC E so that

we get BBB-security in the nonce-respecting setting
we retain birthday-bound security in the nonce-misuse setting
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 15 / 32

SLIDE 54

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Outline

TBCs and AE Generic Composition: the NSIV Method Authentication: the EPWC Mode Encryption: the CTRT Mode Conclusion

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 16 / 32

SLIDE 55

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The EPWC (Encrypted Parallel Wegman-Carter) Mode

E 2

K

E 2

K

E 2

K

E 2

K

E 2/3

K

N N A1 A2 A3 10∗ 1 2 3 4 auth

E 4

K

E 4

K

E 4

K

E 4

K

E 4/5

K

M1 M2 M3 M4 M5 10∗ 1 2 3 4 5 auth

E 4

K

tag

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 17 / 32

SLIDE 56

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The EPWC (Encrypted Parallel Wegman-Carter) Mode

PRF(N)

E 2

K

E 2

K

E 2

K

E 2

K

E 2/3

K

N N A1 A2 A3 10∗ 1 2 3 4 auth

E 4

K

E 4

K

E 4

K

E 4

K

E 4/5

K

M1 M2 M3 M4 M5 10∗ 1 2 3 4 5 auth

E 4

K

tag

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 17 / 32

SLIDE 57

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The EPWC (Encrypted Parallel Wegman-Carter) Mode

PHASH(A, M)

E 2

K

E 2

K

E 2

K

E 2

K

E 2/3

K

N N A1 A2 A3 10∗ 1 2 3 4 auth

E 4

K

E 4

K

E 4

K

E 4

K

E 4/5

K

M1 M2 M3 M4 M5 10∗ 1 2 3 4 5 auth

E 4

K

tag

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 17 / 32

SLIDE 58

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The EPWC (Encrypted Parallel Wegman-Carter) Mode

Final encryption (nonce- misuse resistance)

E 2

K

E 2

K

E 2

K

E 2

K

E 2/3

K

N N A1 A2 A3 10∗ 1 2 3 4 auth

E 4

K

E 4

K

E 4

K

E 4

K

E 4/5

K

M1 M2 M3 M4 M5 10∗ 1 2 3 4 5 auth

E 4

K

tag

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 17 / 32

SLIDE 59

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Security of EPWC

Theorem

Let A be an adversary against EPWC with an ideal TBC with block-length n making at most q queries. Then (a) If A is nonce-respecting, AdvnPRF

EPWC(A) ≤ O

q

2n

,

AdvnMAC

EPWC(A) ≤ O

q

2n

.

(b) If A is allowed to repeat nonces, then AdvPRF

EPWC(A) ≤ q2

2n , AdvMAC

EPWC(A) ≤ q2 + q

2n .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 18 / 32

SLIDE 60

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Outline

TBCs and AE Generic Composition: the NSIV Method Authentication: the EPWC Mode Encryption: the CTRT Mode Conclusion

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 19 / 32

SLIDE 61

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The CTRT (CounTeR-in-Tweak) Encryption Mode

C1 M1

EK

C2 M2

EK

C3 M3

EK

C4 M4

EK

C5 M5

EK
how to build a counter-like nivE encryption scheme?
nonce in the tweak ⇒ birthday attack!
switch inputs: nonce in “message input” and counter in tweak
key observation: T →

EK(T, N) is a pseudorandom function

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 20 / 32

SLIDE 62

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The CTRT (CounTeR-in-Tweak) Encryption Mode

C1 M1

EK

IV C2 M2

EK

IV + 1 C3 M3

EK

IV + 2 C4 M4

EK

IV + 3 C5 M5

EK

IV + 4

how to build a counter-like nivE encryption scheme?
nonce in the tweak ⇒ birthday attack!
switch inputs: nonce in “message input” and counter in tweak
key observation: T →

EK(T, N) is a pseudorandom function

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 20 / 32

SLIDE 63

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The CTRT (CounTeR-in-Tweak) Encryption Mode

