On the Influence of Message Length in PMACs Security Bounds Atul - - PowerPoint PPT Presentation

▶
on the influence of message length in pmac s security
SMART_READER_LITE
LIVE PREVIEW

On the Influence of Message Length in PMACs Security Bounds Atul - - PowerPoint PPT Presentation

Jul 25, 2023 223 likes •880 views

On the Influence of Message Length in PMACs Security Bounds Atul Luykx 1 Bart Preneel 1 Alan Szepieniec 1 Kan Yasuda 2 1 COSIC, KU Leuven, Belgium 2 NTT Secure Platform Laboratories, Japan May 11, 2016 1 Security Bounds Factors: 1.

slide-1
SLIDE 1

On the Influence of Message Length in PMAC’s Security Bounds

Atul Luykx1 Bart Preneel1 Alan Szepieniec1 Kan Yasuda2

1COSIC, KU Leuven, Belgium 2NTT Secure Platform Laboratories, Japan

May 11, 2016

1

slide-2
SLIDE 2

Security Bounds

Factors:

  • 1. Adversarial Resources

2

slide-3
SLIDE 3

Security Bounds

Factors:

  • 1. Adversarial Resources
  • 2. Scheme parameters

2

slide-4
SLIDE 4

Security Bounds

Factors:

  • 1. Adversarial Resources
  • 2. Scheme parameters
  • 3. Confidence level

2

slide-5
SLIDE 5

Security Bounds

Factors:

  • 1. Adversarial Resources
  • 2. Scheme parameters
  • 3. Confidence level

Secure Number of Queries — q Message Length — ℓ

2

slide-6
SLIDE 6

Security Bounds

Factors:

  • 1. Adversarial Resources
  • 2. Scheme parameters
  • 3. Confidence level

TLS 1.3: GCM, ChaCha20 + Poly1305 ISO/IEC SC27 WG2: 48 bit block size?

Secure Number of Queries — q Message Length — ℓ

2

slide-7
SLIDE 7

Example : EMAC

m1 π c1 m2 m3 m4

+ + +

π1 π1 π1 π1 π2 T

3

slide-8
SLIDE 8

Example : EMAC

m1 π c1 m2 m3 m4

+ + +

π1 π1 π1 π1 π2 T q2ℓ2 2n ≤ ǫ n Block size q Number of queries ℓ Query length in blocks ǫ Confidence

3

slide-9
SLIDE 9

Example : EMAC

m1 π c1 m2 m3 m4

+ + +

π1 π1 π1 π1 π2 T q2ℓ2 2n ≤ ǫ n Block size q Number of queries ℓ Query length in blocks ǫ Confidence

Table: ǫ = 1/220, ℓ = 1KB

Cipher Block Size Limit AES128 128 251 PRESENT 64 218.5 KATAN32 32 4

3

slide-10
SLIDE 10

EMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 Number of Queries — q Message Length — ℓ

4

slide-11
SLIDE 11

EMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 Number of Queries — q Message Length — ℓ

4

slide-12
SLIDE 12

EMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 Number of Queries — q Message Length — ℓ

4

slide-13
SLIDE 13

EMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213

?

Number of Queries — q Message Length — ℓ

4

slide-14
SLIDE 14

EMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213

?

Number of Queries — q Message Length — ℓ

4

slide-15
SLIDE 15

EMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213

?

Number of Queries — q Message Length — ℓ

4

slide-16
SLIDE 16

Switching Schemes

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 EMAC Number of Queries — q Message Length — ℓ

5

slide-17
SLIDE 17

Switching Schemes

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 EMAC 3kf9 Sum of CBCs PMAC Plus Number of Queries — q Message Length — ℓ

5

slide-18
SLIDE 18

Switching Schemes

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 EMAC 3kf9 Sum of CBCs PMAC Plus PMACX PMAC w Parity LightMAC Number of Queries — q Message Length — ℓ

5

slide-19
SLIDE 19

XOR-Style PRF

PMAC w Parity PMACX LightMAC

6

slide-20
SLIDE 20

XOR-Style PRF

PMAC w Parity PMACX LightMAC π π π π m x1 x2 x3 x4

+ + +

6

slide-21
SLIDE 21

XOR-Style PRF

PMAC w Parity PMACX LightMAC π π π π m x1 x2 x3 x4

+ + +

6

slide-22
SLIDE 22

PMAC and PHASH

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m)

