Pipelineable On-Line Encryption with Tag (POET) Farzaneh Abed 2 Scott - - PowerPoint PPT Presentation

▶
pipelineable on line encryption with tag poet
SMART_READER_LITE
LIVE PREVIEW

Pipelineable On-Line Encryption with Tag (POET) Farzaneh Abed 2 Scott - - PowerPoint PPT Presentation

Dec 31, 2023 22 likes •643 views

Pipelineable On-Line Encryption with Tag (POET) Farzaneh Abed 2 Scott Fluhrer 1 John Foley 1 Christian Forler 2 Eik List 2 Stefan Lucks 2 David McGrew 1 Jakob Wenzel 2 1 Cisco Systems, 2 Bauhaus-Universitt Weimar DIAC 2014 Santa Barbara, CA

slide-1
SLIDE 1

Pipelineable On-Line Encryption with Tag (POET)

Farzaneh Abed2 Scott Fluhrer1 John Foley1 Christian Forler2 Eik List2 Stefan Lucks2 David McGrew1 Jakob Wenzel2

1 Cisco Systems, 2 Bauhaus-Universität Weimar

DIAC 2014 Santa Barbara, CA

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 1

slide-2
SLIDE 2

Outline

1

Motivation Case Study: OTN Decryption Misuse

2

CAESAR Submission POET

3

Security of POET

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 2

slide-3
SLIDE 3

Motivation

Section 1 Motivation

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 3

slide-4
SLIDE 4

Motivation Case Study: OTN

Case Study: Optical Transport Network (OTN)

Task: Secure network traffic . . .

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

slide-5
SLIDE 5

Motivation Case Study: OTN

Case Study: Optical Transport Network (OTN)

Task: Secure network traffic . . . . . . of real-time applications . . .

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

slide-6
SLIDE 6

Motivation Case Study: OTN

Case Study: Optical Transport Network (OTN)

Task: Secure network traffic . . . . . . of real-time applications . . . . . . in an Optical Transport Network (OTN)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

slide-7
SLIDE 7

Motivation Case Study: OTN

Case Study: Optical Transport Network (OTN)

Task: Secure network traffic . . . . . . of real-time applications . . . . . . in an Optical Transport Network (OTN)

High throughput (40 - 100 Gbit/s) Low latency (few clock cycles) Large message frames (64 KB) (usually consist of multiple TCP/IP or UDP/IP packages)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 4

slide-8
SLIDE 8

Motivation Case Study: OTN

Requirements for OTNs

Security requirements: Data privacy (IND-CPA), and Data integrity (INT-CTXT)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 5

slide-9
SLIDE 9

Motivation Case Study: OTN

Requirements for OTNs

Security requirements: Data privacy (IND-CPA), and Data integrity (INT-CTXT) Functional requirements: On-line encryption/decryption

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 5

slide-10
SLIDE 10

Motivation Case Study: OTN

Problem and Workarounds

Problem: High Latency of Authenticated Decryption

1 Decryption of the entire message 2 Verification of the authentication tag

For 64-kB frames we have 4,096 ciphertext blocks (128 bits)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 6

slide-11
SLIDE 11

Motivation Case Study: OTN

Problem and Workarounds

Problem: High Latency of Authenticated Decryption

1 Decryption of the entire message 2 Verification of the authentication tag

For 64-kB frames we have 4,096 ciphertext blocks (128 bits) Workarounds:

Decrypt-then-mask? [Fouque et al. 03] ⇒ latency again Pass plaintext beforehand and hope. . .

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 6

slide-12
SLIDE 12

Motivation Case Study: OTN

Problem and Workarounds

Problem: High Latency of Authenticated Decryption

1 Decryption of the entire message 2 Verification of the authentication tag

For 64-kB frames we have 4,096 ciphertext blocks (128 bits) Workarounds:

Decrypt-then-mask? [Fouque et al. 03] ⇒ latency again Pass plaintext beforehand and hope. . .

Drawbacks:

Plaintext information would leak if authentication tag invalid Literature calls this setting decryption-misuse [Fleischmann, Forler, and Lucks 12]

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 6

slide-13
SLIDE 13

Motivation Decryption Misuse

How Severe is Decryption-Misuse?

