[PPT] - Release of Unverified Plaintext: Tight Unified Model and Application PowerPoint Presentation

SLIDE 1

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Release of Unverified Plaintext: Tight Unified Model and Application to ANYDAE

Donghoon Chang and Nilanjan Datta and Avijit Dutta and Bart Mennink and Mridul Nandi and Somitra Sanadhya and Ferdinand Sibleyras

Institute for Advancing Intelligence, TCG-CREST, Kolkata

Fast Software Encryption 2020

26th October, 2020

1 / 30

SLIDE 2

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Outline of the Talk

Definitions of AE and Security Notion. RUP Security. INT-RUP Attack on SUNDAE. MONDAE: An INT-RUP Secure Variant of SUNDAE. ANYDAE: Generic INT-RUP Design. TUESDAE: An Optimal Instantiation of ANYDAE.

2 / 30

SLIDE 3

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Goal of Symmetric Cryptography

Symmetric Cryptography Privacy Integrity

SLIDE 4

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Goal of Symmetric Cryptography

Symmetric Cryptography Privacy Integrity

Enc. Scheme

MAC Scheme

3 / 30

SLIDE 5

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Goal of Symmetric Cryptography

Symmetric Cryptography Privacy Integrity

Enc. Scheme

MAC Scheme + AE Scheme

4 / 30

SLIDE 6

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Goal of Symmetric Cryptography

Symmetric Cryptography Privacy Integrity

Enc. Scheme

MAC Scheme + AE Scheme Stateful AE (Nonce, Random IV or Arbitrary IV Based). Stateless AE.

4 / 30

SLIDE 7

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Stateful Authenticated Encryption (AE)

Authenticated Encryption

Enc. Algorithm
Dec. Algorithm

EK N M A DK N A C M/⊥

5 / 30

SLIDE 8

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Stateless Authenticated Encryption (AE)

Authenticated Encryption

Enc. Algorithm
Dec. Algorithm

EK N M A DK N A C M/⊥

6 / 30

SLIDE 9

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of AE

Privacy Requirement (IND-CPA). Real World (Enc. Function) Ideal World (Random Function) EK RF

7 / 30

SLIDE 10

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of AE

Privacy Requirement (IND-CPA). Real World (Enc. Function) Ideal World (Random Function) EK RF For a secure AE, the distinguishing advantage is negligible.

7 / 30

SLIDE 11

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of AE

Integrity Requirement (INT-CTXT). EK DK

8 / 30

SLIDE 12

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of AE

Integrity Requirement (INT-CTXT). EK DK A forges if A can produce a non-trivial (N∗, A∗, C ∗) tuple such that DK(N∗, A∗, C ∗) = M∗.

8 / 30

SLIDE 13

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of AE

Integrity Requirement (INT-CTXT). EK DK A forges if A can produce a non-trivial (N∗, A∗, C ∗) tuple such that DK(N∗, A∗, C ∗) = M∗. For a secure AE, the forging advantage is negligible.

8 / 30

SLIDE 14

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of AE

An AE scheme is secure in a conventional sense if it achieves IND-CPA and INT-CTXT security.

9 / 30

SLIDE 15

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Release of Unverifiable Plaintext (RUP) Issue of AE

Plaintext blocks can only be released after successful verification in the receiver end. But the buffer size in the receiving end is limited. As a result, it might not be able to hold the entire plaintext at once. Receiver might have to release the plaintext before verifying.

10 / 30

SLIDE 16

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

RUP Security Model

DK Core DK VK M/⊥ N A C M N A C ⊤/⊥ C A N EK

11 / 30

SLIDE 17

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

RUP Security Model

Security of AE in RUP Model formalized by Andreeva et al. (ASIACRYPT 2014).

12 / 30

SLIDE 18

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

RUP Security Model

Security of AE in RUP Model formalized by Andreeva et al. (ASIACRYPT 2014). PA1 / PA2 notion. INT-RUP notion.

12 / 30

SLIDE 19

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

RUP Security Model

Security of AE in RUP Model formalized by Andreeva et al. (ASIACRYPT 2014). PA1 / PA2 notion. INT-RUP notion. PA1 Notion. Real World Ideal World EK DK EK S

Enc. Hist

12 / 30

SLIDE 20

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

RUP Security Model

Security of AE in RUP Model formalized by Andreeva et al. (ASIACRYPT 2014). PA1 / PA2 notion. INT-RUP notion. PA2 Notion. Real World Ideal World EK DK EK S

Enc. Hist

13 / 30

SLIDE 21

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

RUP Secure AE

An AE scheme is RUP secure if it achieves IND-CPA and PA1 and INT-RUP security.