C1 M1

EK

IV N C2 M2

EK

IV + 1 N C3 M3

EK

IV + 2 N C4 M4

EK

IV + 3 N C5 M5

EK

IV + 4 N

how to build a counter-like nivE encryption scheme?
nonce in the tweak ⇒ birthday attack!
switch inputs: nonce in “message input” and counter in tweak
key observation: T →

EK(T, N) is a pseudorandom function

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 20 / 32

SLIDE 64

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The CTRT (CounTeR-in-Tweak) Encryption Mode

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

how to build a counter-like nivE encryption scheme?
nonce in the tweak ⇒ birthday attack!
switch inputs: nonce in “message input” and counter in tweak
key observation: T →

EK(T, N) is a pseudorandom function

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 20 / 32

SLIDE 65

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The CTRT (CounTeR-in-Tweak) Encryption Mode

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

how to build a counter-like nivE encryption scheme?
nonce in the tweak ⇒ birthday attack!
switch inputs: nonce in “message input” and counter in tweak
key observation: T →

EK(T, N) is a pseudorandom function

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 20 / 32

SLIDE 66

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Security of CTRT

Theorem

n = block-length
t = tweak-length
σ = total length of queries (in n-bit blocks)
m = maximal number of repetitions of any nonce

AdvnivE

CTRT(A) ≤ 2(m − 1)σ

2t + 1 2t + 2σ log2 σ 2n when σ ≤ 2t, + 2t2σ2 2n+t when σ ≥ 2t.

nonce-respecting (m = 1):

security up to σ ≃ min{2n, 2(n+t)/2}

security degrades “gracefully” with the maximal number of

nonce repetitions m

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 21 / 32

SLIDE 67

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Security of CTRT

Theorem

n = block-length
t = tweak-length
σ = total length of queries (in n-bit blocks)
m = maximal number of repetitions of any nonce

AdvnivE

CTRT(A) ≤ 2(m − 1)σ

2t + 1 2t + 2σ log2 σ 2n when σ ≤ 2t, + 2t2σ2 2n+t when σ ≥ 2t.

nonce-respecting (m = 1):

security up to σ ≃ min{2n, 2(n+t)/2}

security degrades “gracefully” with the maximal number of

nonce repetitions m

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 21 / 32

SLIDE 68

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Security of CTRT

Theorem

n = block-length
t = tweak-length
σ = total length of queries (in n-bit blocks)
m = maximal number of repetitions of any nonce

AdvnivE

CTRT(A) ≤

1 2t + 2σ log2 σ 2n when σ ≤ 2t, + 2t2σ2 2n+t when σ ≥ 2t.

nonce-respecting (m = 1):

security up to σ ≃ min{2n, 2(n+t)/2}

security degrades “gracefully” with the maximal number of

nonce repetitions m

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 21 / 32

SLIDE 69

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Security of CTRT

Theorem

n = block-length
t = tweak-length
σ = total length of queries (in n-bit blocks)
m = maximal number of repetitions of any nonce

AdvnivE

CTRT(A) ≤

1 2t + 2σ log2 σ 2n when σ ≤ 2t, + 2t2σ2 2n+t when σ ≥ 2t.

nonce-respecting (m = 1):

security up to σ ≃ min{2n, 2(n+t)/2}

security degrades “gracefully” with the maximal number of

nonce repetitions m

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 21 / 32

SLIDE 70

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Security of CTRT

Theorem

n = block-length
t = tweak-length
σ = total length of queries (in n-bit blocks)
m = maximal number of repetitions of any nonce

AdvnivE

CTRT(A) ≤ 2(m − 1)σ

2t + 1 2t + 2σ log2 σ 2n when σ ≤ 2t, + 2t2σ2 2n+t when σ ≥ 2t.

nonce-respecting (m = 1):

security up to σ ≃ min{2n, 2(n+t)/2}

security degrades “gracefully” with the maximal number of

nonce repetitions m

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 21 / 32

SLIDE 71

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

assume first that nonces are never repeated
we want to show that ciphertexts are indist. from random
each random IV determines the sequence of tweaks

