140 research outputs found
Characterizing Padding Rules of MD Hash Functions Preserving Collision Security
This paper characterizes collision preserving padding rules and provides variants of \MD (MD) which are having less or no overhead costs due to length. We first show that suffix-free property of padding rule is necessary as well as sufficient to preserve the collision security of MD hash function for an arbitrary domain \s^*. Knowing this, we propose a simple suffix-free padding rule padding only bits for a message , which is less than that of Damg\aa rd\u27s and Sarkar\u27s padding rules. We also prove that the length-padding is not absolutely necessary. We show that a simple variant of MD with -padding (or any injective padding) is collision resistant provided that the underlying compression function is collision resistant after chopping the last-bit. Finally, we design another variant of MD hash function preserving all three basic security notions of hash functions, namely collision and (2nd) preimage. This is an improvement over a recently designed (SAC-08) three-property preserving hash function in terms of both salt size and efficiency
On the Optimality of Non-Linear Computations of Length-Preserving Encryption Schemes
It is well known that three and four rounds of balanced Feistel cipher or Luby-Rackoff (LR) encryption for two blocks messages are pseudorandom permutation (PRP) and strong pseudorandom permutation (SPRP) respectively. A {\bf block} is -bit long for some positive integer and a (possibly keyed) {\bf block-function} is a nonlinear function mapping all blocks to themselves, e.g. blockcipher. XLS (eXtended Latin Square) with three blockcipher calls was claimed to be SPRP and later which is shown to be wrong. Motivating with these observations, we consider the following questions in this paper: {\em What is the minimum number of invocations of block-functions required to achieve PRP or SPRP security over blocks inputs}? To answer this question, we consider all those length-preserving encryption schemes, called {\bf linear encryption mode}, for which only nonlinear operations are block-functions. Here, we prove the following results for these encryption schemes:
(1) At least (or ) invocations of block-functions are required to achieve SPRP (or PRP respectively). These bounds are also tight.
(2) To achieve the above bound for PRP over blocks, either we need at least two keys or it can not be {\em inverse-free} (i.e., need to apply the inverses of block-functions in the decryption). In particular, we show that a single-keyed block-function based, inverse-free PRP needs invocations.
(3) We show that 3-round LR using a single-keyed pseudorandom function (PRF) is PRP if we xor a block of input by a masking key
Revisiting Security Claims of XLS and COPA
Ristenpart and Rogaway proposed XLS in 2007 which is a
generic method to encrypt messages with incomplete last blocks. Later
Andreeva et al., in 2013 proposed an authenticated encryption COPA
which uses XLS while processing incomplete message blocks. Following
the design of COPA, several other CAESAR candidates used the similar
approach. Surprisingly in 2014, Nandi showed a three-query distinguisher against XLS which violates the security claim of XLS and puts a question mark on all schemes using XLS. However, due to the interleaved nature of encryption and decryption queries of the distinguisher, it was not clear whether the security claims of COPA remains true or not. This paper revisits XLS and COPA both in the direction of cryptanalysis and provable security. Our contribution of the paper can be summarized into following two parts:
1. Cryptanalysis: We describe two attacks - (i) a new distinguisher
against XLS and extending this attack to obtain (ii) a forging algo-
rithm with query complexity about 2^n/3 against COPA where n is
the block size of the underlying blockcipher.
2. Security Proof: Due to the above attacks the main claims of XLS
(already known before) and COPA are wrong. So we revise the security analysis of both and show that (i) both XLS and COPA are
pseudorandom function or PRF up to 2^n/2 queries and (ii) COPA is
integrity-secure up to 2^n/3 queries (matching the query complexity
of our forging algorithm)
A Simple Proof of a Distinguishing Bound of Iterated Uniform Random Permutation
Let P be chosen uniformly from the set P := Perm(S), the set of all permutations over a set S of size N. In Crypto 2015, Minaud and Seurin proved that for any unbounded time adversary A, making at most q queries, the distinguishing advantage between P^r (after sampling P, compose it for r times) and P, denoted Delta(P^r ; P), is at most (2r + 1)q/N. In this paper we provide an alternative simple proof of this result for an upper bound 2q(r+1)^2/N by using well known coefficient H-technique
A Generic Method to Extend Message Space of a Strong Pseudorandom Permutation
In this paper we present an efficient and secure generic method
which can encrypt messages of size at least . This generic
encryption algorithm needs a secure encryption algorithm for
messages of multiple of . The first generic construction, XLS,
has been proposed by Ristenpart and Rogaway in FSE-07. It needs
two extra invocations of an independently chosen strong
pseudorandom permutation or SPRP defined over \s^n for
encryption of an incomplete message block. Whereas our
construction needs only one invocation of a weak pseudorandom
function and two multiplications over a finite field
(equivalently, two invocations of an universal hash function). We
prove here that the proposed method preserves (tweakable) SPRP.
