Overview of the Sponge, Duplex and Farfalle constructions Gilles Van - - PowerPoint PPT Presentation

▶
overview of the sponge duplex and farfalle constructions
SMART_READER_LITE
LIVE PREVIEW

Overview of the Sponge, Duplex and Farfalle constructions Gilles Van - - PowerPoint PPT Presentation

Aug 22, 2022 27 likes •912 views

Overview of the Sponge, Duplex and Farfalle constructions Gilles Van Assche 1 1 STMicroelectronics Summer school on real-world crypto and privacy ibenik, Croatia, June 2019 Based on joint work with Elena Andreeva, Guido Bertoni, Joan Daemen,

slide-1
SLIDE 1

Overview of the Sponge, Duplex and Farfalle constructions

Gilles Van Assche1

1STMicroelectronics

Summer school on real-world crypto and privacy Šibenik, Croatia, June 2019 Based on joint work with Elena Andreeva, Guido Bertoni, Joan Daemen, Seth Hoffert, Bart Mennink, Michaël Peeters, Ronny Van Keer

1 / 59

slide-2
SLIDE 2

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

2 / 59

slide-3
SLIDE 3

Security notions for hashing

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

3 / 59

slide-4
SLIDE 4

Security notions for hashing Hashing requirements

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

4 / 59

slide-5
SLIDE 5

Security notions for hashing Hashing requirements

Cryptographic hash functions

h : {0, 1}∗ → {0, 1}n

I n p u t me s s a g e D i g e s t

Applications

Signatures: signRSA(h(M)) instead of signRSA(M) Key derivation: master key K to derived keys (Ki = h(K∥i)) Bit commitment, predictions: h(what I know) Message authentication: h(K∥M) …

5 / 59

slide-6
SLIDE 6

Security notions for hashing Hashing requirements

Cryptographic hash functions

h : {0, 1}∗ → {0, 1}n

I n p u t me s s a g e D i g e s t

Applications

Signatures: signRSA(h(M)) instead of signRSA(M) Key derivation: master key K to derived keys (Ki = h(K∥i)) Bit commitment, predictions: h(what I know) Message authentication: h(K∥M) …

5 / 59

slide-7
SLIDE 7

Security notions for hashing Hashing requirements

Cryptographic hash functions

h : {0, 1}∗ → {0, 1}n

I n p u t me s s a g e D i g e s t

Applications

Signatures: signRSA(h(M)) instead of signRSA(M) Key derivation: master key K to derived keys (Ki = h(K∥i)) Bit commitment, predictions: h(what I know) Message authentication: h(K∥M) …

5 / 59

slide-8
SLIDE 8

Security notions for hashing Hashing requirements

Cryptographic hash functions

h : {0, 1}∗ → {0, 1}n

I n p u t me s s a g e D i g e s t

Applications

Signatures: signRSA(h(M)) instead of signRSA(M) Key derivation: master key K to derived keys (Ki = h(K∥i)) Bit commitment, predictions: h(what I know) Message authentication: h(K∥M) …

5 / 59

slide-9
SLIDE 9

Security notions for hashing Hashing requirements

Generalized: extendable output function (XOF)

h : {0, 1}∗ → {0, 1}∗ “XOF: a function in which the output can be extended to any length. ”

[Ray Perlner, SHA-3 workshop 2014]

Applications

Signatures: full-domain hashing, mask generating function Key derivation: as many/long derived keys as needed Stream cipher: C = P ⊕ h(K∥nonce)

6 / 59

slide-10
SLIDE 10

Security notions for hashing Hashing requirements

Modern security requirements

Hash or XOF h with n-bit output Modern security requirements

h behaves like a random mapping … up to security strength s

Classical security requirements, derived from it Preimage resistance 2min(n,s) Second-preimage resistance 2min(n,s) Collision resistance 2min(n/2,s)