14 / 30

SLIDE 22

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Different Variants of RUP Security

Hoang et al. introduced RAE notion (EUROCRYPT 2015).

Distinguish AE from a random injective function.

Hoang et al. introduced RAEsim notion (EUROCRYPT 2015).

Employs PA2 notion.

Barwell et al. introduced SAE notion (IMACC 2015).

Refinement of RAE for nonce based AE.

Ashur et al. introduced RUPAE notion (CRYPTO 2017).

Focuses on nonce based AE. PA1 + INT-RUP with the ideal model decryption being a random function.

15 / 30

SLIDE 23

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Different Variants of RUP Security

Encode-then-SPRP is known to achieve RAE and RUPAE security.

16 / 30

SLIDE 24

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Different Variants of RUP Security

Encode-then-SPRP is known to achieve RAE and RUPAE security. Such construction is two pass in both encryption and decryption.

16 / 30

SLIDE 25

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Different Variants of RUP Security

Encode-then-SPRP is known to achieve RAE and RUPAE security. Such construction is two pass in both encryption and decryption. These security notions hold for nonce based AE. Security is void when nonce is misused.

16 / 30

SLIDE 26

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Different Variants of RUP Security

Encode-then-SPRP is known to achieve RAE and RUPAE security. Such construction is two pass in both encryption and decryption. These security notions hold for nonce based AE. Security is void when nonce is misused. We need a security model in RUP scenario which allows Nonce Misuse. Single pass decryption feature.

16 / 30

SLIDE 27

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

AERUP Security Notion

AERUP Security Notion. Real World Ideal World EK VK DK $ S ⊥ AERUP ⇐ ⇒ AE + PA1 + INT-RUP.

17 / 30

SLIDE 28

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE [Banik et al., FSE 2019]

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

Determinstic AE.

18 / 30

SLIDE 29

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE [Banik et al., FSE 2019]

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

Determinstic AE. Makes a + 2m + 1 BC invocations.

18 / 30

SLIDE 30

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE [Banik et al., FSE 2019]

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

Determinstic AE. Makes a + 2m + 1 BC invocations. One of the AE Candidates in NIST Lightweight Cryptography competition.

18 / 30

SLIDE 31

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE [Banik et al., FSE 2019]

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

SUNDAE is particularly efficient for short messages.

19 / 30

SLIDE 32

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE [Banik et al., FSE 2019]

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

SUNDAE is particularly efficient for short messages. State size as small as the block size.

19 / 30

SLIDE 33

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE [Banik et al., FSE 2019]

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

SUNDAE is particularly efficient for short messages. State size as small as the block size. Offers good implementation characteristics both on lightweight and high-performance platforms.

19 / 30

SLIDE 34

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

1. A makes query DK(ǫ, T1, C1[1]), where T1 = 110n−2 and
btains M1[1].

20 / 30

SLIDE 35

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

1. A makes query DK(ǫ, T1, C1[1]), where T1 = 110n−2 and
btains M1[1].

A learns EK(110n−2) = M1[1] ⊕ C1[1].

20 / 30

SLIDE 36

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

2. A makes query DK(ǫ, T2, C2[1]), where

T2 = M1[1] ⊕ C1[1] ⊕ A[1] and obtains M2[1].

21 / 30

SLIDE 37

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

2. A makes query DK(ǫ, T2, C2[1]), where

T2 = M1[1] ⊕ C1[1] ⊕ A[1] and obtains M2[1]. A learns EK(EK(110n−2) ⊕ A[1]) = M2[1] ⊕ C2[1].

21 / 30

SLIDE 38

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A′

1

EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

3. A makes query DK(ǫ, T3, C3[1]), where

T3 = M3[1] ⊕ C3[1] ⊕ A′[1](= A[1]) and obtains M3[1].

22 / 30

SLIDE 39

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A′

1

EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

3. A makes query DK(ǫ, T3, C3[1]), where

T3 = M3[1] ⊕ C3[1] ⊕ A′[1](= A[1]) and obtains M3[1]. A learns EK(EK(110n−2) ⊕ A′[1]) = M3[1] ⊕ C3[1].

