Hash-CFB Authenticated Encryption Without a Block Cipher Christian - - PowerPoint PPT Presentation

▶
hash cfb
SMART_READER_LITE
LIVE PREVIEW

Hash-CFB Authenticated Encryption Without a Block Cipher Christian - - PowerPoint PPT Presentation

Mar 20, 2024 317 likes •514 views

Hash-CFB Authenticated Encryption Without a Block Cipher Christian Forler 1 , Stefan Lucks 1 , David McGrew 2 , Jakob Wenzel 1 1 Bauhaus-Universitt Weimar, Germany, 2 Cisco Systems, USA DIAC, Stockholm, July, 2012 1 C. Forler, S. Lucks,

slide-1
SLIDE 1

Hash-CFB

Authenticated Encryption Without a Block Cipher

Christian Forler1, Stefan Lucks1, David McGrew2, Jakob Wenzel1

1Bauhaus-Universität Weimar, Germany, 2Cisco Systems, USA

DIAC, Stockholm, July, 2012

–1–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-2
SLIDE 2

Outlook

Goals From BC-CFB to Hash-CFB Alternatives Security Claims . . . Beyond “Standard” AE . . . Core Ideas for Proofs . . . on Side Channels Final Remarks and Summary

–2–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-3
SLIDE 3

Goals

  • 1. security (of course)
  • 2. feasible on constrained devices
  • ne primitive to rule them all,
  • ne primitive to bind them . . .
  • 3. simplicity:

◮ easy to describe ◮ easy to implement ◮ easy to analyze

based on a “standard” primitive

  • 4. reasonable efficiency

–3–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-4
SLIDE 4

From BC-CFB to Hash-CFB

tag M[n] C[n] M[2] C[2] M[1] C[1] nonce

BC-CFB:

◮ privacy: CFB encryption ◮ authenticity: trivial attacks! –4–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-5
SLIDE 5

From BC-CFB to Hash-CFB

M[1] C[1] M[2] C[2] M[n] C[n] tag 1 1 1 2 nonce

Hash-CFB, using a fixed-input-length (FIL) hash function:

◮ privacy: the same as CFB encryption ◮ authenticity: secure – see later

  • 1. make both T[i] = C[i] ⊕ M[I] and C[i] inputs for the

(i + 1)st call

  • 2. differentiate last primitive call from previous calls

–4–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-6
SLIDE 6

From BC-CFB to Hash-CFB

C[1] C[2] C[n] M[1] M[2] M[n] C[1] C[n] C[n−1] 1 1 1 T[1] T[n−1] T[n] T[0] T[2] S

  • assoc. data

tag nonce key 2

◮ long-term key and nonce define message-secret S –5–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-7
SLIDE 7

From BC-CFB to Hash-CFB

C[1] C[2] C[n] M[1] M[2] M[n] C[1] C[n] C[n−1] 1 1 1 T[1] T[n−1] T[n] T[0] T[2] S

  • assoc. data

tag nonce key 2

◮ long-term key and nonce define message-secret S ◮ S is xor-ed to the previous hash output

(recall that a hash function is unkeyed, by nature)

–5–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-8
SLIDE 8

From BC-CFB to Hash-CFB

C[1] C[2] C[n] M[1] M[2] M[n] C[1] C[n] C[n−1] 1 1 1 T[1] T[n−1] T[n] T[0] T[2] S

  • assoc. data

tag nonce key 2

◮ long-term key and nonce define message-secret S ◮ S is xor-ed to the previous hash output

(recall that a hash function is unkeyed, by nature)

◮ use a VIL (variable input length) hash of the

associated data

–5–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-9
SLIDE 9

Alternatives

primitive solution 1. block cipher block cipher based hash fun. 2. hash function generic composition (e.g., counter mode & HMAC) 3. compression function (whatever)

–6–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-10
SLIDE 10

Alternatives

primitive solution 1. block cipher block cipher based hash fun. 2. hash function generic composition (e.g., counter mode & HMAC) 3. compression function (whatever)

  • 1. standard block cipher: AES, n = 128

need 2n-bit hash function; plenty of good DBL-hashes in literature, but what is the “standard” for DBL hashing?