7 / 59

slide-11
SLIDE 11

Security notions for hashing Modern generic security

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

8 / 59

slide-12
SLIDE 12

Security notions for hashing Modern generic security

Generic security: indistinguishability

Adversary D must tell apart

the ideal function: a monolithic random oracle RO construction S[F] calling an ideal primitive F

Express Pr(success|D) as a function of total cost of queries N Problem: in real world, F is available to adversary

9 / 59

slide-13
SLIDE 13

Security notions for hashing Modern generic security

Generic security: indistinguishability

Adversary D must tell apart

the ideal function: a monolithic random oracle RO construction S[F] calling an ideal primitive F

Express Pr(success|D) as a function of total cost of queries N Problem: in real world, F is available to adversary

9 / 59

slide-14
SLIDE 14

Security notions for hashing Modern generic security

Generic security: indifferentiability [Maurer et al. (2004)]

Applied to hash functions in [Coron et al. (2005)] distinguishing mode-of-use from ideal function (RO) covers adversary with access to primitive F at left additional interface, covered by a simulator at right

10 / 59

slide-15
SLIDE 15

Security notions for hashing Modern generic security

Generic security: indifferentiability [Maurer et al. (2004)]

Methodology: build P that makes left/right distinguishing diffjcult prove bound for advantage given this simulator P P may query RO for acting S-consistently: P[RO]

10 / 59

slide-16
SLIDE 16

Security notions for hashing Modern generic security

Generic security: indifferentiability [Maurer et al. (2004)]

Adv(q) =

  • Pr

( DS[F],F) − Pr ( DRO,P[RO])

  • ≤ ϵ(q)

10 / 59

slide-17
SLIDE 17

Security notions for hashing Modern generic security

Consequences of indifferentiability

Let D: n-bit output pre-image attack. Success probability:

for random oracle: Ppre(D|RO) = q2−n for our construction: Ppre(D|S[F]) = ?

A distinguisher D with Adv(q) = Ppre(D|S[F]) − Ppre(D|RO)

do pre-image attack if success, conclude our construction; otherwise, RO

But we have a proven bound Adv(q) ≤ ϵ(q), so Ppre(D|S[F]) ≤ Ppre(D|RO) + ϵ(q) Can be generalized to any attack

11 / 59

slide-18
SLIDE 18

Security notions for hashing Modern generic security

Consequences of indifferentiability

[Andreeva, Mennink, Preneel, ISC 2010]

12 / 59

slide-19
SLIDE 19

Security notions for hashing Modern generic security

Limitations of indifferentiability

Only about the mode

No security proof with a concrete primitive

Only about single-stage games [Ristenpart et al., Eurocrypt 2011]

Example: hash-based storage auditing Z = h(File∥C)

13 / 59

slide-20
SLIDE 20

Security notions for hashing Modern generic security

Limitations of indifferentiability

Only about the mode

No security proof with a concrete primitive

Only about single-stage games [Ristenpart et al., Eurocrypt 2011]

Example: hash-based storage auditing Z = h(File∥C)

13 / 59

slide-21
SLIDE 21

Why permutation-based cryptography?

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

14 / 59

slide-22
SLIDE 22

Why permutation-based cryptography?

Symmetric crypto: what textbooks and intro’s say

Symmetric cryptography primitives: Block ciphers Key stream generators Hash functions And their modes-of-use

Picture by GlasgowAmateur 15 / 59

slide-23
SLIDE 23

Why permutation-based cryptography?

The truth about symmetric crypto today

Block ciphers:

16 / 59

slide-24
SLIDE 24

Why permutation-based cryptography?

What block cipher are used for

Hashing (Davies-Meyer) and its modes HMAC, MGF1, … Block encryption: ECB, CBC, … Stream encryption:

synchronous: counter mode, OFB, … self-synchronizing: CFB

MAC computation: CBC-MAC, C-MAC, … Authenticated encryption: OCB, GCM, CCM …

17 / 59

slide-25
SLIDE 25

Why permutation-based cryptography?

Block cipher operation

18 / 59

slide-26
SLIDE 26

Why permutation-based cryptography?