22 / 30

SLIDE 40

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A′

1

EK A2 ⊕ ∆ pad M2[1] ⊕ C2[1] EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

4. A makes query EK(A′[1](A[2] ⊕ ∆)A[3] . . . A[a], M)) and
btains (C, T), ∆ = M2[1] ⊕ C2[1] ⊕ M3[1] ⊕ C3[1].

23 / 30

SLIDE 41

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

5. A forges with (A, T, C).

24 / 30

SLIDE 42

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

SUNDAE is not RUP Secure: INT-RUP Insecurity

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T EK C1 M1 EK ⌊·⌋|M2| M2 C2

5. A forges with (A, T, C).

SUNDAE is not INT-RUP Secure.

24 / 30

SLIDE 43

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

MONDAE: A RUP-Secure Variant of SUNDAE.

25 / 30

SLIDE 44

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Remedy for INT-RUP Attack: MONDAE

Reason for INT-RUP attack on SUNDAE. Adversary can learn Ek(T) for any value of T.

26 / 30

SLIDE 45

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Remedy for INT-RUP Attack: MONDAE

Reason for INT-RUP attack on SUNDAE. Adversary can learn Ek(T) for any value of T. Can we make a small change to SUNDAE and make it RUP-Secure ?

26 / 30

SLIDE 46

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Remedy for INT-RUP Attack: MONDAE

Reason for INT-RUP attack on SUNDAE. Adversary can learn Ek(T) for any value of T. Can we make a small change to SUNDAE and make it RUP-Secure ?

110n−2 EK A1 EK A2 pad |A2| < n ? 2 : 4 EK M1 EK M2 pad |M2| < n ? 2 : 4 EK T fix1 EK C1 M1 EK ⌊·⌋|M2| M2 C2

26 / 30

SLIDE 47

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

ANYDAE: A Generic RUP Secure AE

Fmt(A, M) = ((B1, δ1), . . . , (Bl−1, δl−1), Bl). ρ1(Bi, δi) → {0, 1}n. ρ2, ρ3 : {0, 1}n → {0, 1}n.

EK ρ1 δ1 B2 B1 EK ρ1 δ2 B3 EK ρ1 δ3 ... Bℓ EK T T ρ2 EK M1 C1 ρ3 EK M2 C2 ... ρ3 EK ⌊·⌋|Mm| Mm Cm

27 / 30

SLIDE 48

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

ANYDAE: A Generic RUP Secure AE

Fmt(A, M) = ((B1, δ1), . . . , (Bl−1, δl−1), Bl). ρ1(Bi, δi) → {0, 1}n. ρ2, ρ3 : {0, 1}n → {0, 1}n.

EK ρ1 δ1 B2 B1 EK ρ1 δ2 B3 EK ρ1 δ3 ... Bℓ EK T T ρ2 EK M1 C1 ρ3 EK M2 C2 ... ρ3 EK ⌊·⌋|Mm| Mm Cm

Is ANYDAE secure for any choice of Fmt, ρ1, ρ2 and ρ3 function ?

27 / 30

SLIDE 49

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of ANYDAE

F1 is the set of first block outputs of Fmt function.

28 / 30

SLIDE 50

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of ANYDAE

F1 is the set of first block outputs of Fmt function. If Fmt is injective and prefix free function. ρ1 is ǫ1 differential uniform and γ1 regular function. ρ2 is γ2 regular and ρ3 is γ3 regular functions. F1 is disjoint from the range of ρ2. Ω := |F1 ∩ range(ρ3)|.

28 / 30

SLIDE 51

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Security of ANYDAE

F1 is the set of first block outputs of Fmt function. If Fmt is injective and prefix free function. ρ1 is ǫ1 differential uniform and γ1 regular function. ρ2 is γ2 regular and ρ3 is γ3 regular functions. F1 is disjoint from the range of ρ2. Ω := |F1 ∩ range(ρ3)|. Security Result AdvANYDAE(σ, qd) σ2

2n + Ωσ · γ3 + qd 2n .

28 / 30

SLIDE 52

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

MONDAE and TUESDAE: Instantiations of ANYDAE

MONDAE is an instantiation of ANYDAE where ρ2 is fix1 function. TUESDAE is a n-bit state DAE scheme and hence optimal instantiation of ANYDAE. MONDAE and TUESDAE are INT-RUP secure. TUESDAE makes optimal number of BC calls. This optimality comes at the cost of some additional multiplexers which could slightly increase the hardware area.

29 / 30

SLIDE 53

AE Definition RUP Security RUP Attack on SUNDAE ANYDAE

Thank You For Your Attention.

30 / 30