(IV , IV + 1, . . .) used in the TBC

for each tweak T ∈ T , let L(T) (“load”) be the number of

times the tweak T has been used throughout encryption queries

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 22 / 32

SLIDE 72

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

assume first that nonces are never repeated
we want to show that ciphertexts are indist. from random
each random IV determines the sequence of tweaks

(IV , IV + 1, . . .) used in the TBC

for each tweak T ∈ T , let L(T) (“load”) be the number of

times the tweak T has been used throughout encryption queries

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 22 / 32

SLIDE 73

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

assume first that nonces are never repeated
we want to show that ciphertexts are indist. from random
each random IV determines the sequence of tweaks

(IV , IV + 1, . . .) used in the TBC

for each tweak T ∈ T , let L(T) (“load”) be the number of

times the tweak T has been used throughout encryption queries

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 22 / 32

SLIDE 74

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

assume first that nonces are never repeated
we want to show that ciphertexts are indist. from random
each random IV determines the sequence of tweaks

(IV , IV + 1, . . .) used in the TBC

for each tweak T ∈ T , let L(T) (“load”) be the number of

times the tweak T has been used throughout encryption queries

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 22 / 32

SLIDE 75

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

for each tweak, we have an independent PRF/PRP

distinguishing problem with L(T) “queries” (nonces): Adv(A) ≤

T∈T

L(T)2 2 · 2n ≤ min{σ, 2t} · (Lmax)2 2 · 2n

upper bound on Lmax = max L(T): “balls-into-bins” problem
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 23 / 32

SLIDE 76

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

C1 M1

EK

N IV C2 M2

EK

N IV + 1 C3 M3

EK

N IV + 2 C4 M4

EK

N IV + 3 C5 M5

EK

N IV + 4

for each tweak, we have an independent PRF/PRP

distinguishing problem with L(T) “queries” (nonces): Adv(A) ≤

T∈T

L(T)2 2 · 2n ≤ min{σ, 2t} · (Lmax)2 2 · 2n

upper bound on Lmax = max L(T): “balls-into-bins” problem
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 23 / 32

SLIDE 77

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 78

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 79

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N1

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 80

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N1 N2

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 81

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N1 N2 N3

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 82

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N1 N2 N3 N4

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 83

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N1 N2 N3 N4 N5

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 84

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-respecting)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N1 N2 N3 N4 N5

2t bins = tweak values
σ balls = nonces
for each query, the random IV determines in which (consecutive)

bins the nonces are thrown

except with probability 1/2t, one has

(a) if σ ≤ 2t, then max L(T) ≤ 2 log σ; (b) if σ ≥ 2t, then max L(T) ≤ 2tσ

2t .

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 24 / 32

SLIDE 85

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-misuse)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10

bad event that allows to distinguish outputs from random:

∃ two encryption queries with the same nonce and a common tweak (counter)

for two messages of length ℓ and ℓ′, happens with proba.

(ℓ + ℓ′ − 1)/2t

yields the term (m − 1)σ/2t in the security bound
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 25 / 32

SLIDE 86

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-misuse)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N

bad event that allows to distinguish outputs from random:

∃ two encryption queries with the same nonce and a common tweak (counter)

for two messages of length ℓ and ℓ′, happens with proba.

(ℓ + ℓ′ − 1)/2t

yields the term (m − 1)σ/2t in the security bound
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 25 / 32

SLIDE 87

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-misuse)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N N

bad event that allows to distinguish outputs from random:

∃ two encryption queries with the same nonce and a common tweak (counter)

for two messages of length ℓ and ℓ′, happens with proba.

(ℓ + ℓ′ − 1)/2t

yields the term (m − 1)σ/2t in the security bound
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 25 / 32

SLIDE 88

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-misuse)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N N N

bad event that allows to distinguish outputs from random:

∃ two encryption queries with the same nonce and a common tweak (counter)

for two messages of length ℓ and ℓ′, happens with proba.

