Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal - - PowerPoint PPT Presentation

β–Ά
tweakable block cipher secure beyond the
SMART_READER_LITE
LIVE PREVIEW

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal - - PowerPoint PPT Presentation

Dec 12, 2022 213 likes β€’524 views

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model Jooyoung Lee , Byeonghak Lee KAIST Tweakable Block Cipher A tweakable block cipher accepts an additional input "tweak - Tweaks are publicly used

slide-1
SLIDE 1

Tweakable Block Cipher Secure Beyond the Birthday Bound in the Ideal Cipher Model

Jooyoung Lee, Byeonghak Lee KAIST

slide-2
SLIDE 2

Tweakable Block Cipher

  • A tweakable block cipher 𝐹

accepts an additional input "tweak”

  • Tweaks are publicly used (like IVs and nonces in modes of operation)
  • Changing tweaks should be efficient (compared to changing keys)
slide-3
SLIDE 3

Motivation: why do we need tweaks

ο‚– Provide variability to the block cipher ο‚– Can be used to construct various cryptographic schemes Vs.

slide-4
SLIDE 4

Application: Authenticated Encryption

ο‚– Tweakable Authenticated Encryption (Liskov, Rivest, Wagner)

  • TAE can be proved to be secure if the underlying TBC is secure
  • Typically, the TBC is replaced by a block cipher-based construction (e.g.,

OCB modes of operation)

slide-5
SLIDE 5

Construction of Tweakable Block Ciphers

ο‚– Dedicated construction

  • Hasty Pudding, Mercy, Threefish, etc.

ο‚– Block cipher-based construction

  • LRW1, LRW2, XEX, XHX, etc.

ο‚– Permutation-based construction

  • TEM, XPX, etc.
slide-6
SLIDE 6

Block cipher-based Construction

ο‚– Using fixed keys (independent of tweaks)

  • Security is proved in the standard model
  • The underlying BC is replaced by an ideal

random permutation (up to the security of TBC)

ο‚– Using tweak-dependent keys

  • Security is proved in the ideal cipher model
  • An adversary is allowed oracle access to the

primitive

slide-7
SLIDE 7

Security Notion

ο‚– How should we model secure tweakable block ciphers?

  • When a secret key is chosen uniformly at random, each tweak should

make the keyed block cipher behave like an independent random permutation

  • This model is similar to the ideal cipher model, but an adversary is not

allowed oracle access to the underlying tweakable block cipher

Vs.

slide-8
SLIDE 8

Security Notion

ο‚– A tweakable block cipher on {0,1}π‘œ with key space 𝒧 and tweak space 𝒰 is a function 𝐹: 𝒧 Γ— 𝒰 Γ— {0,1}π‘œ β†’ {0,1}π‘œ such that 𝐹 (𝐿, π‘ˆ,βˆ™) (also denoted 𝐹 𝐿(π‘ˆ,βˆ™)) is a permutation on {0,1}π‘œ for each pair of key and tweak (𝐿, π‘ˆ). ο‚– A tweakable permutation on {0,1}π‘œ with tweak space 𝒰 is a function 𝑄: 𝒰 Γ— {0,1}π‘œ β†’ {0,1}π‘œ such that 𝑄 (π‘ˆ,βˆ™) is a permutation on {0,1}π‘œ for each tweak π‘ˆ.

slide-9
SLIDE 9

Security Notion

ο‚– An ideal tweakable permutation is a tweakable permutation that has been chosen uniformly at random from the set of all possible tweakable permutations. ο‚– Any distinguisher should not be able to distinguish a tweakable block cipher with a secret random key and an ideal tweakable permutation by making a certain number of oracle queries.

𝐹 𝐿 𝑄

Real world Ideal world Real? or Ideal?

slide-10
SLIDE 10

Security Notion for Ideal Cipher-based Construction

ο‚– An (information-theoretic) adversary is allowed oracle access to both the construction and the ideal cipher

𝐹

𝑕(𝑒)

x

β„Ž(𝑒)

y 𝐹 𝑄 𝐹

Real world Ideal world Real? or Ideal?