Puts security at high risk CCA-adversary may inject controlled manipulations Particularly, CTR-mode based AE schemes C ⊕ ∆ →Dec M ⊕ ∆

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 7

slide-14
SLIDE 14

Motivation Decryption Misuse

How Severe is Decryption-Misuse?

Puts security at high risk CCA-adversary may inject controlled manipulations Particularly, CTR-mode based AE schemes C ⊕ ∆ →Dec M ⊕ ∆ Decryption-misuse is not covered by existing CCA3-security proofs

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 7

slide-15
SLIDE 15

Motivation Decryption Misuse

Decryption Misuse Resistance

Best to wish for:

Manipulation of ciphertext block Ci ⇒ completely random plaintext Contradiction to on-line requirement

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 8

slide-16
SLIDE 16

Motivation Decryption Misuse

Decryption Misuse Resistance

Best to wish for:

Manipulation of ciphertext block Ci ⇒ completely random plaintext Contradiction to on-line requirement

What can we achive with an on-line encryption scheme?

Manipulation of Ci ⇒ Mi, Mi+1, . . . random garbage Adversary sees at best common message prefixes

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 8

slide-17
SLIDE 17

Motivation Decryption Misuse

Decryption Misuse Resistance

Best to wish for:

Manipulation of ciphertext block Ci ⇒ completely random plaintext Contradiction to on-line requirement

What can we achive with an on-line encryption scheme?

Manipulation of Ci ⇒ Mi, Mi+1, . . . random garbage Adversary sees at best common message prefixes

The security notion of OPRP-CCA covers this behaviour [Bellare et al. 01]

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 8

slide-18
SLIDE 18

Motivation Decryption Misuse

On-Line Permutation

P1 P2 P3 P4 P5 P1 P2 P'3 P4 P5 C1 C2 C3 C4 C5 C'3 C'4 C'5

Encrypt Encrypt

On-Line Pseudo Random Permutation (OPRP) Like a PRP with the following property: Plaintexts with common prefix → ciphertexts with common prefix

(Bellare et al.; “Online Ciphers and the Hash-CBC Construction”; CRYPTO’01)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 9

slide-19
SLIDE 19

Motivation Decryption Misuse

OPRP-CCA

Definition (OPRP-CCA Advantage) Let P be a random on-line permutation, Π = (K, E, D) an on-line encryption scheme, k

$

← K(), and A be an adversary. Then we have

AdvOPRP-CCA

Π

(A) =

  • Pr
  • AEk(.),Dk(.) =

⇒ 1

  • −
  • AP(.),P−1(.) =

⇒ 1

  • Cisco Systems, Bauhaus-Universität Weimar

POET DIAC 2014 10

slide-20
SLIDE 20

Motivation Decryption Misuse

Intermediate (Authentication) Tags

Assume an OPRP-CCA secure encryption scheme Recap: Modifying Ci = ⇒ Mi, Mi+1, . . . , MM random garbage Redundancy in the plaintext (e.g., checksum)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 11

slide-21
SLIDE 21

Motivation Decryption Misuse

Intermediate (Authentication) Tags

Assume an OPRP-CCA secure encryption scheme Recap: Modifying Ci = ⇒ Mi, Mi+1, . . . , MM random garbage Redundancy in the plaintext (e.g., checksum) = ⇒ intermediate authentication tags

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 11

slide-22
SLIDE 22

Motivation Decryption Misuse

Intermediate (Authentication) Tags

Assume an OPRP-CCA secure encryption scheme Recap: Modifying Ci = ⇒ Mi, Mi+1, . . . , MM random garbage Redundancy in the plaintext (e.g., checksum) = ⇒ intermediate authentication tags Common network packets (TCP/IP , UDP/IP) have a checksum = ⇒ OTN: 16-bit integrity for free (per packet)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 11

slide-23
SLIDE 23

CAESAR Submission POET

Section 2 CAESAR Submission POET

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 12

slide-24
SLIDE 24

CAESAR Submission POET

Pipeline On-Line Encryption (POE)

...

E E E τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK2 FK2 FK2 M1 M2 Mb−1 C1 C2 Cb−1

POE is a OPRP-CCA secure enc scheme [Abed et al. 14] Actually, it provides birthday bound security POE is used to process a message or ciphertext

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 13

slide-25
SLIDE 25

CAESAR Submission POET

POET Header Processing

... ...