Block cipher operation: the inverse

19 / 59

slide-27
SLIDE 27

Why permutation-based cryptography?

When do you need the inverse?

Indicated in red: Hashing and its modes HMAC, MGF1, … Block encryption: ECB, CBC, … Stream encryption:

synchronous: counter mode, OFB, … self-synchronizing: CFB

MAC computation: CBC-MAC, C-MAC, … Authenticated encryption: OCB, GCM, CCM …

Most schemes with misuse-resistant claims

So for most uses you don’t need the inverse!

20 / 59

slide-28
SLIDE 28

Why permutation-based cryptography?

Block cipher internals

21 / 59

slide-29
SLIDE 29

Why permutation-based cryptography?

Davies-Meyer compression function

22 / 59

slide-30
SLIDE 30

Why permutation-based cryptography?

Removing restrictions not required in hashing

23 / 59

slide-31
SLIDE 31

Why permutation-based cryptography?

Simplifying the view: iterated permutation

24 / 59

slide-32
SLIDE 32

Why permutation-based cryptography?

Designing a permutation

Remaining problem: design of iterated permutation

round function: good approaches known asymmetry: round constants

Advantages with respect to block ciphers:

less barriers ⇒ more diffusion no more need for effjcient inverse no more worries about key schedule

25 / 59

slide-33
SLIDE 33

Why permutation-based cryptography?

Examples of permutations

In Salsa, Chacha, Spongent, Quark, Photon… In SHA-3 candidates: CubeHash, Grøstl, JH, MD6, … In CAESAR candidates: Ascon, Icepole, Norx, π-cipher, Primates, Stribob, … In recent proposals: Gimli, Xoodoo And of course in Keccak

26 / 59

slide-34
SLIDE 34

Why permutation-based cryptography?

What textbooks and intro’s should say

Symmetric cryptography primitives: Block ciphers Key stream generators Permutations And their modes-of-use

Picture by Sébastien Wiertz 27 / 59

slide-35
SLIDE 35

Unkeyed applications

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

28 / 59

slide-36
SLIDE 36

Unkeyed applications The sponge construction

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

29 / 59

slide-37
SLIDE 37

Unkeyed applications The sponge construction

The sponge construction

input

  • utput
  • uter

inner r c f f f f f f absorbing squeezing

Calls a b-bit permutation f, with b = r + c

r bits of rate c bits of capacity (security parameter)

Natively implements a XOF

30 / 59

slide-38
SLIDE 38

Unkeyed applications The sponge construction

Generic security of the sponge construction

Theorem (Bound on the RO-differentiating advantage of sponge) A ≤ N2 2c+1 A: differentiating advantage of random sponge from random oracle N: total data complexity c: capacity

[Keccak Team, Eurocrypt 2008]

Preimage resistance 2min(n,c/2) Second-preimage resistance 2min(n,c/2) Collision resistance 2min(n/2,c/2) Any other attack 2min(RO,c/2)

31 / 59

slide-39
SLIDE 39

Unkeyed applications The duplex construction

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

32 / 59

slide-40
SLIDE 40

Unkeyed applications The duplex construction

The duplex construction

r c

  • uter

inner initialize pad trunc f duplexing σ0 Z0 pad trunc f duplexing σ1 Z1 pad trunc f duplexing σ2 Z2 …

Object: D = duplex[f, pad, r] Requesting ℓ-bit output Z = D.duplexing(σ, ℓ)

input σ and output Z limited in length Z depends on all previous inputs

33 / 59

slide-41
SLIDE 41

Unkeyed applications The duplex construction

Generating duplex responses with a sponge

Z0 = sponge(σ0, ℓ0)

34 / 59

slide-42
SLIDE 42

Unkeyed applications The duplex construction

Generating duplex responses with a sponge

Z1 = sponge(pad(σ0)||σ1, ℓ1)

34 / 59

slide-43
SLIDE 43

Unkeyed applications The duplex construction

Generating duplex responses with a sponge

Z2 = sponge(pad(σ0)||pad(σ1)||σ2, ℓ2)

