WAGE: An Authenticated Encryption with a Twist Riham AlTawy , Guang - - PowerPoint PPT Presentation

▶
wage an authenticated encryption with a twist
SMART_READER_LITE
LIVE PREVIEW

WAGE: An Authenticated Encryption with a Twist Riham AlTawy , Guang - - PowerPoint PPT Presentation

May 26, 2023 363 likes •750 views

WAGE: An Authenticated Encryption with a Twist Riham AlTawy , Guang Gong, Kalikinkar Mandal 1 , and Raghvendra Rohit 2 IACR FSE 2020 1 Currently with University of New Brunswick, Canada 2 Currently with University of Rennes 1, CNRS,

slide-1
SLIDE 1

WAGE: An Authenticated Encryption with a Twist

Riham AlTawy⋆, Guang Gong, Kalikinkar Mandal1, and Raghvendra Rohit2 ⋆

IACR FSE 2020

1 Currently with University of New Brunswick, Canada 2 Currently with University of Rennes 1, CNRS, IRISA, France

slide-2
SLIDE 2

Outline

  • 1. Introduction
  • 2. Design of WAGE
  • 3. Security Analysis and Features
  • 4. Hardware Performance

1 / 20

slide-3
SLIDE 3

Developments in symmetric key cryptography

1970 1980 1990 2000 Lucifier DES MD5 RIPEMD SHA-1 AES MARS RC6 Serpent CAST . . . RC4 2010 2019 SHA-2 Grain Trivium Mickey Salsa WG Present Keccak . . . Photon Quark Spongent Simon Simeck Ascon Skinny GIFT . . .

2 / 20

slide-4
SLIDE 4

Developments in symmetric key cryptography

1970 1980 1990 2000 Lucifier DES MD5 RIPEMD SHA-1 AES MARS RC6 Serpent CAST . . . RC4 2010 2019 SHA-2 Grain Trivium Mickey Salsa WG Present Keccak . . . Photon Quark Spongent Simon Simeck Ascon Skinny GIFT . . . Resource constrained devices Smart devices Internet of Things RFIDs and NFC Embedded systems Sensor networks

2 / 20

slide-5
SLIDE 5

Developments in symmetric key cryptography

1970 1980 1990 2000 Lucifier DES MD5 RIPEMD SHA-1 AES MARS RC6 Serpent CAST . . . RC4 2010 2019 SHA-2 Grain Trivium Mickey Salsa WG Present Keccak . . . Photon Quark Spongent Simon Simeck Ascon Skinny GIFT . . . Resource constrained devices Smart devices Internet of Things RFIDs and NFC Embedded systems Sensor networks Some algorithms and current standards do not fit into these devices!

2 / 20

slide-6
SLIDE 6

Developments in symmetric key cryptography

1970 1980 1990 2000 Lucifier DES MD5 RIPEMD SHA-1 AES MARS RC6 Serpent CAST . . . RC4 2010 2019 SHA-2 Grain Trivium Mickey Salsa WG Present Keccak . . . Photon Quark Spongent Simon Simeck Ascon Skinny GIFT . . . Resource constrained devices Smart devices Internet of Things RFIDs and NFC Embedded systems Sensor networks Some algorithms and current standards do not fit into these devices! NIST LWC Submission call 56 round 1 candidates 32 round 2 candidates Different designs and goals

2 / 20

slide-7
SLIDE 7

Developments in symmetric key cryptography

1970 1980 1990 2000 Lucifier DES MD5 RIPEMD SHA-1 AES MARS RC6 Serpent CAST . . . RC4 2010 2019 SHA-2 Grain Trivium Mickey Salsa WG Present Keccak . . . Photon Quark Spongent Simon Simeck Ascon Skinny GIFT . . . Resource constrained devices Smart devices Internet of Things RFIDs and NFC Embedded systems Sensor networks Some algorithms and current standards do not fit into these devices! NIST LWC Submission call 56 round 1 candidates 32 round 2 candidates Different designs and goals

2 / 20

slide-8
SLIDE 8

Developments in symmetric key cryptography

1970 1980 1990 2000 Lucifier DES MD5 RIPEMD SHA-1 AES MARS RC6 Serpent CAST . . . RC4 2010 2019 SHA-2 Grain Trivium Mickey Salsa WG Present Keccak . . . Photon Quark Spongent Simon Simeck Ascon Skinny GIFT . . . Resource constrained devices Smart devices Internet of Things RFIDs and NFC Embedded systems Sensor networks Some algorithms and current standards do not fit into these devices! NIST LWC Submission call 56 round 1 candidates 32 round 2 candidates Different designs and goals

WAGE

2 / 20

slide-9
SLIDE 9

Our Contributions

  • Permutation design: We design a hardware-friendly permutation
  • f size 259 bits based on a 37-stage Galois NLFSR over F27.

