Intro Repairing GCM Simeck Design Summery Revisiting Counter Mode to Repair Galois/Counter Mode Bo Zhu, Yin Tan and Guang Gong University of Waterloo, Canada Aug 12, 2013 1 of 32 Revisiting CM to Repair GCM
Intro Repairing GCM Simeck Design Summery Revisiting Counter Mode to Repair Galois/Counter Mode and Simeck: An Authenticated Cipher Design Bo Zhu, Yin Tan and Guang Gong University of Waterloo, Canada Aug 12, 2013 2 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Motivations ◮ To study existing modes of operations ◮ Before designing authenticated ciphers 3 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Motivations ◮ To study existing modes of operations ◮ Before designing authenticated ciphers ◮ Recent attacks on GCM ◮ A flaw found in GCM’s security proofs in Crypto’12 ◮ Forgery attacks in FSE’12 and FSE’13 3 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Motivations ◮ To study existing modes of operations ◮ Before designing authenticated ciphers ◮ Recent attacks on GCM ◮ A flaw found in GCM’s security proofs in Crypto’12 ◮ Forgery attacks in FSE’12 and FSE’13 ◮ To study lightweight cipher designs ◮ To use with mode of operation 3 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Motivations ◮ To study existing modes of operations ◮ Before designing authenticated ciphers ◮ Recent attacks on GCM ◮ A flaw found in GCM’s security proofs in Crypto’12 ◮ Forgery attacks in FSE’12 and FSE’13 ◮ To study lightweight cipher designs ◮ To use with mode of operation ◮ Two block ciphers designed by people from NSA 3 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Outline Intro to Galois/Counter Mode Repairing Galois/Counter Mode The flaw in GCM’s proofs discovered by Iwata et al. A fix to GCM’s security proofs and bounds Simeck: A Simple Authenticated Cipher Design Design Rationales Specifications Summery and Future Work 4 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Outline Intro to Galois/Counter Mode Repairing Galois/Counter Mode The flaw in GCM’s proofs discovered by Iwata et al. A fix to GCM’s security proofs and bounds Simeck: A Simple Authenticated Cipher Design Design Rationales Specifications Summery and Future Work 5 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Galois/Counter Mode (GCM) ◮ One design of AEAD by McGrew and Viega in 2005 ◮ Counter Mode (CM) for encryption ◮ Galois MAC (GMAC) for authentication ◮ GCM comparing to CCM (CM + CBC-MAC) ◮ Less popular than CCM for historical reasons ◮ Supported by OpenSSH from v6.2 (March 2013) ◮ Incluced in NSA Suite B (CCM isn’t in) ◮ Suite A is classified ◮ Parallelizable computation 6 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Authentication by Galois MAC (GMAC) Additions and multiplications in GF (2 128 ) ◮ Authentication key: H = E K (0) The image is from Procter and Cid’s slides in FSE’13. 7 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Polynomial Based GHASH ◮ GMAC = GHASH ( H , A , C ) + E K ( IV ) ◮ GHASH m M i × H m − i +1 = g M ( H ) � h H ( M ) = i =1 ◮ Note: constant term is zero 8 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Encryption in Counter Mode (CM) The image is from Saarinen’s paper in FSE’12. 9 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation ◮ Initial counter ◮ N 0 = IV || 0 32 , if len ( IV ) = 96 ◮ N 0 = GHASH H ( IV ), if len ( IV ) � = 96 10 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation ◮ Initial counter ◮ N 0 = IV || 0 32 , if len ( IV ) = 96 ◮ N 0 = GHASH H ( IV ), if len ( IV ) � = 96 ◮ Generating counters N r +1 = msb 96 ( N r ) || lsb 32 ( N r ) ⊞ 1 10 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation ◮ Initial counter ◮ N 0 = IV || 0 32 , if len ( IV ) = 96 ◮ N 0 = GHASH H ( IV ), if len ( IV ) � = 96 ◮ Generating counters N r +1 = msb 96 ( N r ) || lsb 32 ( N r ) ⊞ 1 ◮ Security of GCM highly depends the prob of counter collisions ◮ N ′ 0 = N ′′ 0 , N ′ r 1 = N ′′ r 2 10 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation ◮ Initial counter ◮ N 0 = IV || 0 32 , if len ( IV ) = 96 ◮ N 0 = GHASH H ( IV ), if len ( IV ) � = 96 ◮ Generating counters N r +1 = msb 96 ( N r ) || lsb 32 ( N r ) ⊞ 1 ◮ Security of GCM highly depends the prob of counter collisions ◮ N ′ 0 = N ′′ 0 , N ′ r 1 = N ′′ r 2 ◮ if len ( IV ) � = 96, GHASH ( IV 1 ) = GHASH ( IV 2 ), GHASH ( IV 1 ) ⊞ r 1 = GHASH ( IV 2 ) ⊞ r 2 10 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation ◮ Initial counter ◮ N 0 = IV || 0 32 , if len ( IV ) = 96 ◮ N 0 = GHASH H ( IV ), if len ( IV ) � = 96 ◮ Generating counters N r +1 = msb 96 ( N r ) || lsb 32 ( N r ) ⊞ 1 ◮ Security of GCM highly depends the prob of counter collisions ◮ N ′ 0 = N ′′ 0 , N ′ r 1 = N ′′ r 2 ◮ if len ( IV ) � = 96, GHASH ( IV 1 ) = GHASH ( IV 2 ), GHASH ( IV 1 ) ⊞ r 1 = GHASH ( IV 2 ) ⊞ r 2 ◮ GHASH ( IV 1 ) ⊞ ( r 1 − r 2 ) = GHASH ( IV 2 ) 10 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation (Cont.) GHASH ( IV 1 ) ⊞ r = GHASH ( IV 2 ) h H ( IV 1 ) ⊞ r = h H ( IV 2 ) 11 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation (Cont.) GHASH ( IV 1 ) ⊞ r = GHASH ( IV 2 ) h H ( IV 1 ) ⊞ r = h H ( IV 2 ) g IV 1 ( H ) ⊞ r = g IV 2 ( H ) 11 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation (Cont.) GHASH ( IV 1 ) ⊞ r = GHASH ( IV 2 ) h H ( IV 1 ) ⊞ r = h H ( IV 2 ) g IV 1 ( H ) ⊞ r = g IV 2 ( H ) ◮ For a randomly chosen H , the collision prob is # { x : x ∈ GF (2 128 ) | g IV 1 ( x ) ⊞ r = g IV 2 ( x ) } 2 128 11 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation (Cont.) GHASH ( IV 1 ) ⊞ r = GHASH ( IV 2 ) h H ( IV 1 ) ⊞ r = h H ( IV 2 ) g IV 1 ( H ) ⊞ r = g IV 2 ( H ) ◮ For a randomly chosen H , the collision prob is # { x : x ∈ GF (2 128 ) | g IV 1 ( x ) ⊞ r = g IV 2 ( x ) } 2 128 ◮ In the original security proofs of GCM, it was believed g IV 1 ( x ) ⊞ r = g IV 2 ( x ) has the same number of solutions as g IV 1 ( x ) ⊕ r = g IV 2 ( x ) 11 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Counter Generation (Cont.) GHASH ( IV 1 ) ⊞ r = GHASH ( IV 2 ) h H ( IV 1 ) ⊞ r = h H ( IV 2 ) g IV 1 ( H ) ⊞ r = g IV 2 ( H ) ◮ For a randomly chosen H , the collision prob is # { x : x ∈ GF (2 128 ) | g IV 1 ( x ) ⊞ r = g IV 2 ( x ) } 2 128 ◮ In the original security proofs of GCM, it was believed g IV 1 ( x ) ⊞ r = g IV 2 ( x ) has the same number of solutions as g IV 1 ( x ) ⊕ r = g IV 2 ( x ) which is upper-bounded by max { deg ( g IV 1 ( x )) , deg ( g IV 2 ( x )) } = max { len ( IV 1 ) , len ( IV 2 ) } + 1 11 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Provable Security Reparing GCM Outline Intro to Galois/Counter Mode Repairing Galois/Counter Mode The flaw in GCM’s proofs discovered by Iwata et al. A fix to GCM’s security proofs and bounds Simeck: A Simple Authenticated Cipher Design Design Rationales Specifications Summery and Future Work 12 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Provable Security Reparing GCM Problem in N r ⊞ 1 ◮ Pointed out by Iwata et al. in Crypto’12 ◮ N r ⊞ 1 is non-linear in Galois field ◮ f ( x ) ⊞ r = g ( x ) can be converted to multiple forms of equations in GF 13 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Provable Security Reparing GCM Problem in N r ⊞ 1 ◮ Pointed out by Iwata et al. in Crypto’12 ◮ N r ⊞ 1 is non-linear in Galois field ◮ f ( x ) ⊞ r = g ( x ) can be converted to multiple forms of equations in GF ◮ Much more solutions than expected max { len ( IV 1 ) , len ( IV 2 ) } + 1 ◮ α r times more solutions ◮ for r < 2 32 , α r is up to 2 22 α r · (max { len ( IV 1 ) , len ( IV 2 ) } + 1) ≤ 2 22 · (max { len ( IV 1 ) , len ( IV 2 ) } + 1) 13 of 32 Revisiting CM to Repair GCM, and Simeck
Intro Repairing GCM Simeck Design Summery Provable Security Reparing GCM Actual Security Bounds of GCM ◮ New security bounds of GCM were also given by Iwata et al. ◮ for both of privacy (encryption) and authenticity (MAC) ◮ almost 2 22 looser than originally claimed 14 of 32 Revisiting CM to Repair GCM, and Simeck
Recommend
More recommend