34 / 59

slide-44
SLIDE 44

Unkeyed applications The duplex construction

Security of the duplex construction

Duplexing-sponge lemma Every output block of a duplex object duplex[f, pad, r] is a valid

  • utput of sponge[f, pad, r]

Proof is trivial Corollary The security of duplex[f, pad, r] can be reduced to that of sponge[f, pad, r]

35 / 59

slide-45
SLIDE 45

Unkeyed applications The duplex construction

Security of the duplex construction

Duplexing-sponge lemma Every output block of a duplex object duplex[f, pad, r] is a valid

  • utput of sponge[f, pad, r]

Proof is trivial Corollary The security of duplex[f, pad, r] can be reduced to that of sponge[f, pad, r]

35 / 59

slide-46
SLIDE 46

Keyed applications

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

36 / 59

slide-47
SLIDE 47

Keyed applications The outer keyed sponge and duplex constructions

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

37 / 59

slide-48
SLIDE 48

Keyed applications The outer keyed sponge and duplex constructions

Message authentication codes

f f Key … Padded message f f f MAC

Using sponge See also KMAC [NIST SP 800-185]

38 / 59

slide-49
SLIDE 49

Keyed applications The outer keyed sponge and duplex constructions

Stream encryption

f f Key IV f Key stream

Using sponge Long output stream per IV: similar to OFB mode Short output stream per IV: similar to counter mode

39 / 59

slide-50
SLIDE 50

Keyed applications The outer keyed sponge and duplex constructions

Authenticated encryption: spongeWrap

f f Key … Padded message IV f Key stream f f MAC

Using duplex Adopted by several CAESAR and NIST LWC candidates

[Keccak Team, SAC 2011]

40 / 59

slide-51
SLIDE 51

Keyed applications The outer keyed sponge and duplex constructions

Outer keyed sponge

M pad trunc Z

  • uter

inner r c f f f f f f absorbing squeezing

41 / 59

slide-52
SLIDE 52

Keyed applications The outer keyed sponge and duplex constructions

Outer keyed sponge

K|M pad trunc Z

  • uter

inner r c f f f f f f absorbing squeezing

OKSf

K(M) = spongef(K||M)

41 / 59

slide-53
SLIDE 53

Keyed applications The outer keyed sponge and duplex constructions

Outer keyed duplex

r c

  • uter

inner initialize pad trunc f duplexing σ0 Z0 pad trunc f duplexing σ1 Z1 pad trunc f duplexing σ2 Z2 …

Duplexing-sponge lemma Zi = sponge(σ0||pad|| . . . ||σi)

42 / 59

slide-54
SLIDE 54

Keyed applications The outer keyed sponge and duplex constructions

Outer keyed duplex

r c

  • uter

inner initialize pad trunc f duplexing K|σ0 Z0 pad trunc f duplexing σ1 Z1 pad trunc f duplexing σ2 Z2 …

Duplexing-sponge lemma Zi = sponge(K||σ0||pad|| . . . ||σi) ⇒ equivalent to OKSK

42 / 59

slide-55
SLIDE 55

Keyed applications The outer keyed sponge and duplex constructions

Keyed sponge: distinguishing setting

Straightforward bound: M2/2c+1 + M/2k Security strength s: expected complexity of succesful attack

strength s means attack complexity 2s bounds can be converted to security strength statements

Here: s ≤ min(c/2, k)

e.g., s = 128 requires c = 256 and k = 128 c/2: birthday bound

43 / 59

slide-56
SLIDE 56

Keyed applications The outer keyed sponge and duplex constructions

More fjne-grained attack complexity

Splitting attack complexity:

queries to construction: data complexity M queries to f or f−1: computational complexity N