𝐹

slide-11
SLIDE 11

Security Notion for Ideal Cipher-based Construction

ο‚– For a distinguisher 𝒠, its distinguishing advantage is defined by 𝐁𝐞𝐰𝐹

𝒠 = Pr 1 $

𝒠𝑄

,𝐹 βˆ’ Pr 1 $

𝒠𝐹

𝐿,𝐹

where 𝑄 is an ideal random tweakable permutation and a key 𝐿 is uniform random ο‚– For positive integers π‘ž and π‘Ÿ, 𝐁𝐞𝐰𝐹

π‘ž, π‘Ÿ = max𝒠 𝐁𝐞𝐰𝐹 𝒠

, where the maximum is taken over all the distinguishers making π‘ž block cipher queries and π‘Ÿ construction queries

slide-12
SLIDE 12

𝐺 1 , 𝐺 2 (Mennink, FSE 2015)

When it is based on an π‘œ-bit block block cipher using π‘œ-bit keys, ο‚– 𝐺 1 is secure up to 22π‘œ/3 queries

  • BBB-secure with one BC calls

ο‚– 𝐺 [2] is secure up to 2π‘œ queries

  • Fully secure with two BC calls

𝐺 1 𝐺 2

slide-13
SLIDE 13

𝐹1 , … , 𝐹32 (Wang, et. al., Aisacrypt 2016)

When it is based on an π‘œ -bit block block cipher using π‘œ-bit keys, ο‚– 𝐹i is secure up to 2π‘œ queries

  • Make two block cipher calls (or a single

block cipher call by precomputation)

  • Only xor operation is used
slide-14
SLIDE 14

XHX (Jha, et. al., Latincrypt 2017)

ο‚– XHX uses two types of hash functions

  • 𝑕: πœ€-almost xor-universal and uniform hash function
  • β„Ž: πœ€β€²-almost universal and uniform hash function

ο‚– When it is based on an π‘œ-bit block block cipher using 𝑛-bit keys, XHX is secure up to 2

π‘œ+𝑛 2 queries

𝐹 𝑕(𝑒) 𝑦 β„Ž(𝑒) 𝑧

slide-15
SLIDE 15

Uniform/Universal Hash Functions

For (small) πœ€ > 0, ο‚– A keyed function β„Ž is πœ€-almost uniform if for any 𝑦 and 𝑧, Pr[β„Ž 𝑦 = 𝑧] ≀ πœ€. ο‚– A keyed function β„Ž is πœ€-almost universal if for any 𝑦 and 𝑦′, Pr[β„Ž 𝑦 = β„Ž(𝑦′)] ≀ πœ€. ο‚– A keyed function β„Ž is πœ€-almost xor-universal if for any 𝑦 and 𝑧, Pr[β„Ž 𝑦 βŠ• β„Ž 𝑦′ = 𝑧] ≀ πœ€.

  • These functions can be defined as polynomials over a finite field.

Cryptology Laboratory @ GSIS, KAIST 15

slide-16
SLIDE 16

XHX2: Motivation

ο‚– The input size of an π‘œ-bit block block cipher using 𝑛-bit key is π‘œ + 𝑛 bits. ο‚– In the ideal cipher model, its information-theoretic security cannot go beyond π‘œ + 𝑛 bits. (due to key exhaustive search) ο‚– With respect to this size, the birthday bound should be

π‘œ+𝑛 2 .

