[PPT] - On Some Constructions for Authenticated Encryption with Associated PowerPoint Presentation

SLIDE 1

isilogo

On Some Constructions for Authenticated Encryption with Associated Data

Palash Sarkar

Applied Statistics Unit Indian Statistical Institute, Kolkata India palash@isical.ac.in

(Partially based on joint work with Debrup Chakraborty)

Directions in Authenticated Ciphers – DIAC 2012, 6th July 2012

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 1 / 32

SLIDE 2

isilogo

Encryption

Receiver Sender

Decrypt Encrypt adversary public channel K K msg cpr

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 2 / 32

SLIDE 3

isilogo

Authentication

Receiver Sender

adversary public channel K K msg Generate Tag Verify Tag (msg, tag)

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 3 / 32

SLIDE 4

isilogo

Authenticated Encryption (AE)

Receiver Sender

adversary public channel K K Decrypt Encrypt msg nonce nonce cpr = (C, tag)

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 4 / 32

SLIDE 5

isilogo

AE with Associated Data (AEAD)

Receiver Sender

adversary public channel K K Decrypt Encrypt nonce nonce hdr, msg (hdr, cpr = (C, tag))

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 5 / 32

SLIDE 6

isilogo

Deterministic AEAD (DAEAD)

Receiver Sender

adversary public channel K K Decrypt Encrypt hdr, msg (hdr, cpr = (C, tag))

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 6 / 32

SLIDE 7

isilogo

Construction Approaches

We will consider: Single-pass block cipher modes of operations.

From tweakable block ciphers. From (plain) block ciphers.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 7 / 32

SLIDE 8

isilogo

Construction Approaches

We will consider: Single-pass block cipher modes of operations.

From tweakable block ciphers. From (plain) block ciphers.

Stream cipher with IV and a hash function (with provably low collision and differential probabilities).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 7 / 32

SLIDE 9

isilogo

Construction Approaches

We will consider: Single-pass block cipher modes of operations.

From tweakable block ciphers. From (plain) block ciphers.

Stream cipher with IV and a hash function (with provably low collision and differential probabilities). Other approaches: Direct construction of an integrated primitive: PHELIX, SOBER, AEGIS, ... From permutations (Bertoni at al 2011). Generic conversion from AE to AEAD: AE+MAC (Rogaway 2002); AE+CRHF (Sarkar 2010).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 7 / 32

SLIDE 10

isilogo

Some AE(AD) Schemes from Block Ciphers

Two-pass: Cost per block (approx): 2[BC] or 1[BC]+1[M]. CCM: Counter + CBC-MAC; standardised by NIST (USA). GCM: Counter + (universal) hash; standardised by NIST (USA). CWC: Carter-Wegman + Counter Mode; EAX; CHM: CENC + hash; CCFB: between one and two-pass.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 8 / 32

SLIDE 11

isilogo

Some AE(AD) Schemes from Block Ciphers

Two-pass: Cost per block (approx): 2[BC] or 1[BC]+1[M]. CCM: Counter + CBC-MAC; standardised by NIST (USA). GCM: Counter + (universal) hash; standardised by NIST (USA). CWC: Carter-Wegman + Counter Mode; EAX; CHM: CENC + hash; CCFB: between one and two-pass. Single-pass: Cost per block (approx): 1[BC]+SOMETHING. Constructions having associated (US) patents:

IACBC, IAPM: (Jutla, 2001); XCBC, XECB: (Gligor-Donescu, 2001); OCB: (Rogaway et al, 2001; Rogaway 2004; Krovetz-Rogaway, 2011).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 8 / 32

SLIDE 12

isilogo

Some AE(AD) Schemes from Block Ciphers

Two-pass: Cost per block (approx): 2[BC] or 1[BC]+1[M]. CCM: Counter + CBC-MAC; standardised by NIST (USA). GCM: Counter + (universal) hash; standardised by NIST (USA). CWC: Carter-Wegman + Counter Mode; EAX; CHM: CENC + hash; CCFB: between one and two-pass. Single-pass: Cost per block (approx): 1[BC]+SOMETHING. Constructions having associated (US) patents:

IACBC, IAPM: (Jutla, 2001); XCBC, XECB: (Gligor-Donescu, 2001); OCB: (Rogaway et al, 2001; Rogaway 2004; Krovetz-Rogaway, 2011).