This new construction is meaningful for two reasons. Firstly, it
is based on weak pseudorandom function which is a weaker security
notion than SPRP. Thus we are able to achieve stronger security
from a weaker one. Secondly, in practice, finite field
multiplication is more efficient than an invocation of SPRP. Hence
our method can be more efficient than XLS
XLS is not a Strong Pseudorandom Permutation
In FSE 2007, Ristenpart and Rogaway had described a generic
method XLS to construct a length-preserving strong pseudorandom per-
mutation (SPRP) over bit-strings of size at least n. It requires a length-preserving permutation E over all bits of size multiple of n and a blockcipher E with block size n. The SPRP security of XLS was proved from the SPRP assumptions of both E and E. In this paper we disprove the claim by demonstrating a SPRP distinguisher of XLS which makes only
three queries and has distinguishing advantage about 1/2. XLS uses a
multi-permutation linear function, called mix2. In this paper, we also
show that if we replace mix2 by any invertible linear functions, the construction XLS still remains insecure. Thus the mode has inherit weakness
A Unified Method for Improving PRF Bounds for a Class of Blockcipher based MACs
This paper provides a unified framework for {\em improving} \PRF(pseudorandom function) advantages of several popular MACs (message authentication codes) based on a blockcipher modeled as \tx{RP} (random permutation). In many known MACs, the inputs of the underlying blockcipher are defined to be some deterministic affine functions of previously computed outputs of the blockcipher. Keeping the similarity in mind, we introduce a class of \tx{ADE}s (affine domain extensions) and a wide subclass of \tx{SADE}s (secure \tx{ADE}) containing \mathcal{C} = \{ \tx{CBC-MAC},\ \tx{GCBC}^*,\ \tx{OMAC},\ \tx{PMAC} \}. We define a parameter for each domain extension and show that all \tx{SADE}s have \PRF advantages where is the total number of blockcipher computations needed for all queries. We prove that \PRF advantage of any \tx{SADE} is by showing that is always at most . We provide a better estimate of for all members of and hence these MACs have {\em improved advantages }. Our proposed bounds for \tx{CBC-MAC} and \tx{GCBC}^* are better than previous best known bounds
Birthday Attack on Dual EWCDM
In CRYPTO 2017, Mennink and Neves showed almost n-bit security for a dual version of EWCDM. In this paper we describe a birthday attack on this construction which violates their claim
Forging Attacks on two Authenticated Encryptions COBRA and POET
In FSE 2014, an authenticated encryption mode COBRA [4], based on pseudorandom permutation (PRP) blockcipher, and POET [3], based on Almost XOR-Universal (AXU) hash and strong pseudorandom permutation (SPRP), were proposed. Few weeks later, COBRA mode and a simple variant of the original proposal of POET (due to a forging attack [13] on the original proposal) with AES as an underlying blockcipher, were submitted in CAESAR, a competition [1] of authenticated encryption
(AE). In this paper we show a forging attack on the mode COBRA based on any n-bit blockcipher. Our attack on COBRA requires about O(n) queries with success probability about 1/2. This disproves the
claim proved in FSE 2014 paper. We also show both privacy and forging attack on the parallel version of POET, denoted POET-m. In case of the modes POET or POE (the underlying modes for encryption), we show one query distinguishing attack when we instantiate the underlying AXU-hash function with some other AXU hash function, namely uniform random involution. Thus, our result violates the designer\u27s main claim (Theorem 8.1 in [1]). However, the attacks can not be extended directly for the specific choices of existing submitted versions to the CAESAR competition
Mind the Composition: Birthday Bound Attacks on EWCDMD and SoKAC21
In an early version of CRYPTO’17, Mennink and Neves pro- posed EWCDMD, a dual of EWCDM, and showed n-bit security, where n is the block size of the underlying block cipher. In CRYPTO’19, Chen et al. proposed permutation based design SoKAC21 and showed 2n/3- bit security, where n is the input size of the underlying permutation. In this paper we show birthday bound attacks on EWCDMD and SoKAC21, invalidating their security claims. Both attacks exploit an inherent com- position nature present in the constructions. Motivated by the above two attacks exploiting the composition nature, we consider some generic relevant composition based constructions of ideal primitives (possibly in the ideal permutation and random oracle model) and present birthday bound distinguishers for them. In particular, we demonstrate a birthday bound distinguisher against (1) a secret random permutation followed by a public random function and (2) composition of two secret random functions. Our distinguishers for SoKAC21 and EWCDMD are direct con- sequences of (1) and (2) respectively
- …