E E E E E K K K K K H1 H2 Ha−1 Ha Ha||10∗ τ τ L 2L 2a−2L 2a−23L 2a−25L

We just borrowed the PMAC design [Black & Rogaway 02] Nonce is (part of) the header

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 14

slide-26
SLIDE 26

CAESAR Submission POET

POET

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

Well pipelineable 1 BC + 2 AXU hash-function (F) calls per block Borrows tag-splitting procedure from McOE Robust against nonce- and decryption-misuse

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 15

slide-27
SLIDE 27

CAESAR Submission POET

Requirements for F

Basic Assumption (F is AXU) F : {0, 1}k × {0, 1}n → {0, 1}n is ǫ-AXU

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 16

slide-28
SLIDE 28

CAESAR Submission POET

Requirements for F

Basic Assumption (F is AXU) F : {0, 1}k × {0, 1}n → {0, 1}n is ǫ-AXU Further Assumption (Cascade F b is AXU) F b

κ (X) := Fκ(. . . (Fκ(X1) ⊕ X2), . . .) ⊕ Xb) is b · ǫ-AXU

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 16

slide-29
SLIDE 29

CAESAR Submission POET

Requirements for F

Basic Assumption (F is AXU) F : {0, 1}k × {0, 1}n → {0, 1}n is ǫ-AXU Further Assumption (Cascade F b is AXU) F b

κ (X) := Fκ(. . . (Fκ(X1) ⊕ X2), . . .) ⊕ Xb) is b · ǫ-AXU

Thanks to Mridul Nandi for pointing out this implicit assumption for F in our inital version

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 16

slide-30
SLIDE 30

CAESAR Submission POET

Requirements for F

Basic Assumption (F is AXU) F : {0, 1}k × {0, 1}n → {0, 1}n is ǫ-AXU Further Assumption (Cascade F b is AXU) F b

κ (X) := Fκ(. . . (Fκ(X1) ⊕ X2), . . .) ⊕ Xb) is b · ǫ-AXU

Thanks to Mridul Nandi for pointing out this implicit assumption for F in our inital version Nandi will give your more details about this in the next talk :-)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 16

slide-31
SLIDE 31

CAESAR Submission POET

Recommended Instantiations of F

Primary Recommendation: 4-Round-AES 10 + 4 + 4 = 18 AES rounds/block ǫ-AXU with ǫ ≈ 2−113 [Daemen et al. 09]

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 17

slide-32
SLIDE 32

CAESAR Submission POET

Recommended Instantiations of F

Primary Recommendation: 4-Round-AES 10 + 4 + 4 = 18 AES rounds/block ǫ-AXU with ǫ ≈ 2−113 [Daemen et al. 09] Secondary Recommendation: 10-Round-AES (Full-AES) 3 · 10 = 30 AES rounds/block Full AES should be 2−128-AXU

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 17

slide-33
SLIDE 33

CAESAR Submission POET

Recommended Instantiations of F

Primary Recommendation: 4-Round-AES 10 + 4 + 4 = 18 AES rounds/block ǫ-AXU with ǫ ≈ 2−113 [Daemen et al. 09] Secondary Recommendation: 10-Round-AES (Full-AES) 3 · 10 = 30 AES rounds/block Full AES should be 2−128-AXU Withdrawn Recommendation: GF-128 multiplication Reason: Weak-Key Analysis of POET Abdelraheem, Bogdanov and Tischhauser applied the

  • bservations of Cid and Procter [CidP13] to POET

https://eprint.iacr.org/2014/226

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 17

slide-34
SLIDE 34

CAESAR Submission POET

Software Performance

Software performance with Full-AES [Bogdanov et al. 14]

Single message scenario: 4.62 cpb Multi message scenario: 2.75 cpb

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 18

slide-35
SLIDE 35

CAESAR Submission POET

Software Performance

Software performance with Full-AES [Bogdanov et al. 14]

Single message scenario: 4.62 cpb Multi message scenario: 2.75 cpb

Estimated software performance with 4-AES

Single message scenario: (18/30) · 4.62 cpb ≈ 2.77 cpb Multi message scenario: (18/30) · 2.75 cpb = 1.65 cpb