Our ambition around 2010: M2/2c+1 + NM/2c + N/2k If we limit data complexity M ≤ 2a ≪ 2c/2:

s ≤ min(c − a, k) e.g., s = 128 and a = 64 require c = 192 and k = 128

44 / 59

slide-57
SLIDE 57

Keyed applications The outer keyed sponge and duplex constructions

Intuition behind NM/2c

Typically just one instance with the same partial r-bit input Success probability per guess: 1/2c

45 / 59

slide-58
SLIDE 58

Keyed applications The outer keyed sponge and duplex constructions

Intuition behind NM/2c

Multiple instances (µ ≤ M) with same partial r-bit input Success probability per guess: µ/2c

45 / 59

slide-59
SLIDE 59

Keyed applications The outer keyed sponge and duplex constructions

Intuition behind NM/2c

Multiple instances (µ ≤ M) with same partial r-bit input Success probability per guess: µ/2c

45 / 59

slide-60
SLIDE 60

Keyed applications The outer keyed sponge and duplex constructions

Intuition behind NM/2c

Multiple instances (µ ≤ M) with same partial r-bit input Success probability per guess: µ/2c

45 / 59

slide-61
SLIDE 61

Keyed applications The outer keyed sponge and duplex constructions

Proof evolution

Outer keyed sponge

[Keccak Team, SKEW 2011]

Inner keyed sponge

[Chang, Dworkin, Hong, Kelsey, Nandi, 2012]

Security beyond 2c/2

[Jovanovic, Luykx, Mennink, Asiacrypt 2014]

Inner and outer keyed sponges, multi-target

[Andreeva, Daemen, Mennink, Van Assche, FSE 2015]

Partially full-state sponge-based AE

[Sasaki, Yasuda, CT-RSA 2015]

Full-state keyed sponge (but fjxed output size)

[Gaži, Pietrzak, Tessaro, Crypto 2015]

Full-state keyed sponge and duplex

[Mennink, Reyhanitabar, Vizár, Asiacrypt 2015]

Improved security of the outer keyed sponge

[Naito, Yasuda, FSE 2016]

46 / 59

slide-62
SLIDE 62

Keyed applications The outer keyed sponge and duplex constructions

Full-state absorbing!

Absorbing on full permutation width does not degrade bounds

[Mennink, Reyhanitabar, Vizár, Asiacrypt 2015]

47 / 59

slide-63
SLIDE 63

Keyed applications The outer keyed sponge and duplex constructions

Full-state absorbing!

Absorbing on full permutation width does not degrade bounds

[Mennink, Reyhanitabar, Vizár, Asiacrypt 2015]

47 / 59

slide-64
SLIDE 64

Keyed applications The full-state keyed duplex construction

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

48 / 59

slide-65
SLIDE 65

Keyed applications The full-state keyed duplex construction

Keyed duplex

± K f iv Z ¾ f Z ¾ f Z ¾ …

Initial state: concatenation of key k = K[δ] and IV Full-state absorbing, no padding: |σ| = b Re-phased: f, Z, σ instead of σ, f, Z ≈ all keyed sponge functions are modes of this

49 / 59

slide-66
SLIDE 66

Keyed applications The full-state keyed duplex construction

Generic security of keyed duplex: the setup

± K f IV Z ¾ f Z ¾ f Z ¾ … f x y

?

(±, IV) Path ¾ RO Z f x y

Ideal function: Ideal eXtendable Input Function (IXIF)

RO-based object with duplex interface Independent outputs Z for different paths

Further refjne adversary’s capability

L: # queries to keyed duplex/RO with repeated path qIV : maxIV # init queries with different keys

50 / 59

slide-67
SLIDE 67

Keyed applications The full-state keyed duplex construction

Generic security of keyed duplex: the bound

± K f IV Z ¾ f Z ¾ f Z ¾ … f x y

?