Constructions without assoicated patents:

Chakraborty-Sarkar (2006, 2008); Sarkar (2010).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 8 / 32

SLIDE 13

isilogo

AE(AD) from Tweakable Block Ciphers

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 9 / 32

SLIDE 14

isilogo

(Tweakable) Block Ciphers

tweak T key K cpr blk msg blk

Decrypt

key K cpr blk msg blk

Decrypt

key K msg blk cpr blk

Encrypt

msg blk cpr blk

Encrypt

key K tweak T

Non-secret tweak allows flexibility in designing applications. Formalised by Liskov-Rivest-Wagner (2002).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 10 / 32

SLIDE 15

isilogo

TBC and Modes of Operations

Rogaway (2004). Provides efficient construction of a TBC family. Introduces a technique for using a TBC family to construct different modes of operations.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 11 / 32

SLIDE 16

isilogo

TBC and Modes of Operations

Rogaway (2004). Provides efficient construction of a TBC family. Introduces a technique for using a TBC family to construct different modes of operations. Chakraborty-Sarkar (2006, 2008). A new TBC family obtained by generalising Rogaway’s construction.

Can be instantiated over GF(2n) or Z2n.

Provides two techniques for constructing modes of operations.

The first technique generalises Rogaway’s work. A second new technique.

Provides a family of modes of operations for MAC, AE and AEAD.

Only one of each kind was known earlier.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 11 / 32

SLIDE 17

isilogo

From BC to TBC (Generalising Rogaway 2004)

XE Construction (tweakable PRP): EK

N,l(M) = EK(M + ∆).

XEX Construction (tweakable SPRP): EK

N,l(M) = EK(M + ∆) − ∆.

where ∆ = fl(N) and N = EK(N). f1, f2, . . . is a masking sequence. (N, l) is the tweak; tweak space is {0, 1}n × {1, 2, . . . , 2n − 2}. Addition (and subtraction) is over a ring R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 12 / 32

SLIDE 18

isilogo

From BC to TBC (Generalising Rogaway 2004)

XE Construction (tweakable PRP): EK

N,l(M) = EK(M + ∆).

XEX Construction (tweakable SPRP): EK

N,l(M) = EK(M + ∆) − ∆.

where ∆ = fl(N) and N = EK(N). f1, f2, . . . is a masking sequence. (N, l) is the tweak; tweak space is {0, 1}n × {1, 2, . . . , 2n − 2}. Addition (and subtraction) is over a ring R. The generalisation arises from the notion of masking sequence and working over R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 12 / 32

SLIDE 19

isilogo

Masking Sequence: Definition

f1, f2, . . . , fm is an (n, m, µ) masking sequence if: (fs : {0, 1}n → {0, 1}n) Prob[fs(N) = α] ≤

1 µ

Prob[fs(N) = N + α] ≤

1 µ

Prob[fs(N) = ft(N) + α] ≤

1 µ

Prob[fs(N) = ft(N ′) + α] ≤

1 µ

where N and N ′ are randomly and independently chosen from {0, 1}n. α is any fixed n-bit string.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 13 / 32

SLIDE 20

isilogo

Instantiations of R

R as GF(2n): Define fi(N) = NGi where G is an n × n binary matrix whose characteristic polynomial is primitive over GF(2). f1, f2, . . . , f2n−2 is an (n, 2n − 2, 2n) masking sequence. Efficient instantiations of G: powering method, (word oriented) LFSR, CA.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 14 / 32

SLIDE 21

isilogo

Instantiations of R

R as GF(2n): Define fi(N) = NGi where G is an n × n binary matrix whose characteristic polynomial is primitive over GF(2). f1, f2, . . . , f2n−2 is an (n, 2n − 2, 2n) masking sequence. Efficient instantiations of G: powering method, (word oriented) LFSR, CA. R as Z2n: Let p = 2n + δ be a prime, with δ as small as possible, eg: p = 2128 + 51. Define fi(N) = ((i + 1)N mod p) mod 2n. f1, f2, . . . , f2n−2 is an (n, 2n − 2, 2n−1/(δ + 1)) masking sequence.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 14 / 32