7

slide-23
SLIDE 23

PMAC and PHASH

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m) PMAC(m) = OutputTransform

  • PHASH(m)
  • 7
slide-24
SLIDE 24

PMAC and PHASH

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m) PMAC(m) = OutputTransform

  • PHASH(m)
  • 1. Gray codes
  • 2. Powering up

7

slide-25
SLIDE 25

PMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 PMAC Number of Queries — q Message Length — ℓ

8

slide-26
SLIDE 26

PMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 PMAC Number of Queries — q Message Length — ℓ

8

slide-27
SLIDE 27

PMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 PMAC PMACX PMAC w Parity LightMAC Number of Queries — q Message Length — ℓ

8

slide-28
SLIDE 28

PMAC Bounds

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 PMAC PMACX PMAC w Parity LightMAC

?

Number of Queries — q Message Length — ℓ

8

slide-29
SLIDE 29

Focusing on Collisions

PHASH(m1) = PHASH(m2) PMAC(m1) = PMAC(m2)

9

slide-30
SLIDE 30

Focusing on Collisions

PHASH(m1) = PHASH(m2) PMAC(m1) = PMAC(m2) PHASH collision implies a PMAC attack

9

slide-31
SLIDE 31

Results

Message length dependence changes according to masks

10

slide-32
SLIDE 32

Results

Message length dependence changes according to masks PHASH Instances

10

slide-33
SLIDE 33

Results

Message length dependence changes according to masks PHASH Instances

Gray Codes

10

slide-34
SLIDE 34

Results

Message length dependence changes according to masks PHASH Instances

Gray Codes Powering Up

10

slide-35
SLIDE 35

Results

Message length dependence changes according to masks Infinitely many with collision upper bound 2/2n

  • r

PHASH Instances PHASH Instances

Gray Codes Powering Up

10

slide-36
SLIDE 36

Results

Message length dependence changes according to masks Infinitely many with collision upper bound 2/2n

  • r

Computationally hard to find high probability collision (based on conjecture) PHASH Instances

Gray Codes Powering Up

10

slide-37
SLIDE 37

Results

Message length dependence changes according to masks Infinitely many with collision upper bound 2/2n

  • r

Computationally hard to find high probability collision (based on conjecture) Gray codes instances depend on message length PHASH Instances

Gray Codes Powering Up

10

slide-38
SLIDE 38

Results in Context

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 PMAC PMACX PMAC w Parity LightMAC Number of Queries — q Message Length — ℓ

11

slide-39
SLIDE 39

Results in Context

21 23 25 27 29 211 213 21 24 27 210 213 216 219 222 20 213 PMAC PMACX PMAC w Parity LightMAC Number of Queries — q Message Length — ℓ

11

slide-40
SLIDE 40

PHASH vs XOR Hash

π π π π 1n/2 m1 2n/2 m2 3n/2 m3 4n/2 m4

+ + +

XOR Hash(m) m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m)