ο‚– Can we go beyond the birthday bound?

slide-17
SLIDE 17

XHX2: Construction

ο‚– Cascade of two independent copies of XHX

  • 𝐹1 and 𝐹2 are π‘œ-bit block ciphers using 𝑛-bit keys
  • 𝑕1 and 𝑕2 are πœ€-almost uniform and universal hash functions
  • β„Ž1 and β„Ž2 is πœ€β€²-almost uniform and xor-universal hash functions

𝐹1 𝑕1(𝑒) 𝑦 β„Ž1(𝑒) 𝐹2 𝑕2(𝑒) β„Ž2(𝑒) 𝑧

slide-18
SLIDE 18

Provable Security of XHX2

When 𝑕1 and 𝑕2 are π‘œ-bit πœ€-almost uniform and universal hash functions, and β„Ž1 and β„Ž2 are 𝑛-bit πœ€β€²-almost uniform and xor-universal hash functions,

  • ne has

ππžπ°π‘ŒπΌπ‘Œ2 π‘ž, π‘Ÿ ≀ 64π‘ž

2 3π‘Ÿ 2 3πœ€πœ€β€² + 256 8π‘Ÿ3 + 2π‘žπ‘Ÿ2 1 2πœ€ 1 2πœ€β€²

2

π‘œ 2

+ 160 16π‘Ÿ3 + 8π‘žπ‘Ÿ2 + π‘ž2π‘Ÿ

1 2πœ€β€²

2π‘œ + 256 16π‘Ÿ3 + 8π‘žπ‘Ÿ2 + 2π‘Ÿ2 + 3π‘ž2π‘Ÿ πœ€2(πœ€β€²)2 + 131072π‘œ2π‘Ÿ2πœ€β€² 22π‘œ , where πœ€ β‰ˆ

1 2π‘œ , πœ€β€² β‰ˆ 1 2𝑛

slide-19
SLIDE 19

Comparison

Construction Key size Security Efficiency Ref. E ⨂/H LRW 2π‘œ π‘œ/2 1 1 [LRW02] LRW[2] 4π‘œ 2π‘œ/3 2 2 [LST12] LRW[s] 2π‘‘π‘œ π‘‘π‘œ/(𝑑 + 2) 𝑑 𝑑 [LS13] 𝐺 [1] π‘œ 2π‘œ/3 1 1 [Men15] 𝐺 [2] π‘œ π‘œ 2 [Men15] 𝐹1 , β‹― , 𝐹32 π‘œ π‘œ 2 [Lei+16] XHX π‘œ + 𝑛 (π‘œ + 𝑛)/2 1 1 [Jha+ 17] XHX2 2π‘œ + 2𝑛 π‘›π‘—π‘œ(2(π‘œ + 𝑛)/3, π‘œ + 𝑛/2) 2 2 Our work

Cryptology Laboratory @ GSIS, KAIST 19

slide-20
SLIDE 20

Security of the 2-round XTX

ο‚– XTX is a tweak-length extension scheme (Minematsu and Iwata, IMACC 2015) ο‚– Without allowing block cipher queries (π‘ž = 0), we can prove beyond- birthday-bound security for the cascade of two independent XTX constructions.

𝐹1 𝑕1(𝑒) 𝑦 β„Ž1(𝑒) 𝐹2 𝑕2(𝑒) β„Ž2(𝑒) 𝑧

𝐹

𝑕(𝑒) 𝑦 β„Ž(𝑒) 𝑧

slide-21
SLIDE 21

XHX2 from a Practical Viewpoint

ο‚– In the ideal cipher model, each key should define an independent random permutation ο‚– The BBB bound might be useful when the underlying block cipher is relatively small (lightweight) ο‚– Such a small block cipher might be vulnerable to related key attacks (i.e., does not fit the ideal cipher model) ο‚– XHX2 is suitable for a block cipher with the small block size (with a strong key schedule):

  • when π‘œ = 64 and 𝑛 = 128, XHX2 provides 128 bit security
slide-22
SLIDE 22

Transcripts

  • Adversary tries to distinguish two worlds by making oracle queries
  • All the information obtained during the attack is represented by a transcript:

𝜐 = 𝑅𝐷 = 𝑒1, 𝑦1, 𝑧1 , β‹― , π‘’π‘Ÿ, π‘¦π‘Ÿ, π‘§π‘Ÿ , π‘…πΉπ‘˜ = π‘˜, 𝑙1, 𝑣1, 𝑀1 , β‹― , π‘˜, π‘™π‘ž, π‘£π‘ž, π‘€π‘ž , 𝑕1, 𝑕2, β„Ž1, β„Ž1

Cryptology Laboratory @ GSIS, KAIST 22

𝐹1/𝐹2

𝑄

𝐹1/𝐹2

Real world Ideal world Real? or Ideal?