–6–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-11
SLIDE 11

Alternatives

primitive solution 1. block cipher block cipher based hash fun. 2. hash function generic composition (e.g., counter mode & HMAC) 3. compression function (whatever)

  • 1. standard block cipher: AES, n = 128

need 2n-bit hash function; plenty of good DBL-hashes in literature, but what is the “standard” for DBL hashing?

  • 2. how to deal with additional complexity and

storage? (two independent keys, two states, . . . )

–6–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-12
SLIDE 12

Alternatives

primitive solution 1. block cipher block cipher based hash fun. 2. hash function generic composition (e.g., counter mode & HMAC) 3. compression function (whatever)

  • 1. standard block cipher: AES, n = 128

need 2n-bit hash function; plenty of good DBL-hashes in literature, but what is the “standard” for DBL hashing?

  • 2. how to deal with additional complexity and

storage? (two independent keys, two states, . . . )

  • 3. cryptographers know the “compression functions”, but

which standards or APIs actually define them?

–6–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-13
SLIDE 13

Security Claims

Standard AE Claims

message (assoc. data) ciphertext

  • auth. tag

key nonce

◮ assume the hash function behaves like a good PRF ◮ restrict the adversary to be nonce-respecting ◮ privacy: chosen plaintext attack (CPA) resistant ◮ authenticity: integrity of ciphertexts (Int-CTXT) ◮ more privacy: CPA and Int-CTXT ⇒ CCA –7–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-14
SLIDE 14

Security Claims

. . . Beyond “Standard” AE

message (assoc. data) ciphertext

  • auth. tag

key nonce

◮ nonce misuse: the adversary is not always nonce

respecting (e.g., due to implementation errors)

◮ privacy: still holds when using a new nonce ◮ authenticity: not affected (!)

◮ weak assumptions:

◮ privacy: requires the FIL HF to be a good PRF ◮ authenticity: only requires “forgery resistance” of the

FIL HF

◮ side-channel resistance: (see below) –8–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-15
SLIDE 15

Security Claims

. . . Core Ideas for Proofs

◮ privacy: similar to block cipher based CFB ◮ authenticity: for queries, the final hash input to

compute tag is always different:

C[n] M[n] C[n] C[n−1] 1 T[n−1] T[n] tag 2

◮ T[n] is a (keyed) hash

  • f the message

(⇒ no collisions), and

◮ the postfix 2 is only

used for final hash function calls

so a forger would have to predict the output of the final FIL hash function call – even if the same nonce had been used repeatedly

–9–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-16
SLIDE 16

Security Claims

. . . on Side Channels

typical side-channel attacks:

◮ many measurements of a primitive operations under

the same key

◮ X messages, each of length L blocks:

XL measurements for the same key

–10–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-17
SLIDE 17

Security Claims

. . . on Side Channels

C[1] C[2] C[n] M[1] M[2] M[n] C[1] C[n] C[n−1] 1 1 1 T[1] T[n−1] T[n] T[0] T[2] S

  • assoc. data

tag nonce key 2

side-channel attacks against hash-CFB:

◮ X messages, each of length L, nonce-respecting:

X measurements for key and L for each of S

◮ even when not nonce-respecting:

adversary may find some S but only use it to to compromise messages using that single nonce

–11–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB
slide-18
SLIDE 18

Final Remarks and Summary

◮ in the paper

◮ SHA-224-based instantiation of HASH-CFB: ◮ one FIL hash ⇔ one compression function call

◮ our goals:

◮ secure, feasable on constrained devices, simple,

efficient (in that order)

◮ using a hash function seems to be a good approach

◮ security requirements (beyond “standard”):

◮ authenticity even under nonce reuse ◮ authenticity needs weaker assumption than privacy ◮ some defense against side-channel attacks

◮ for discussion at DIAC:

◮ Should such security requirements become a

standard for new generation AE schemes?

–12–

  • C. Forler, S. Lucks, D. McGrew, J. Wenzel: Hash-CFB