SLIDE 22

isilogo

Instantiations of R

R as GF(2n): Define fi(N) = NGi where G is an n × n binary matrix whose characteristic polynomial is primitive over GF(2). f1, f2, . . . , f2n−2 is an (n, 2n − 2, 2n) masking sequence. Efficient instantiations of G: powering method, (word oriented) LFSR, CA. R as Z2n: Let p = 2n + δ be a prime, with δ as small as possible, eg: p = 2128 + 51. Define fi(N) = ((i + 1)N mod p) mod 2n. f1, f2, . . . , f2n−2 is an (n, 2n − 2, 2n−1/(δ + 1)) masking sequence. Rogaway (2004): R as GF(2n) with the powering construction.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 14 / 32

SLIDE 23

isilogo

From TBC to AE

XEX-TBC E with tweak space {0, 1}n × {1, 2, . . . , 2n/2} × {0, 1}.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 15 / 32

SLIDE 24

isilogo

From TBC to AE

XEX-TBC E with tweak space {0, 1}n × {1, 2, . . . , 2n/2} × {0, 1}.

❄ ❄ ❄ ❄ ❄

EN,1,0

K

EN,2,0

K

EN,3,0

K

EN,4,0

K

EN,4,1

K

P1 P2 P3 binn(r) sum

❄ ❄ ❄ ❄ ❄

pad Firstr

❄ ❥

+

✲

P4

❄

C1 C2 C3 C4 tag N is used as a nonce; r = len(P4); sum = P1 + P2 + P3 + (C4||0∗) + pad

Figure: Rogaway’s 2004 TBC-to-AE construction lifted to R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 15 / 32

SLIDE 25

isilogo

From TBC to AE

Required tweak space: {0, 1}n × {1, 2, . . . , 2n/2} × {0, 1}. Tweak space of XEX-TBC: {0, 1}n × {1, 2, . . . , 2n − 2}.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 16 / 32

SLIDE 26

isilogo

From TBC to AE

Required tweak space: {0, 1}n × {1, 2, . . . , 2n/2} × {0, 1}. Tweak space of XEX-TBC: {0, 1}n × {1, 2, . . . , 2n − 2}. Injective Map φ : {1, 2, . . . , 2n/2} × {0, 1} → {1, 2, . . . , 2n − 2}.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 16 / 32

SLIDE 27

isilogo

From TBC to AE

Required tweak space: {0, 1}n × {1, 2, . . . , 2n/2} × {0, 1}. Tweak space of XEX-TBC: {0, 1}n × {1, 2, . . . , 2n − 2}. Injective Map φ : {1, 2, . . . , 2n/2} × {0, 1} → {1, 2, . . . , 2n − 2}. Linear Separation: φ(i, b) = i + Lb where L is an appropriately chosen “large” integer.

R as GF(2n): L is the discrete log of (x + 1) (Rogaway 2004). R as Z2n: L = 2n/2.

Interleaved Separation: φ(i, b) = 2i + b.

Avoids the (design time) discrete log computation.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 16 / 32

SLIDE 28

isilogo

From TBC to AE

Required tweak space: {0, 1}n × {1, 2, . . . , 2n/2} × {0, 1}. Tweak space of XEX-TBC: {0, 1}n × {1, 2, . . . , 2n − 2}. Injective Map φ : {1, 2, . . . , 2n/2} × {0, 1} → {1, 2, . . . , 2n − 2}. Linear Separation: φ(i, b) = i + Lb where L is an appropriately chosen “large” integer.

R as GF(2n): L is the discrete log of (x + 1) (Rogaway 2004). R as Z2n: L = 2n/2.

Interleaved Separation: φ(i, b) = 2i + b.

Avoids the (design time) discrete log computation.

Variations of the above technique provides constructions for MAC and AEAD.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 16 / 32

SLIDE 29

isilogo

AE(AD) from (Plain) Block Ciphers

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 17 / 32

SLIDE 30

isilogo

AE Functions

Random function f : N × X → X × {0, 1}t; f(N, X) = (Y, tag). (Randomness arising from uniform random K.)

