WAGE: An Authenticated Encryption with a Twist Riham AlTawy ⋆ , Guang Gong, Kalikinkar Mandal 1 , and Raghvendra Rohit 2 ⋆ IACR FSE 2020 1 Currently with University of New Brunswick, Canada 2 Currently with University of Rennes 1, CNRS, IRISA, France
Outline 1. Introduction 2. Design of WAGE 3. Security Analysis and Features 4. Hardware Performance 1 / 20
Developments in symmetric key cryptography MD5 SHA-2 Photon RIPEMD Grain Quark SHA-1 Trivium Spongent AES Mickey Simon MARS Salsa Simeck RC6 WG Ascon Serpent Present Skinny Lucifier CAST Keccak GIFT RC4 DES . . . . . . . . . 1970 1980 1990 2000 2010 2019 2 / 20
Developments in symmetric key cryptography MD5 SHA-2 Photon RIPEMD Grain Quark SHA-1 Trivium Spongent AES Mickey Simon MARS Salsa Simeck RC6 WG Ascon Serpent Present Skinny Lucifier CAST Keccak GIFT RC4 DES . . . . . . . . . 1970 1980 1990 2000 2010 2019 Smart devices RFIDs and NFC Internet of Things Resource constrained devices Sensor networks Embedded systems 2 / 20
Developments in symmetric key cryptography MD5 SHA-2 Photon RIPEMD Grain Quark SHA-1 Trivium Spongent AES Mickey Simon MARS Salsa Simeck RC6 WG Ascon Serpent Present Skinny Lucifier CAST Keccak GIFT RC4 DES . . . . . . . . . 1970 1980 1990 2000 2010 2019 Smart devices RFIDs and NFC Internet of Things Resource constrained devices Some algorithms and current standards do not fit into these devices! Sensor networks Embedded systems 2 / 20
Developments in symmetric key cryptography MD5 SHA-2 Photon RIPEMD Grain Quark SHA-1 Trivium Spongent AES Mickey Simon MARS Salsa Simeck RC6 WG Ascon Serpent Present Skinny NIST LWC Lucifier CAST Keccak GIFT RC4 Submission DES . . . . . . call . . . 1970 1980 1990 2000 2010 2019 Smart devices 56 round 1 candidates RFIDs and NFC 32 round 2 candidates Internet of Things Different designs and goals Resource constrained devices Some algorithms and current standards do not fit into these devices! Sensor networks Embedded systems 2 / 20
Developments in symmetric key cryptography MD5 SHA-2 Photon RIPEMD Grain Quark SHA-1 Trivium Spongent AES Mickey Simon MARS Salsa Simeck RC6 WG Ascon Serpent Present Skinny NIST LWC Lucifier CAST Keccak GIFT RC4 Submission DES . . . . . . call . . . 1970 1980 1990 2000 2010 2019 Smart devices 56 round 1 candidates RFIDs and NFC 32 round 2 candidates Internet of Things Different designs and goals Resource constrained devices Some algorithms and current standards do not fit into these devices! Sensor networks Embedded systems 2 / 20
Developments in symmetric key cryptography MD5 SHA-2 Photon RIPEMD Grain Quark SHA-1 Trivium Spongent AES Mickey Simon MARS Salsa Simeck RC6 WG Ascon Serpent Present Skinny NIST LWC Lucifier CAST Keccak GIFT RC4 Submission DES . . . . . . call . . . 1970 1980 1990 2000 2010 2019 Smart devices 56 round 1 candidates RFIDs and NFC 32 round 2 candidates Internet of Things Different designs and goals WAGE Resource constrained devices Some algorithms and current standards do not fit into these devices! Sensor networks Embedded systems 2 / 20
Our Contributions - Permutation design: We design a hardware-friendly permutation of size 259 bits based on a 37-stage Galois NLFSR over F 2 7 . 3 / 20
Our Contributions - Permutation design: We design a hardware-friendly permutation of size 259 bits based on a 37-stage Galois NLFSR over F 2 7 . - Security analysis: We analyze the diffusion, algebraic, differential, and linear properties of the WAGE permutation and the WAGE authenticated encryption. 3 / 20
Our Contributions - Permutation design: We design a hardware-friendly permutation of size 259 bits based on a 37-stage Galois NLFSR over F 2 7 . - Security analysis: We analyze the diffusion, algebraic, differential, and linear properties of the WAGE permutation and the WAGE authenticated encryption. - WG-PRBG: We present the construction of WG based pseudo random bit generator with guaranteed randomness properties from WAGE. 3 / 20
Design of WAGE 4 / 20
WAGE Permutation Round Function rc i 1 S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 WGP SB SB rc i ⊕ 0 ω S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i S i 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 WGP SB SB - S j i is a 7-bit word, WGP and SB are 7-bit S-boxes, ω is a linear operation over 7-bit word, and rc i j are 7-bit round constants. 5 / 20