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 18

slide-36
SLIDE 36

CAESAR Submission POET

Software Performance

Software performance with Full-AES [Bogdanov et al. 14]

Single message scenario: 4.62 cpb Multi message scenario: 2.75 cpb

Estimated software performance with 4-AES

Single message scenario: (18/30) · 4.62 cpb ≈ 2.77 cpb Multi message scenario: (18/30) · 2.75 cpb = 1.65 cpb

We are looking for developers for high speed implementations (https://github.com/cforler/poet)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 18

slide-37
SLIDE 37

Security of POET

Section 3 Security of POET

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 19

slide-38
SLIDE 38

Security of POET

POET: Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

Birthday bound security POET is CCA3 secure against nonce-respecting adversaries AdvCCA3

Π

(q, ℓ, t) ≤ AdvIND-CPA

Π

(q, ℓ, t′)+AdvINT-CTXT

Π

(q, ℓ, t′′) (∗)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 20

slide-39
SLIDE 39

Security of POET

POET: Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

Birthday bound security POET is CCA3 secure against nonce-respecting adversaries AdvCCA3

Π

(q, ℓ, t) ≤ AdvIND-CCA

Π

(q, ℓ, t′)+AdvINT-CTXT

Π

(q, ℓ, t′′) (∗)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 20

slide-40
SLIDE 40

Security of POET

POET: Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

Birthday bound security POET is CCA3 secure against nonce-respecting adversaries AdvCCA3

Π

(q, ℓ, t) ≤ AdvIND-CCA

Π

(q, ℓ, t′)+AdvINT-CTXT

Π

(q, ℓ, t′′) (∗) POET is OCCA3 secure against nonce-ignoring adversaries AdvOCCA3

Π

(q, ℓ, t) ≤ AdvOPRP-CCA

Π

(q, ℓ, t′)+AdvINT-CTXT

Π

(q, ℓ, t′′) (∗)

(∗)t′, t′′ ∈ O(t)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 20

slide-41
SLIDE 41

Security of POET

POET: OPRP-CCA-Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

A instantly wins if a bad event occurs

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 21

slide-42
SLIDE 42

Security of POET

POET: OPRP-CCA-Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

A instantly wins if a bad event occurs

  • 1. A can distinguish E from random permutation

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 21

slide-43
SLIDE 43

Security of POET

POET: OPRP-CCA-Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

A instantly wins if a bad event occurs

  • 1. A can distinguish E from random permutation
  • 2. Header collison (Pr[COLLad])

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 21

slide-44
SLIDE 44

Security of POET

POET: OPRP-CCA-Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

A instantly wins if a bad event occurs

  • 1. A can distinguish E from random permutation
  • 2. Header collison (Pr[COLLad])
  • 3. Top row collison (Pr[COLLtop])

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 21

slide-45
SLIDE 45

Security of POET

POET: OPRP-CCA-Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

A instantly wins if a bad event occurs

  • 1. A can distinguish E from random permutation
  • 2. Header collison (Pr[COLLad])
  • 3. Top row collison (Pr[COLLtop])
  • 4. Bottom row collison (Pr[COLLbot])

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 21

slide-46
SLIDE 46

Security of POET

POET: OPRP-CCA-Security

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

A instantly wins if a bad event occurs

  • 1. A can distinguish E from random permutation
  • 2. Header collison (Pr[COLLad])
  • 3. Top row collison (Pr[COLLtop])
  • 4. Bottom row collison (Pr[COLLbot])

A can distinguish POET without a collison (Pr[NOCOLL])

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 21

slide-47
SLIDE 47

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-48
SLIDE 48

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-49
SLIDE 49

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

  • 2. Upper bound for header collison: ℓ2/2n

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-50
SLIDE 50

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

  • 2. Upper bound for header collison: ℓ2/2n
  • 3. Top row collision implies either

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-51
SLIDE 51

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

  • 2. Upper bound for header collison: ℓ2/2n
  • 3. Top row collision implies either

Collision with a final message block: ≈ ℓ2ǫ

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-52
SLIDE 52

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

  • 2. Upper bound for header collison: ℓ2/2n
  • 3. Top row collision implies either

Collision with a final message block: ≈ ℓ2ǫ Collision between non final mesage blocks: ≤ ℓ2ǫ/2

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-53
SLIDE 53

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

  • 2. Upper bound for header collison: ℓ2/2n
  • 3. Top row collision implies either

Collision with a final message block: ≈ ℓ2ǫ Collision between non final mesage blocks: ≤ ℓ2ǫ/2

  • 4. Collision in bottom row (see 3.)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-54
SLIDE 54

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

  • 2. Upper bound for header collison: ℓ2/2n
  • 3. Top row collision implies either

Collision with a final message block: ≈ ℓ2ǫ Collision between non final mesage blocks: ≤ ℓ2ǫ/2

  • 4. Collision in bottom row (see 3.)