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 18 / 32

SLIDE 31

isilogo

AE Functions

Random function f : N × X → X × {0, 1}t; f(N, X) = (Y, tag). (Randomness arising from uniform random K.) fmain

N

(X) ∆ = Y, a length preserving permutation.

f: authentication function associated with f.
f(N, Y) ∆

= tag if f(N, X) = (Y, tag) for some X ∈ X;

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 18 / 32

SLIDE 32

isilogo

AE Functions

Random function f : N × X → X × {0, 1}t; f(N, X) = (Y, tag). (Randomness arising from uniform random K.) fmain

N

(X) ∆ = Y, a length preserving permutation.

f: authentication function associated with f.
f(N, Y) ∆

= tag if f(N, X) = (Y, tag) for some X ∈ X; AE-privacy of f: follows from

PRF-property of fmain against nonce-respecting adversaries.

AE-auth of f: follows from

AE-privacy of f; PRF-property of f.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 18 / 32

SLIDE 33

isilogo

AE Functions

Random function f : N × X → X × {0, 1}t; f(N, X) = (Y, tag). (Randomness arising from uniform random K.) fmain

N

(X) ∆ = Y, a length preserving permutation.

f: authentication function associated with f.
f(N, Y) ∆

= tag if f(N, X) = (Y, tag) for some X ∈ X; AE-privacy of f: follows from

PRF-property of fmain against nonce-respecting adversaries.

AE-auth of f: follows from

AE-privacy of f; PRF-property of f.

f itself can serve as a standalone MAC function.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 18 / 32

SLIDE 34

isilogo

PAE (Sarkar 2010): Only Full Blocks

EK EK EK EK DK ⊕ ⊕ ⊕ ⊕

❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ✲ ✲ ✲ ❄

Γ1 Γ2 Γ3 Γ4 ⊕ ⊕ ⊕ ⊕

❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ✲ ✲ ✲

Γ1 Γ2 Γ3 Γ4

❄

P1 P2 P3 P4 sum C1 C2 C3 C4 tag N is a nonce; Γi = ψi(DK(N)); sum = P1 ⊕ P2 ⊕ P3 ⊕ C4. ψ : I F2n → I F2n is a linear map whose minimal polynomial over I F2 is primitive.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 19 / 32

SLIDE 35

isilogo

PAE (Sarkar 2010): Last Block is Partial

EK EK EK DK DK ⊕ ⊕ ⊕ ⊕ ⊕

❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ❄ ✲ ✲ ✲ ✲ ✲

Γ1 Γ2 Γ3 Γ4 Γ5 ⊕ ⊕ ⊕

❄ ❄ ❄ ❄ ❄ ❄ ✲ ✲ ✲

Γ1 Γ2 Γ3

❄

⊕

✲

P4

❄

Firstr

❄

T4

❄

P1 P2 P3 binn(r) sum C1 C2 C3 tag C4 = T4||(10n−r−1), sum = P1 ⊕ P2 ⊕ P3 ⊕ C4

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 20 / 32

SLIDE 36

isilogo

PAEAD (Sarkar 2010)

PAEAD.EncryptEK ,fStr(N, H, P)

1. if H is null, return PAE.EncryptEK (N, P);
2. (C, tag1) = PAE.EncryptEK (N, P);
3. υ = DK(fStr);
4. tag2 = iPMACDK (υ||H);
5. return (C, tag1 ⊕ tag2).

fStr is a fixed string without any secrecy requirement. iPMAC is a MAC algorithm which is also given in Sarkar (2010).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 21 / 32

SLIDE 37

isilogo

Advantages

Single-pass with efficient masking:

Word-oriented LFSR based masking should be faster than competitors on 32-bit machines. Support for AES-NI and 128-bit instructions has changed the game for Intel processors.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 22 / 32

SLIDE 38

isilogo

Advantages

Single-pass with efficient masking:

Word-oriented LFSR based masking should be faster than competitors on 32-bit machines. Support for AES-NI and 128-bit instructions has changed the game for Intel processors. But, 98% of the CPU market consists of embedded CPUs (Christof Paar, Indocrypt 2011).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 22 / 32

SLIDE 39

isilogo

Advantages

Single-pass with efficient masking:

Word-oriented LFSR based masking should be faster than competitors on 32-bit machines. Support for AES-NI and 128-bit instructions has changed the game for Intel processors. But, 98% of the CPU market consists of embedded CPUs (Christof Paar, Indocrypt 2011).

Reconfigurable: easy to change the masking functions.

