Forking a Blockcipher for Authenticated Encryption of Very Short Messages Damian Vizár (CSEM, Switzerland) ASK 2018, Kolkata Joint work with: Elena Andreeva (KU Leuven, Belgium) Reza Reyhanitabar (Elektrobit, Germany) Kerem Varici (KU Leuven, Belgium)
78
Embed
Forking a Blockcipher for Authenticated Encryption of Very ...ask2018/slides/damian-vizar.pdf · •Constrained channels [NB-IoT] o 16 bits
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Forking a Blockcipher for Authenticated Encryption of Very Short Messages
Damian Vizár (CSEM, Switzerland)
ASK 2018, Kolkata
Joint work with:
Elena Andreeva (KU Leuven, Belgium)
Reza Reyhanitabar (Elektrobit, Germany)
Kerem Varici (KU Leuven, Belgium)
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption
1
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption
• Confidentiality and Integrity
1
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption
• Confidentiality and Integrity
1
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption
• Confidentiality and Integrity
1
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
• BUT issues with performance, robustness, patent burden …
1
…
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption: is it solved?
CAESAR competition:
• Boost research, find new AEAD schemes
o 57 submissions
o 3 5 years of activity
2
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption: is it solved?
CAESAR competition:
• Boost research, find new AEAD schemes
o 57 submissions
o 3 5 years of activity
• A LOT of results
o Primitives, constructions, security notions
2
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption: is it solved?
CAESAR competition:
• Boost research, find new AEAD schemes
o 57 submissions
o 3 5 years of activity
• A LOT of results
o Primitives, constructions, security notions
• AE schemes for different use cases
o High speed Robustness Lightweight
2
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption: is it solved?
CAESAR competition:
• Boost research, find new AEAD schemes
o 57 submissions
o 3 5 years of activity
• A LOT of results
o Primitives, constructions, security notions
• AE schemes for different use cases
o High speed Robustness Lightweight
• 7 schemes in final portfolio
2
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Authenticated Encryption: is it solved?
CAESAR competition:
• Boost research, find new AEAD schemes
o 57 submissions
o 3 5 years of activity
• A LOT of results
o Primitives, constructions, security notions
• AE schemes for different use cases
o High speed Robustness Lightweight
• 7 schemes in final portfolio
2
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
New Challenges
• “IoT” devices
3
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
New Challenges
• “IoT” devices
• Distinct constraints
o Latency, throughput, power, code size/area, …
3
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
New Challenges
• “IoT” devices
• Distinct constraints
o Latency, throughput, power, code size/area, …
3
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
New Challenges
• “IoT” devices
• Distinct constraints
o Latency, throughput, power, code size/area, …
3
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
New Challenges
• “IoT” devices
• Distinct constraints
o Latency, throughput, power, code size/area, …
3
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
New Challenges
• “IoT” devices
• Distinct constraints
o Latency, throughput, power, code size/area, …
3
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
New Challenges
• “IoT” devices
• Distinct constraints
o Latency, throughput, power, code size/area, …
• New communication patterns
o Dominated by (very) short messages
3
M
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
(Very) Short Messages: Possibly <= 1 AES Block
• Short data burst [5G spec]
o “Small status updates (few bits)”
IoT Setting
4
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
(Very) Short Messages: Possibly <= 1 AES Block
• Short data burst [5G spec]
o “Small status updates (few bits)”
• Low-latency processing short messages [SecOC (automotive)]
o Payload <= 64 bytes [CAN FD standard (ISO 11898-1)]
IoT Setting
4
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
(Very) Short Messages: Possibly <= 1 AES Block
• Short data burst [5G spec]
o “Small status updates (few bits)”
• Low-latency processing short messages [SecOC (automotive)]
o Payload <= 64 bytes [CAN FD standard (ISO 11898-1)]
• Constrained channels [NB-IoT]
o 16 bits <= transport block size <= 680 bits/1000bits
IoT Setting
4
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
(Very) Short Messages: Possibly <= 1 AES Block
• Short data burst [5G spec]
o “Small status updates (few bits)”
• Low-latency processing short messages [SecOC (automotive)]
o Payload <= 64 bytes [CAN FD standard (ISO 11898-1)]
• Constrained channels [NB-IoT]
o 16 bits <= transport block size <= 680 bits/1000bits
• NIST’s call for lightweight crypto
o “Be efficient for short messages (e.g., as short as 8 bytes)”
IoT Setting
4
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
(Very) Short Messages: Possibly <= 1 AES Block
• Short data burst [5G spec]
o “Small status updates (few bits)”
• Low-latency processing short messages [SecOC (automotive)]
o Payload <= 64 bytes [CAN FD standard (ISO 11898-1)]
• Constrained channels [NB-IoT]
o 16 bits <= transport block size <= 680 bits/1000bits
• NIST’s call for lightweight crypto
o “Be efficient for short messages (e.g., as short as 8 bytes)”
IoT Setting
4
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
GHASH: a + m + 1 GF(2128) mul.