3 / 20

slide-10
SLIDE 10

Our Contributions

  • Permutation design: We design a hardware-friendly permutation
  • f size 259 bits based on a 37-stage Galois NLFSR over F27.
  • Security analysis: We analyze the diffusion, algebraic,

differential, and linear properties of the WAGE permutation and the WAGE authenticated encryption.

3 / 20

slide-11
SLIDE 11

Our Contributions

  • Permutation design: We design a hardware-friendly permutation
  • f size 259 bits based on a 37-stage Galois NLFSR over F27.
  • Security analysis: We analyze the diffusion, algebraic,

differential, and linear properties of the WAGE permutation and the WAGE authenticated encryption.

  • WG-PRBG: We present the construction of WG based pseudo

random bit generator with guaranteed randomness properties from WAGE.

3 / 20

slide-12
SLIDE 12

Design of WAGE

4 / 20

slide-13
SLIDE 13

WAGE Permutation Round Function

Si

36

Si

35

Si

34

Si

33

Si

32

Si

31

Si

30

Si

29

Si

28

Si

27

Si

26

Si

25

Si

24

Si

23

Si

22

Si

21

Si

20

Si

19

WGP SB SB Si

17

Si

18

Si

16

Si

15

Si

14

Si

13

Si

12

Si

11

Si

10

Si

9

Si

8

Si

7

Si

6

Si

5

Si

4

Si

3

Si

2

Si

1

Si WGP SB SB ⊕ ω rci

1

rci

  • Sj

i is a 7-bit word, WGP and SB are 7-bit S-boxes, ω is a linear

  • peration over 7-bit word, and rci

j are 7-bit round constants.

5 / 20

slide-14
SLIDE 14

Rationale of the overall design

  • Reuse and adopt the initialization phase of the well-studied WG

stream cipher for authenticated encryption

6 / 20

slide-15
SLIDE 15

Rationale of the overall design

  • Reuse and adopt the initialization phase of the well-studied WG

stream cipher for authenticated encryption

  • Cheap hardware cost for WGP over F27 than F28
  • 1 WGP S-box to 5 additional S-boxes (1 WGP + 4 SB) for faster

confusion

  • Extra XORs for strong diffusion in addition to feedback

6 / 20

slide-16
SLIDE 16

Rationale of the overall design

  • Reuse and adopt the initialization phase of the well-studied WG

stream cipher for authenticated encryption

  • Cheap hardware cost for WGP over F27 than F28
  • 1 WGP S-box to 5 additional S-boxes (1 WGP + 4 SB) for faster

confusion

  • Extra XORs for strong diffusion in addition to feedback
  • Minimal overhead for tweaking the WAGE permutation to an

independent WG-PRBG

6 / 20

slide-17
SLIDE 17

S-boxes

  • WGP S-Box: Defined over F27:

WGP(x) = WGP7(x13) WGP7(x) = x + (x + 1)33 + (x + 1)39 + (x + 1)41 + (x + 1)104 d = 13 chosen to achieve low differential uniformity and high nonlinearity

7 / 20

slide-18
SLIDE 18

S-boxes

  • WGP S-Box: Defined over F27:

WGP(x) = WGP7(x13) WGP7(x) = x + (x + 1)33 + (x + 1)39 + (x + 1)41 + (x + 1)104 d = 13 chosen to achieve low differential uniformity and high nonlinearity

  • SB S-Box: Defined in a bit-wise and iterative fashion:

(x0, x1, x2, x3, x4, x5, x6) ← R5(x0, x1, x2, x3, x4, x5, x6) (x0, x1, x2, x3, x4, x5, x6) ← Q(x0, x1, x2, x3, x4, x5, x6) x0 ← x0 ⊕ 1 x2 ← x2 ⊕ 1

7 / 20

slide-19
SLIDE 19

S-boxes (cont.)