Simply choose another suitable ψ. Yields a large family of schemes enjoying the same security promise. Provides an opportunity to combine “provable security” with “security-by-obscurity”.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 22 / 32

SLIDE 40

isilogo

Advantages (contd.)

Versatility: A single module (hardware/software) can be used for different tasks.

Authentication. Authenticated encryption. Authenticated encryption with associated data.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 23 / 32

SLIDE 41

isilogo

Advantages (contd.)

Versatility: A single module (hardware/software) can be used for different tasks.

Authentication. Authenticated encryption. Authenticated encryption with associated data.

Simplified Decryption: The decryption algorithms of PAE and PAEAD do not require EK().

Leads to smaller hardware for lower-level operatives who only need to decrypt the encrypted instructions that are received.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 23 / 32

SLIDE 42

isilogo

Advantages (contd.)

Versatility: A single module (hardware/software) can be used for different tasks.

Authentication. Authenticated encryption. Authenticated encryption with associated data.

Simplified Decryption: The decryption algorithms of PAE and PAEAD do not require EK().

Leads to smaller hardware for lower-level operatives who only need to decrypt the encrypted instructions that are received.

Simplified Encryption: Obtained from a variant PAE-1 (and also PAEAD-1).

The encryption algorithm requires only EK(); leads to smaller hardware for devices which only need to transmit encrypted information.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 23 / 32

SLIDE 43

isilogo

AE(AD) from Stream Ciphers With IV

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 24 / 32

SLIDE 44

isilogo

Components

Stream cipher with IV: SCK : {0, 1}n → {0, 1}L. L long enough to encrypt practical-sized messages. Modelled as a PRF .

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 25 / 32

SLIDE 45

isilogo

Components

Stream cipher with IV: SCK : {0, 1}n → {0, 1}L. L long enough to encrypt practical-sized messages. Modelled as a PRF . Hash function: a keyed family {Hashτ}; τ is the hash key. Low collision probability. For all distinct x and x′ Prτ[Hashτ(x) = Hashτ(x′)] is low. Low differential probability. For all distinct x and x′ and any y, Prτ[Hashτ(x) ⊕ Hashτ(x′) = y] is low.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 25 / 32

SLIDE 46

isilogo

Components

Stream cipher with IV: SCK : {0, 1}n → {0, 1}L. L long enough to encrypt practical-sized messages. Modelled as a PRF . Hash function: a keyed family {Hashτ}; τ is the hash key. Low collision probability. For all distinct x and x′ Prτ[Hashτ(x) = Hashτ(x′)] is low. Low differential probability. For all distinct x and x′ and any y, Prτ[Hashτ(x) ⊕ Hashτ(x′) = y] is low. Type-I hash function: key is a short fixed length string. Example: polynomial hashing. Type-II hash function: key is as long as the message (or longer). Example: multilinear hash; UMAC.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 25 / 32

SLIDE 47

isilogo

AE

AE-1.EncryptK,τ(N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(C) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 26 / 32

SLIDE 48

isilogo

AE

AE-1.EncryptK,τ(N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(C) ⊕ R. AE-2.EncryptK,K ′(N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(C) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 26 / 32

SLIDE 49

isilogo

AE

AE-1.EncryptK,τ(N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(C) ⊕ R. AE-2.EncryptK,K ′(N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(C) ⊕ R. AE-3.EncryptK,τ(N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(M) ⊕ R. AE-4.EncryptK,K ′(N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(M) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 26 / 32

SLIDE 50

isilogo

AE

AE-1.EncryptK,τ(N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(C) ⊕ R. AE-2.EncryptK,K ′(N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(C) ⊕ R. AE-3.EncryptK,τ(N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(M) ⊕ R. AE-4.EncryptK,K ′(N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(M) ⊕ R. AE-1: used by Bernstein during eSTREAM as a standard way of achieving AE; others from Sarkar (2011). AE-1, AE-3: suitable for Type-I hash functions; AE-2, AE-4: suitable for Type-II hash functions. AE-1, AE-2: hash the ciphertext; AE-3, AE-4: hash the message.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 26 / 32

SLIDE 51

isilogo

AEAD (Sarkar 2011)

AEAD-1.EncryptK,τ(H, N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(H, C) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 27 / 32

SLIDE 52

isilogo

AEAD (Sarkar 2011)