&
CTR mode: m + 1 AES calls
extra AES and m+1 mul. for tag
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
CBC MAC: a + m +1 AES calls
&
CTR: m + 1 AES calls
extra AES for tag, m+1 extra calls for MAC
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
AD-HASH: a AES calls
&
OCB core: m + 2 AES calls
2x extra AES for tag and for derived key
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
IV + CFB: a + m AES calls
&
Tag: m + 1 AES calls
m+1 extra AES calls for tag
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
AD-HASH: a Deoxys calls (1.4 AES)
&
OCB core: m + 1 Deoxys calls (1.4 AES)
1.4 extra AES for tag
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
AD-HASH: a KIASU calls (~ AES)
&
OCB core: m + 1 KIASU calls (~AES)
extra AES for tag
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Existing AES-based AE vs Very Short Messages
5
a,m: length of A and M in 128-bit blocks; per-session key derivation excluded
“The performance target is wrong · · · an authenticated cipher is applied to many small messages · · · The challenge here is to minimize overhead.” [ECRYPT-CSA 2017]
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Nonce-based Authenticated Encryption with Associated Data
6
• Enc,Dec: deterministic algorithms
• N: Nonce, must not repeat
• A: Associated Data, authenticated, but not encrypted
• M: Plaintext, encrypted and authenticated
• K: Secret key
Also |C| = |M| + τ and Dec(K,N,A,Enc(K,N,A,M)) = M
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Nonce-based Authenticated Encryption with Associated Data
6
• Enc,Dec: deterministic algorithms
• N: Nonce, must not repeat
• A: Associated Data, authenticated, but not encrypted
• M: Plaintext, encrypted and authenticated
• K: Secret key
Also |C| = |M| + τ and Dec(K,N,A,Enc(K,N,A,M)) = M
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Nonce-based Authenticated Encryption with Associated Data
6
• Enc,Dec: deterministic algorithms
• N: Nonce, must not repeat
• A: Associated Data, authenticated, but not encrypted
• M: Plaintext, encrypted and authenticated
• K: Secret key
Also |C| = |M| + τ and Dec(K,N,A,Enc(K,N,A,M)) = M
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Nonce-based Authenticated Encryption with Associated Data
6
• Enc,Dec: deterministic algorithms
• N: Nonce, must not repeat
• A: Associated Data, authenticated, but not encrypted
• M: Plaintext, encrypted and authenticated
• K: Secret key
Also |C| = |M| + τ and Dec(K,N,A,Enc(K,N,A,M)) = M
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
The Notional Gap
7
Available primitives:
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
The Notional Gap
7
secret randompermutation
public randompermutation
random function (compressing)
Available primitives:
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
The Notional Gap
• No integrity or non-trivial redundancy
7
secret randompermutation
public randompermutation
random function (compressing)
Available primitives:
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
The Notional Gap
• No integrity or non-trivial redundancy
• For AE: at least 1 extra call for integrity
o Amortized in long queries
o 100% overhead for short queries!
7
secret randompermutation
public randompermutation
random function (compressing)
Available primitives:
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
The Notional Gap
• No integrity or non-trivial redundancy
• For AE: at least 1 extra call for integrity
o Amortized in long queries
o 100% overhead for short queries!
7
secret randompermutation
public randompermutation
random function (compressing)
Available primitives:
Solution:
Invent a new primitive
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher
9
• Keyed
• Expanding
• Tweakable
• Invertible
• Parallel permutations
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher: Syntax
10
• Forward: n-bit block 2 n-bit blocks
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher: Syntax
10
• Forward: n-bit block 2 n-bit blocks
• Inverse: n-bit block, binary flag n-bit block
o Can invert either output block
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher: Syntax
10
• Forward: n-bit block 2 n-bit blocks
• Inverse: n-bit block, binary flag n-bit block
o Can invert either output block
• Reconstruction: n-bit block, binary flag n-bit block
o Can reconstruct either ouput block from the other output block
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher: Security
11
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher: Security
• Almost AE security (natural PRI construction)
11
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher: Security
• Almost AE security (natural PRI construction)
• “Two TBCs? What’s so novel about that?”
11
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher Instantiation: Iterate-Fork-Iterate
• IFI: Round Function + Tweakey Schedule + #rounds/3
12
Copyright 2018 CSEM | Forking a Blockcipher for AE of Very Short Messages | D. Vizár | Page
Forkcipher Instantiation: Iterate-Fork-Iterate
• IFI: Round Function + Tweakey Schedule + #rounds/3