⊙ ⊙ ⊙ ⊕ ⊕ ⊕ ▽

  • ▽
  • x0

x1 x2 x3 x4 x5 x6 y0 y1 y2 y3 y4 y5 y6 A block diagram of R Q layer P layer

8 / 20

slide-20
SLIDE 20

Round constants

  • Lightweight 7-bit LFSR for generating the constants

ai+6 ai+4 ai+2 ai ai+5 ai+3 ai+1 ai+8 ai+7

rci

1

  • ai+7, ai+6, ai+5, ai+4, ai+3, ai+2, ai+1, ai
  • rci

9 / 20

slide-21
SLIDE 21

Round constants

  • Lightweight 7-bit LFSR for generating the constants

ai+6 ai+4 ai+2 ai ai+5 ai+3 ai+1 ai+8 ai+7

rci

1

  • ai+7, ai+6, ai+5, ai+4, ai+3, ai+2, ai+1, ai
  • rci
  • Property: (rci

0, rci 1) = (rcj 0, rcj 1) for 0 ≤ i, j ≤ 110 and i = j.

Ensures that all the rounds of WAGE are distinct and provides resistance against slide and invariant subspace attacks.

9 / 20

slide-22
SLIDE 22

Number of rounds

  • Number of rounds: 111
  • Selection based on the security analysis: diffusion, algebraic degree,

differential and linear bounds

  • Overall criterion: WAGE permutation is indistinguishable from a

random permutation

10 / 20

slide-23
SLIDE 23

Diffusion and algebraic degree behavior

  • Diffusion: Full bit diffusion in 28+28 rounds in both forward and

backward directions. 56/111 rounds are sufficient against meet-in the-middle attacks.

  • Algebraic degree: WGP and SB sboxes each are of degree 6. Faster

growth in algebraic degree and 111 rounds provides huge security margin against algebraic attacks.

11 / 20

slide-24
SLIDE 24

Differential and linear bounds

  • WGP S-box: DP = 2−4.4 and LSC = 2−5.08
  • SB S-box: DP = 2−4 and LSC = 2−5.35

12 / 20

slide-25
SLIDE 25

Differential and linear bounds

  • WGP S-box: DP = 2−4.4 and LSC = 2−5.08
  • SB S-box: DP = 2−4 and LSC = 2−5.35
  • Case I: No constraints on the positions of input and output

differences

  • Case II: Input and output differences are restricted to only rate

positions

Table: Upper bounds of MEDCP and MELCSC values of WAGE in log2(·) scale Rounds Minimum MEDCP MELSC # active sboxes log2(·) Case I 74 59 −59 × 4 = −236 −59 × 5.08 ≈ −299.7 Case II 74 72 −72 × 4 = −288 −72 × 5.08 ≈ −365.7

12 / 20

slide-26
SLIDE 26

WAGE Authenticated Encryption and WG-PRBG

13 / 20

slide-27
SLIDE 27

WAGE Authenticated Encryption

  • Supports 128-bit key, 128-bit nonce and 128-bit tag
  • Operates in sponge-duplex mode with stronger keyed initialization

and finalization phases

14 / 20

slide-28
SLIDE 28

WAGE Authenticated Encryption

  • Supports 128-bit key, 128-bit nonce and 128-bit tag
  • Operates in sponge-duplex mode with stronger keyed initialization

and finalization phases

P P P

load(N, K)

195 64 0x00 0x00 K0 K1 Initialization 14 / 20

slide-29
SLIDE 29

WAGE Authenticated Encryption

  • Supports 128-bit key, 128-bit nonce and 128-bit tag
  • Operates in sponge-duplex mode with stronger keyed initialization

and finalization phases

P P P

load(N, K)

195 64 0x00 0x00 K0 K1 Initialization P P Processing associated data AD0 ADa−1 0x01 0x01 14 / 20

slide-30
SLIDE 30

WAGE Authenticated Encryption

  • Supports 128-bit key, 128-bit nonce and 128-bit tag
  • Operates in sponge-duplex mode with stronger keyed initialization

and finalization phases

P P P

load(N, K)

195 64 0x00 0x00 K0 K1 Initialization P P Processing associated data AD0 ADa−1 0x01 0x01 P P P M0 Mm−2 Mm−1 C0 Cm−2 Cm−1 Encryption X Y X Y 0x02 0x02 0x02 14 / 20

slide-31
SLIDE 31

WAGE Authenticated Encryption

  • Supports 128-bit key, 128-bit nonce and 128-bit tag
  • Operates in sponge-duplex mode with stronger keyed initialization

and finalization phases

P P P

load(N, K)