Pr[NOCOLL] can be upper bound by 9 · ℓ2/(2n − 3ℓ)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-55
SLIDE 55

Security of POET

POET: OPRP-CCA-Security

Upper bounds for the four bad events

  • 1. Assume E is secure: AdvIND-SPRP

E,E−1

(ℓ + 2q, O(t))

  • 2. Upper bound for header collison: ℓ2/2n
  • 3. Top row collision implies either

Collision with a final message block: ≈ ℓ2ǫ Collision between non final mesage blocks: ≤ ℓ2ǫ/2

  • 4. Collision in bottom row (see 3.)

Pr[NOCOLL] can be upper bound by 9 · ℓ2/(2n − 3ℓ) AdvOPRP-CCA

Π

(q, ℓ, t) ≤ 4ℓ2ǫ+

9ℓ2 2n−3ℓ +AdvIND-SPRP E,E−1

(ℓ+2q, O(t))

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 22

slide-56
SLIDE 56

Security of POET

POET: INT-CTXT-Security

INT-CTXT proof is game-based Combines the ideas from its OPRP-CCA proof and the INT-CTXT proof from McOE Details (→ CAESAR submission) INT-CTXT Advantage

AdvINT-CTXT

POET

(q, ℓ, t) ≤ (ℓ + 2q)2/2n + q 2n − q + AdvOPRP-CCA

Π

(q, ℓ, t)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 23

slide-57
SLIDE 57

Security of POET

Restated Security Claims

Bits of Security Confidentiality for the plaintext log2(2128 − c · ǫ · ℓ2) Integrity for the plaintext log2(2128 − c · ǫ · ℓ2) Integrity for the associated data log2(2128 − c · ǫ · ℓ2) Integrity for the public message number log2(2128 − c · ǫ · ℓ2) Security against key recovery 128 Security against tag guessing 128 Yu Sasaki pointed out that our stated security claims had been confusing

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 24

slide-58
SLIDE 58

Security of POET

Conclusion

POET is non-sequential and on-line support for intermediate tags is robust against nonce- and decryption-misuse (OCCA3-secure = OPRP-CCA + INT-CTXT) fulfills the demanding requirements of high-speed networks

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 25

slide-59
SLIDE 59

Security of POET

Conclusion

POET is non-sequential and on-line support for intermediate tags is robust against nonce- and decryption-misuse (OCCA3-secure = OPRP-CCA + INT-CTXT) fulfills the demanding requirements of high-speed networks Final Remark: Cryptanalysis, fruitful remarks and third party implementation etc. will be rewarded!

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 25

slide-60
SLIDE 60

Security of POET

The End Thank you for your attention!

POET Homepage http://www.uni-weimar.de/de/medien/professuren/ mediensicherheit/research/poet/

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 26

slide-61
SLIDE 61

Security of POET

——————————————————————-

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 27

slide-62
SLIDE 62

Security of POET

Key Derivation

...

E E E E E EK(|M|) EK(|M|) τ X2 Xb−2 τ Y2 Yb−2 FK1 FK1 FK1 FK1 FK1 FK2 FK2 FK2 FK2 FK2 τ T β||Z M1 M2 Mb−1 Mb||τ α LT LT C1 C2 Cb−1 Cb||T α

POET needs five 128-bit keys: K, K1, and K2, L, and LT They are derived from a 128 bit master key SK K = ESK(0), L = ESK(1) K1 = ESK(2) K2 = ESK(3), LT = ESK(4) (currently I am analysing the case: K1 = K2 and LT = 7L)

Cisco Systems, Bauhaus-Universität Weimar POET DIAC 2014 27