𝐹1

𝑕1(𝑒)

𝑦

β„Ž1(𝑒)

𝐹2

𝑕2(𝑒) β„Ž2(𝑒)

𝑧

slide-23
SLIDE 23

Upper Bounding the Distinguishing Advantage

1) Tid : Probability distribution of Ο„ in the ideal world 2) Tre : Probability distribution of Ο„ in the real world 𝐁𝐞𝐰𝐹

𝒠 ≀

Tid βˆ’ Tre

Transcripts 1 Probability to appear real ideal

Cryptology Laboratory @ GSIS, KAIST 23

slide-24
SLIDE 24

H-Coefficient Lemma

Let Θ = Θgood βŠ” Θbad be a partition of the set of transcripts. Assume that there exist Ο΅1, Ο΅2 > 0 such that Pr Tid ∈ Θbad ≀ Ο΅2, and for any 𝜐 ∈ Θgood, Pr Tre = 𝜐 Pr Tid = 𝜐 β‰₯ 1 βˆ’ Ο΅1. Then one has βˆ₯ Tid βˆ’ Tre βˆ₯ ≀ Ο΅1 + Ο΅2. We can use following lemma to upper bound the statistical distance.

Cryptology Laboratory @ GSIS, KAIST 24

slide-25
SLIDE 25

Security Proof of XHX2 (Sketch)

1) Define bad transcripts 2) Lower bounding the ratio of probabilities of obtaining a good transcript in the real world and in the ideal world

  • Pr Tid = 𝜐 is easy to compute, while Pr Tre = 𝜐 is challenging

3) Apply the H-coefficients Lemma

Cryptology Laboratory @ GSIS, KAIST 25

slide-26
SLIDE 26

Representation of Construction Queries

ο‚– Reduced query: combine keys and construction queries 𝑒, 𝑦, 𝑧 ↦ β„Ž1 𝑒 , β„Ž2 𝑒 , 𝑦⨁𝑕1 𝑒 , 𝑧⨁𝑕2 𝑒 , 𝑕1(𝑒)⨁𝑕2 𝑒 ο‚– Black dots represent values fixed by block cipher queries, while white dots are β€œfree”

Cryptology Laboratory @ GSIS, KAIST 26

𝐹1 𝑕1(𝑒) 𝑦 β„Ž1(𝑒) 𝐹2 𝑕2(𝑒) β„Ž2(𝑒) 𝑧

slide-27
SLIDE 27

≀ π‘Ÿ2 2π‘œ+2𝑛

Bad Transcripts

ο‚– Avoid revealing any colliding internal path ο‚– Upper bound the number of colliding pairs ο‚– Avoid a multi-collision with a large multiplicity

Cryptology Laboratory @ GSIS, KAIST 27

≀ 𝑂/4

slide-28
SLIDE 28

Analyzing Good Transcripts

ο‚– Classify good queries into 5 classes ο‚– Estimate the probability of completing the queries in each class ο‚– In this way, we can lower bound Pr Tre = 𝜐

Cryptology Laboratory @ GSIS, KAIST 28

slide-29
SLIDE 29

Conclusion

ο‚– XHX2 is a TBC that is based on an 𝑛-bit key π‘œ-bit block cipher providing π‘›π‘—π‘œ(

2(π‘œ+𝑛) 3

, π‘œ +

𝑛 2) bit security in the ideal cipher model

As open problems; ο‚– Can we improve our security bound using an alternative approach (e.g., the expectation method)? ο‚– What is the security of the 3-round XHX?

Cryptology Laboratory @ GSIS, KAIST 29

slide-30
SLIDE 30

Thank You Q&A