195 64 0x00 0x00 K0 K1 Initialization P P Processing associated data AD0 ADa−1 0x01 0x01 P P P M0 Mm−2 Mm−1 C0 Cm−2 Cm−1 Encryption X Y X Y 0x02 0x02 0x02 P P tagextract(·) 128 Tag generation K0 K1 0x00 0x00 14 / 20

slide-32
SLIDE 32

Security claims

Confidentiality, Integrity and Authenticity in nonce-respecting setting: 128 bits Data limit per key: 264 bits Strong security guarantees in related-key setting because of absorbing key blocks via rate

15 / 20

slide-33
SLIDE 33

Sponge-PRBG and WG-PRBG

  • Sponge-PRBG: Start with an intial seed and output 64 bits after

each call of WAGE permutation. Number of rounds to generate 64 bits is 111.

  • WG-PRBG: Null some components of WAGE round function

(construction in next slide) and use WG stream cipher over F27 to generate random bits. Number of rounds in initialization phase is

  • 74. Then, each output bit is generated in 1 clock cycle.

16 / 20

slide-34
SLIDE 34

Sponge-PRBG and WG-PRBG

  • Sponge-PRBG: Start with an intial seed and output 64 bits after

each call of WAGE permutation. Number of rounds to generate 64 bits is 111.

  • WG-PRBG: Null some components of WAGE round function

(construction in next slide) and use WG stream cipher over F27 to generate random bits. Number of rounds in initialization phase is

  • 74. Then, each output bit is generated in 1 clock cycle.

Advantages:

  • Low power and energy consumption
  • Low latency
  • Efficient source for generating random nonces for authenticated

encryption

16 / 20

slide-35
SLIDE 35

WG-PRBG from WAGE round function

WAGE internal state WAGE internal state Feedback polynomial Feedback polynomial

WGP WGP SB SB WGP SB SB Tr

bitstream

17 / 20

slide-36
SLIDE 36

Hardware Performance

  • Comparison of the different ASIC implementation results of WAGE

with other NIST LWC round 2 candidates. Tput, A, F, and E denote throughput, area, maximum frequency, and energy, respectively.

ST Micro 65 nm ST Micro 90 nm IBM 130 nm Algorithm‡‡ A F Tput E A F Tput E A F Tput E [GE] [MHz] [Mbit/s] [nJ] [GE] [MHz] [Mbit/s] [nJ] [GE] [MHz] [Mbit/s] [nJ] WAGE⋄ 2900 907 517 20.0 2540 940 535 39.2 2960 153 87.21 30.4 SKINNY-AEAD

  • 7179

422 53

  • 7456

267 34

  • ASCON
  • 2570

672 14 5,706 µJ/B

  • GIFT-COFB
  • 3927

10 22.3 † 2.69 †

  • Grain-128AEAD

3638.5 1120 560

  • Isap-A-128a
  • ≤12780

≥169 2.9 bpc

  • SPIX‡

2611 100 kHz 81.8 Kbps

  • 2742 100 kHz 81.8 Kbps
  • SpoC-64‡

2329 100 kHz 58.3 Kbps

  • 2389 100 kHz 58.3 Kbps
  • SUNDAE-GIFT
  • 3494

10 15.9 †† 4.2 †

  • TinyJAMBU-128
  • 1352⋆
  • 24.6
  • ‡‡ Implementations numbers from round 2 submissions.

⋄ Entire cipher including encryption, decryption and control logic † For 16 B and 32 B of associated data and plaintext, respectively ‡ Encryption circuit only. †† #cycles = 242, ⋆ only 112 bit security

  • Fair comparison is hard at this stage.

18 / 20

slide-37
SLIDE 37

Conclusions

  • We have proposed WAGE, a sponge-based authenticated encryption

algorithm, tailored for resource-constrained environments.

  • Simple underlying permutation based on Galois NLFSR, two sboxes:

WGP and SB, a primitive feedback polynomial, and partial word-wise XORs.

  • Offers good security guarantees and hardware efficiency.
  • Easily tweakable to WG-PRBG.

19 / 20

slide-38
SLIDE 38

Thank you!

Full paper available at: https://tosc.iacr.org/index.php/ToSC/article/view/8620 https://eprint.iacr.org/2020/435 For any questions, comments or suggestions, please email us. Special thanks to TikZ for Cryptographers for the diagrams.

20 / 20