Rationale of the overall design - Reuse and adopt the initialization phase of the well-studied WG stream cipher for authenticated encryption 6 / 20
Rationale of the overall design - Reuse and adopt the initialization phase of the well-studied WG stream cipher for authenticated encryption - Cheap hardware cost for WGP over F 2 7 than F 2 8 - 1 WGP S-box to 5 additional S-boxes (1 WGP + 4 SB) for faster confusion - Extra XORs for strong diffusion in addition to feedback 6 / 20
Rationale of the overall design - Reuse and adopt the initialization phase of the well-studied WG stream cipher for authenticated encryption - Cheap hardware cost for WGP over F 2 7 than F 2 8 - 1 WGP S-box to 5 additional S-boxes (1 WGP + 4 SB) for faster confusion - Extra XORs for strong diffusion in addition to feedback - Minimal overhead for tweaking the WAGE permutation to an independent WG-PRBG 6 / 20
S-boxes - WGP S-Box : Defined over F 2 7 : WGP ( x ) = WGP 7( x 13 ) WGP 7( x ) = x + ( x + 1) 33 + ( x + 1) 39 + ( x + 1) 41 + ( x + 1) 104 d = 13 chosen to achieve low differential uniformity and high nonlinearity 7 / 20
S-boxes - WGP S-Box : Defined over F 2 7 : WGP ( x ) = WGP 7( x 13 ) WGP 7( x ) = x + ( x + 1) 33 + ( x + 1) 39 + ( x + 1) 41 + ( x + 1) 104 d = 13 chosen to achieve low differential uniformity and high nonlinearity - SB S-Box : Defined in a bit-wise and iterative fashion: ( x 0 , x 1 , x 2 , x 3 , x 4 , x 5 , x 6 ) ← R 5 ( x 0 , x 1 , x 2 , x 3 , x 4 , x 5 , x 6 ) ( x 0 , x 1 , x 2 , x 3 , x 4 , x 5 , x 6 ) ← Q ( x 0 , x 1 , x 2 , x 3 , x 4 , x 5 , x 6 ) x 0 ← x 0 ⊕ 1 x 2 ← x 2 ⊕ 1 7 / 20
S-boxes (cont.) x 0 x 1 x 2 x 3 x 4 x 5 x 6 ⊙ ⊙ ⊙ Q layer ⊕ ⊕ ⊕ ▽ ▽ ◦ ◦ P layer y 0 y 1 y 2 y 3 y 4 y 5 y 6 A block diagram of R 8 / 20
Round constants - Lightweight 7-bit LFSR for generating the constants a i +8 a i +6 a i +4 a i +2 a i a i +7 a i +5 a i +3 a i +1 rc i 1 � �� � a i +7 , a i +6 , a i +5 , a i +4 , a i +3 , a i +2 , a i +1 , a i � �� � rc i 0 9 / 20
Round constants - Lightweight 7-bit LFSR for generating the constants a i +8 a i +6 a i +4 a i +2 a i a i +7 a i +5 a i +3 a i +1 rc i 1 � �� � a i +7 , a i +6 , a i +5 , a i +4 , a i +3 , a i +2 , a i +1 , a i � �� � rc i 0 1 ) � = ( rc j 0 , rc j - Property: ( rc i 0 , rc i 1 ) for 0 ≤ i, j ≤ 110 and i � = j . Ensures that all the rounds of WAGE are distinct and provides resistance against slide and invariant subspace attacks. 9 / 20
Number of rounds - Number of rounds: 111 - Selection based on the security analysis: diffusion, algebraic degree, differential and linear bounds - Overall criterion: WAGE permutation is indistinguishable from a random permutation 10 / 20
Diffusion and algebraic degree behavior - Diffusion: Full bit diffusion in 28+28 rounds in both forward and backward directions. 56/111 rounds are sufficient against meet-in the-middle attacks. - Algebraic degree: WGP and SB sboxes each are of degree 6. Faster growth in algebraic degree and 111 rounds provides huge security margin against algebraic attacks. 11 / 20
Differential and linear bounds - WGP S-box: DP = 2 − 4 . 4 and LSC = 2 − 5 . 08 - SB S-box: DP = 2 − 4 and LSC = 2 − 5 . 35 12 / 20
Differential and linear bounds - WGP S-box: DP = 2 − 4 . 4 and LSC = 2 − 5 . 08 - SB S-box: DP = 2 − 4 and LSC = 2 − 5 . 35 - Case I: No constraints on the positions of input and output differences - Case II: Input and output differences are restricted to only rate positions Table: Upper bounds of MEDCP and MELCSC values of WAGE in log 2 ( · ) scale Rounds Minimum MEDCP MELSC # active sboxes log 2 ( · ) Case I 74 59 − 59 × 4 = − 236 − 59 × 5 . 08 ≈ − 299 . 7 Case II 74 72 − 72 × 4 = − 288 − 72 × 5 . 08 ≈ − 365 . 7 12 / 20
WAGE Authenticated Encryption and WG-PRBG 13 / 20
WAGE Authenticated Encryption - Supports 128-bit key, 128-bit nonce and 128-bit tag - Operates in sponge-duplex mode with stronger keyed initialization and finalization phases 14 / 20
WAGE Authenticated Encryption - Supports 128-bit key, 128-bit nonce and 128-bit tag - Operates in sponge-duplex mode with stronger keyed initialization and finalization phases K 0 K 1 64 load ( N, K ) P P P 195 0x00 0x00 Initialization 14 / 20
WAGE Authenticated Encryption - Supports 128-bit key, 128-bit nonce and 128-bit tag - Operates in sponge-duplex mode with stronger keyed initialization and finalization phases K 0 K 1 AD 0 AD a − 1 64 load ( N, K ) P P P P P 195 0x00 0x00 0x01 0x01 Initialization Processing associated data 14 / 20
Recommend
More recommend