AEAD-1.EncryptK,τ(H, N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(H, C) ⊕ R. AEAD-2.EncryptK,K ′(H, N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(H, C) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 27 / 32

SLIDE 53

isilogo

AEAD (Sarkar 2011)

AEAD-1.EncryptK,τ(H, N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(H, C) ⊕ R. AEAD-2.EncryptK,K ′(H, N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(H, C) ⊕ R. AEAD-3.EncryptK,τ(H, N, M) (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(H, M) ⊕ R. AEAD-4.EncryptK,K ′(H, N, M) τ = SCK(K ′); (R, Z) = SCK(N); C = M ⊕ Z; tag = Hashτ(H, M) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 27 / 32

SLIDE 54

isilogo

AEAD (Sarkar 2011)

AEAD-5.EncryptK,τ(H, N, M) V = Hashτ(H, N); (R, Z) = SCK(V); C = M ⊕ Z; tag = Hashτ(C) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 28 / 32

SLIDE 55

isilogo

AEAD (Sarkar 2011)

AEAD-5.EncryptK,τ(H, N, M) V = Hashτ(H, N); (R, Z) = SCK(V); C = M ⊕ Z; tag = Hashτ(C) ⊕ R. AEAD-6.EncryptK,K ′(H, N, M) (τ1, τ2) = SCK(K ′); V = Hashτ1(H, N); (R, Z) = SCK(V); C = M ⊕ Z; tag = Hashτ2(C) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 28 / 32

SLIDE 56

isilogo

AEAD (Sarkar 2011)

AEAD-5.EncryptK,τ(H, N, M) V = Hashτ(H, N); (R, Z) = SCK(V); C = M ⊕ Z; tag = Hashτ(C) ⊕ R. AEAD-6.EncryptK,K ′(H, N, M) (τ1, τ2) = SCK(K ′); V = Hashτ1(H, N); (R, Z) = SCK(V); C = M ⊕ Z; tag = Hashτ2(C) ⊕ R. AEAD-7.EncryptK,τ(H, N, M) V = Hashτ(H, N); (R, Z) = SCK(V); C = M ⊕ Z; tag = Hashτ(M) ⊕ R. AEAD-8.EncryptK,K ′(H, N, M) (τ1, τ2) = SCK(K ′); V = Hashτ1(H, N); (R, Z) = SCK(V); C = M ⊕ Z; tag = Hashτ2(M) ⊕ R.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 28 / 32

SLIDE 57

isilogo

AEAD (Sarkar 2011)

Requires double-input hash function with low collision and differential probabilities. Efficient encoding methods have been proposed. Generic conversions from single-input to double-input (more generally, multiple-input) that is suitable for both Type-I and Type-II hash functions. Modifications of well-known hash functions such as Poly1305 and UMAC to handle double inputs.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 29 / 32

SLIDE 58

isilogo

Deterministic AEAD (Sarkar 2011)

DAEAD.EncryptK,τ(H, M) V = Hashτ(H, M); tag = SCK(V); Z = SCK(tag); C = M ⊕ Z; return (C, tag). Requires double-input hash functions. Suitable for Type-I hash functions. Extension to Type-II hash functions: Let K ′ be another n-bit key and produce τ as τ = SCK(K ′).

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 30 / 32

SLIDE 59

isilogo

Security

“Provable” Security: All schemes described here have associated security proofs.

Make an appropriate idealised assumption on the underlying primitive (block or stream cipher). Show that the adversary cannot do much more than try to defeat the assumption.

Analysis is in the single-user setting.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 31 / 32

SLIDE 60

isilogo

Security

“Provable” Security: All schemes described here have associated security proofs.

Make an appropriate idealised assumption on the underlying primitive (block or stream cipher). Show that the adversary cannot do much more than try to defeat the assumption.

Analysis is in the single-user setting. Multi-User Security: In the multi-user setting, an attack is successful if any one out of several keys is compromised. Using a single 128-bit key for the entire system may not offer 128-bit security (Chatterjee-Menezes-Sarkar, 2011). So, for attaining 128-bit security, the key length may possibly have to be greater than 128 bits.

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 31 / 32

SLIDE 61

isilogo

Thank you for your attention!

Palash Sarkar (ISI, Kolkata) AEAD Constructions DIAC 2012 32 / 32