(ℓ + ℓ′ − 1)/2t

yields the term (m − 1)σ/2t in the security bound
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 25 / 32

SLIDE 89

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-misuse)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N N N

bad event that allows to distinguish outputs from random:

∃ two encryption queries with the same nonce and a common tweak (counter)

for two messages of length ℓ and ℓ′, happens with proba.

(ℓ + ℓ′ − 1)/2t

yields the term (m − 1)σ/2t in the security bound
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 25 / 32

SLIDE 90

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-misuse)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N N N

bad event that allows to distinguish outputs from random:

∃ two encryption queries with the same nonce and a common tweak (counter)

for two messages of length ℓ and ℓ′, happens with proba.

(ℓ + ℓ′ − 1)/2t

yields the term (m − 1)σ/2t in the security bound
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 25 / 32

SLIDE 91

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Proof of Security of CTRT (nonce-misuse)

T1 T2 T3 T4 T5 T6 T7 T8 T9 T10 N N N

bad event that allows to distinguish outputs from random:

∃ two encryption queries with the same nonce and a common tweak (counter)

for two messages of length ℓ and ℓ′, happens with proba.

(ℓ + ℓ′ − 1)/2t

yields the term (m − 1)σ/2t in the security bound
T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 25 / 32

SLIDE 92

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Outline

TBCs and AE Generic Composition: the NSIV Method Authentication: the EPWC Mode Encryption: the CTRT Mode Conclusion

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 26 / 32

SLIDE 93

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Wrap-up and Final Remarks

EPWC + CTRT combined using the NSIV composition method

= SCT (Synthetic Counter in Tweak) mode

BBB-secure in the nonce-respecting setting
retains birthday-bound security in the nonce-misuse setting
parallel, quite efficient, does not need the decryption direction
instantiation of the TBC: needs to be BBB-secure!

⇒ XEX does not work ⇒ use ad-hoc TBCs such as Deoxys-BC and Joltik-BC

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 27 / 32

SLIDE 94

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Wrap-up and Final Remarks

EPWC + CTRT combined using the NSIV composition method

= SCT (Synthetic Counter in Tweak) mode

BBB-secure in the nonce-respecting setting
retains birthday-bound security in the nonce-misuse setting
parallel, quite efficient, does not need the decryption direction
instantiation of the TBC: needs to be BBB-secure!

⇒ XEX does not work ⇒ use ad-hoc TBCs such as Deoxys-BC and Joltik-BC

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 27 / 32

SLIDE 95

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Wrap-up and Final Remarks

EPWC + CTRT combined using the NSIV composition method

= SCT (Synthetic Counter in Tweak) mode

BBB-secure in the nonce-respecting setting
retains birthday-bound security in the nonce-misuse setting
parallel, quite efficient, does not need the decryption direction
instantiation of the TBC: needs to be BBB-secure!

⇒ XEX does not work ⇒ use ad-hoc TBCs such as Deoxys-BC and Joltik-BC

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 27 / 32

SLIDE 96

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Wrap-up and Final Remarks

EPWC + CTRT combined using the NSIV composition method

= SCT (Synthetic Counter in Tweak) mode

BBB-secure in the nonce-respecting setting
retains birthday-bound security in the nonce-misuse setting
parallel, quite efficient, does not need the decryption direction
instantiation of the TBC: needs to be BBB-secure!

⇒ XEX does not work ⇒ use ad-hoc TBCs such as Deoxys-BC and Joltik-BC

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 27 / 32

SLIDE 97

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

Wrap-up and Final Remarks

EPWC + CTRT combined using the NSIV composition method

= SCT (Synthetic Counter in Tweak) mode

BBB-secure in the nonce-respecting setting
retains birthday-bound security in the nonce-misuse setting
parallel, quite efficient, does not need the decryption direction
instantiation of the TBC: needs to be BBB-secure!

⇒ XEX does not work ⇒ use ad-hoc TBCs such as Deoxys-BC and Joltik-BC

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 27 / 32

SLIDE 98

TBCs and AE NSIV Generic Composition EPWC MAC CTRT Encryption Conclusion

The end. . .

Thanks for your attention! Comments or questions?