12

slide-41
SLIDE 41

XOR Hash Collision

π π π π π π π

1n/2 m1 2n/2 m2 3n/2 m3 4n/2 m4 1n/2 m′

1 2n/2 m′ 2 3n/2 m′ 3

+ + + + + +

13

slide-42
SLIDE 42

XOR Hash Collision

π π π π π π π

1n/2 m1 2n/2 m2 3n/2 m3 4n/2 m4 1n/2 m′

1 2n/2 m′ 2 3n/2 m′ 3

+ + + + + +

13

slide-43
SLIDE 43

XOR Hash Collision

π π π π π π π

1n/2 m1 2n/2 m2 3n/2 m3 4n/2 m4 1n/2 m′

1 2n/2 m′ 2 3n/2 m′ 3

+ + + + + +

13

slide-44
SLIDE 44

XOR Hash Collision

π π π π π π π

1n/2 m1 2n/2 m2 3n/2 m3 4n/2 m4 1n/2 m′

1 2n/2 m′ 2 3n/2 m′ 3

+ + + + + +

13

slide-45
SLIDE 45

XOR Hash Collision

π π π π π π π

1n/2 m1 2n/2 m2 3n/2 m3 4n/2 m4 1n/2 m′

1 2n/2 m′ 2 3n/2 m′ 3

+ + + + + +

13

slide-46
SLIDE 46

XOR Hash Collision

π π π π π π π

1n/2 m1 2n/2 m2 3n/2 m3 4n/2 m4 1n/2 m′

1 2n/2 m′ 2 3n/2 m′ 3

+ + + + + +

13

slide-47
SLIDE 47

PHASH Collision

m1 m2 m3 m4 m′

1

m′

2

m′

3

+ + + + + + +

π π π π π π π c1ω c2ω c3ω c4ω c1ω c2ω c3ω

+ + + + + +

14

slide-48
SLIDE 48

PHASH Collision

m1 m2 m3 m4 m′

1

m′

2

m′

3

+ + + + + + +

π π π π π π π c1ω c2ω c3ω c4ω c1ω c2ω c3ω

+ + + + + +

14

slide-49
SLIDE 49

Approach

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m) X2

15

slide-50
SLIDE 50

Approach

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m) c1 m1

15

slide-51
SLIDE 51

Approach

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m) c1 m1 c2 c3 c4 m2 m3 m4

15

slide-52
SLIDE 52

Approach

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m) c1 m1 c2 c3 c4 m2 m3 m4

15

slide-53
SLIDE 53

Approach

m1 m2 m3 m4

+ + + +

π π π π π c1ω c2ω c3ω c4ω ω

+ + +

PHASH(m) c1 m1 c2 c3 c4 m2 m3 m4

15

slide-54
SLIDE 54

Conclusions and Open Problems

PMAC message length dependence is non-trivial

16

slide-55
SLIDE 55

Conclusions and Open Problems

PMAC message length dependence is non-trivial

  • 1. What happens with powering up?

16

slide-56
SLIDE 56

Conclusions and Open Problems

PMAC message length dependence is non-trivial

  • 1. What happens with powering up?
  • 2. Optimal masks?

16

slide-57
SLIDE 57

Conclusions and Open Problems

PMAC message length dependence is non-trivial

  • 1. What happens with powering up?
  • 2. Optimal masks?
  • 3. Relationship between PMAC and PHASH when the output

transform is not independent?

16

slide-58
SLIDE 58

Conclusions and Open Problems

PMAC message length dependence is non-trivial

  • 1. What happens with powering up?
  • 2. Optimal masks?
  • 3. Relationship between PMAC and PHASH when the output

transform is not independent? Thank you for your attention.

16

slide-59
SLIDE 59

Connection With PHASH Collision Probability

Two messages m1 and m2 collide with probability k/2n if the corresponding set in X2 is evenly covered by k slopes. Simple proof of ℓ-bound:

17

slide-60
SLIDE 60

Set Evenly Covered by Two Slopes

a a−1

Figure: A set of four points evenly covered by the slopes 0 and a−1. The x-coordinates of the points are 0 and a, and the y-coordinates are 0 and 1.

Guarantees a collision with probability 2/2n.

18

slide-61
SLIDE 61

Set Evenly Covered by Three Slopes

a b c

a−1 b−1

Figure: A set of four points evenly covered by the slopes 0, a−1, and b−1. The x-coordinates of the points are 0, a, b, and c, and the y-coordinates are 0 and 1.

Exists if and only if a + b + c = 0.

19

slide-62
SLIDE 62

Another Set Evenly Covered by Three Slopes

a b c u v w

Figure: A set of points evenly covered by the slopes u, v, and w. Each point is accompanied by another point with the same x-coordinate. The x-coordinates of the pairs are indicated below the lower points.

Exists if and only if a2 + b2 + c2 + ab + ac = 0.

20

slide-63
SLIDE 63

Evenly Covered Sets in General

The x-coordinates of evenly covered sets satisfy one of the following:

  • 1. They contain a subset summing to zero (NP-complete)
  • 2. They are the solution to a non-trivial binary quadratic form

(similar problem NP-complete)

Conjecture

Given S ⊂ X, finding a subset of S satisfying either of the above requirements is computationally hard.

21

slide-64
SLIDE 64

Searching for Evenly Covered Sets

Proposition

An evenly covered set with distinct x-coordinates forms a complete graph if and only if the x-coordinates are an additive subgroup of X.

  • 1. For sufficiently long messages, the masks will always contain

an additive subgroup

  • 2. Finding additive subgroups in Gray codes is easy for every

power of two. Success probability of Gray code attack: 2k−1 − 1 2n for ℓ = 2k

22