(±, IV) Path ¾ RO Z f x y

L2/2c+1 + (L + 2ν)N/2c + qIVN/2k + M2/2b + . . . with ν: chosen such that probability of ν-wise multi-collision in set

  • f M r-bit values is negligible

[Daemen, Mennink, VA, Asiacrypt 2017]

51 / 59

slide-68
SLIDE 68

Keyed applications Farfalle

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

52 / 59

slide-69
SLIDE 69

Keyed applications Farfalle

Farfalle

f m0 k f m1 k … f i mi k f z0 k′ f z1 k′ … f j zj k′ K∥10∗ f

i+2

f

[FSE 2018]

53 / 59

slide-70
SLIDE 70

Keyed applications Farfalle

Multi-string input and incrementality

f k f 1 k f 2 k 3 k

blank index

f 4 k f 5 k 6 k

blank index

K∥10∗ f k′ … 7 a0 a1 a2 b0 b1 A

10∗

B

10∗

…

54 / 59

slide-71
SLIDE 71

Keyed applications Deck functions and modes

Outline

1

Security notions for hashing Hashing requirements Modern generic security

2

Why permutation-based cryptography?

3

Unkeyed applications The sponge construction The duplex construction

4

Keyed applications The outer keyed sponge and duplex constructions The full-state keyed duplex construction Farfalle Deck functions and modes

55 / 59

slide-72
SLIDE 72

Keyed applications Deck functions and modes

Defjnition of a deck function

A deck function FK Z = 0n + FK ( X(m) ◦ · · · ◦ X(1)) ≪ q doubly extendable cryptographic keyed function

56 / 59

slide-73
SLIDE 73

Keyed applications Deck functions and modes

Defjnition of a deck function

A deck function FK Z = 0n + FK ( X(m) ◦ · · · ◦ X(1)) ≪ q Input: sequence of strings X(m) ◦ · · · ◦ X(1)

56 / 59

slide-74
SLIDE 74

Keyed applications Deck functions and modes

Defjnition of a deck function

A deck function FK Z = 0n + FK ( X(m) ◦ · · · ◦ X(1)) ≪ q Input: sequence of strings X(m) ◦ · · · ◦ X(1) Output: potentially infjnite output

pseudo-random function of the input taking n bits starting from offset q

56 / 59

slide-75
SLIDE 75

Keyed applications Deck functions and modes

Defjnition of a deck function

A deck function FK Z = 0n + FK ( X(m) ◦ · · · ◦ X(1)) ≪ q Effjcient incrementality Extendable input

1 Compute FK (X) 2 Compute FK (Y ◦ X): cost independent of X

56 / 59

slide-76
SLIDE 76

Keyed applications Deck functions and modes

Defjnition of a deck function

A deck function FK Z = 0n + FK ( X(m) ◦ · · · ◦ X(1)) ≪ q Effjcient incrementality Extendable input

1 Compute FK (X) 2 Compute FK (Y ◦ X): cost independent of X

Extendable output

1 Request n1 bits from offset 0 2 Request n2 bits from offset n1: cost independent of n1

56 / 59

slide-77
SLIDE 77

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-78
SLIDE 78

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-79
SLIDE 79

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-80
SLIDE 80

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-81
SLIDE 81

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-82
SLIDE 82

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-83
SLIDE 83

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-84
SLIDE 84

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-85
SLIDE 85

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-86
SLIDE 86

Keyed applications Deck functions and modes

Deck-SANE: session-supporting and nonce-based

Initialization taking nonce N ∈ Z∗

2

e ← 01 history ← N return optional setup tag T = 0t + FK (history) Wrap taking metadata A ∈ Z∗

2 and plaintext P ∈ Z∗ 2

C ← P + FK (history) ≪ t history ← A||0||e ◦ history history ← C||1||e ◦ history T ← 0t + FK (history) e ← e + 11 return ciphertext C and tag T

57 / 59

slide-87
SLIDE 87

Keyed applications Deck functions and modes

Other applications

Using a deck function: Deck-SANE: session AE relying on user nonce Deck-SANSE: session AE using SIV technique Deck-WBC: tweakable wide block cipher

58 / 59

slide-88
SLIDE 88

Conclusions

Any questions?

Thanks for your attention!

https://keccak.team/

59 / 59