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 28 / 32

SLIDE 99

References

References I

Elena Andreeva, Andrey Bogdanov, Atul Luykx, Bart Mennink, Elmar Tischhauser, and Kan Yasuda. Parallelizable and Authenticated Online

Ciphers. In Kazue Sako and Palash Sarkar, editors, Advances in

Cryptology - ASIACRYPT 2013 (Proceedings, Part I), volume 8269 of LNCS, pages 424–443. Springer, 2013. Mihir Bellare and Chanathip Namprempre. Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition

Paradigm. In Tatsuaki Okamoto, editor, Advances in Cryptology -

ASIACRYPT 2000, volume 1976 of LNCS, pages 531–545. Springer, 2000. Paul Crowley. Mercy: A Fast Large Block Cipher for Disk Sector

Encryption. In Bruce Schneier, editor, Fast Software Encryption - FSE

2000, volume 1978 of LNCS, pages 49–63. Springer, 2000. Ewan Fleischmann, Christian Forler, and Stefan Lucks. McOE: A Family

f Almost Foolproof On-Line Authenticated Encryption Schemes. In Anne

Canteaut, editor, Fast Software Encryption - FSE 2012, volume 7549 of LNCS, pages 196–215. Springer, 2012.

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 29 / 32

SLIDE 100

References

References II

Niels Ferguson, Stefan Lucks, Bruce Schneier, Doug Whiting, Mihir Bellare, Tadayoshi Kohno, Jon Callas, and Jesse Walker. The Skein Hash Function Family. SHA3 Submission to NIST (Round 3), 2010. Viet Tung Hoang, Ted Krovetz, and Phillip Rogaway. Robust Authenticated-Encryption: AEZ and the Problem That It Solves. In Elisabeth Oswald and Marc Fischlin, editors, Advances in Cryptology - EUROCRYPT 2015 (Proceedings, Part I), volume 9056 of LNCS, pages 15–44. Springer, 2015. Viet Tung Hoang, Reza Reyhanitabar, Phillip Rogaway, and Damian Vizár. Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance. In Rosario Gennaro and Matthew Robshaw, editors, Advances in Cryptology - CRYPTO 2015 (Proceedings, Part I), volume 9215 of LNCS, pages 493–517. Springer, 2015. Ted Krovetz and Phillip Rogaway. The Software Performance of Authenticated-Encryption Modes. In Antoine Joux, editor, Fast Software Encryption - FSE 2011, volume 6733 of LNCS, pages 306–327. Springer, 2011.

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 30 / 32

SLIDE 101

References

References III

Mridul Nandi. XLS is not a strong pseudorandom permutation. In Palash Sarkar and Tetsu Iwata, editors, Advances in Cryptology - ASIACRYPT 2014 (Proceedings, Part I), volume 8873 of LNCS, pages 478–490. Springer, 2014. Chanathip Namprempre, Phillip Rogaway, and Thomas Shrimpton. Reconsidering Generic Composition. In Phong Q. Nguyen and Elisabeth Oswald, editors, Advances in Cryptology - EUROCRYPT 2014, volume 8441 of LNCS, pages 257–274. Springer, 2014. Phillip Rogaway and Thomas Shrimpton. A Provable-Security Treatment

f the Key-Wrap Problem. In Serge Vaudenay, editor, Advances in

Cryptology - EUROCRYPT 2006, volume 4004 of LNCS, pages 373–390. Springer, 2006. Richard Schroeppel. The Hasty Pudding Cipher. AES submission to NIST, 1998.

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 31 / 32

SLIDE 102

References

References IV

Thomas Shrimpton and R. Seth Terashima. A Modular Framework for Building Variable-Input-Length Tweakable Ciphers. In Kazue Sako and Palash Sarkar, editors, Advances in Cryptology - ASIACRYPT 2013 (Proceedings, Part I), volume 8269 of LNCS, pages 405–423. Springer, 2013.

T. Peyrin, Y. Seurin

Counter-in-Tweak CRYPTO 2016 32 / 32