Inoue and Minematsu [Cryptology ePrint Archive: Report 2018/1040] presented efficient forgery attacks against OCB2, and Poettering [Cryptology ePrint Archive: Report 2018/1087] presented a distinguishing attack. In this short note, based on these results, we show a plaintext recovery attack against OCB2 in the chosen plaintext and ciphertext setting. We also show that the decryption oracle of the underlying block cipher can be simulated. This complements the simulation of the encryption oracle of the block cipher by Poettering in [Cryptology ePrint Archive: Report 2018/1087]

Tetsu Iwata

Cryptology ePrint Archive

Plaintext Recovery Attack of OCB2?Tetsu IwataNagoya University, Japantetsu.iwata@nagoya-u.jpAbstract. Inoue and Minematsu [Cryptology ePrint Archive: Report2018/1040] presented efficient forgery attacks against OCB2, and Poet-tering [Cryptology ePrint Archive: Report 2018/1087] presented a dis-tinguishing attack. In this short note, based on these results, we showa plaintext recovery attack against OCB2 in the chosen plaintext andciphertext setting. We also show that the decryption oracle of the under-lying block cipher can be simulated. This complements the simulation ofthe encryption oracle of the block cipher by Poettering in [CryptologyePrint Archive: Report 2018/1087].Keywords: OCB2, plaintext recovery attack, chosen plaintext and ci-phertext setting1 IntroductionOCB2 is an efficient authenticated encryption scheme proposed in [6]. In [1],Inoue and Minematsu presented efficient forgery attacks against OCB2, andPoettering presented an implication of the attack in the context of confidential-ity [3]. Specifically, Poettering presented a distinguishing attack under the chosenplaintext and ciphertext setting, and this breaks the privacy security notion inthe sense of IND-CCA.In this short note, based on the results of [1,3], we show a plaintext recov-ery attack against OCB2 in the chosen plaintext and ciphertext setting, i.e.,Poettering showed that OCB2 allows a distinguishing attack and hence cannotachieve the privacy notion of IND-CCA, but we show that for a given ciphertext,the corresponding plaintext can be recovered if the adversary has access to theencryption and decryption oracles.1 This attack model is usually not coveredin the provable security analysis, as the provable security notion only requiresless ambitious goal of the adversary (and this is an important point in prov-able security results). A similar model was considered in the security analysis of? See [Cryptology ePrint Archive: Report 2019/311] that appeared on March 20, 2019,which is a joint report that includes the findings of [Cryptology ePrint Archive:Report 2018/1040] (by Inoue and Minematsu), [Cryptology ePrint Archive: Report2018/1087] (by Poettering), and this report.1 We note that the updated version [5] of [3] includes the same plaintext recoveryattack.EAX-prime [2], while the attack against EAX-prime works without an encryp-tion oracle.In [4], Poettering showed that the encryption EK of the underlying blockcipher can be simulated if the adversary has access to the encryption and de-cryption oracles of OCB2. That is, for any X∗ chosen by the adversary, it cancompute Y ∗ = EK(X∗). We complement this by showing that the decryptionE−1K can also be simulated with an overwhelming probability if the adversaryhas access to the encryption and decryption oracles of OCB2, i.e., for any Y ∗chosen by the adversary, it can compute X∗ = E−1K (Y∗).To make the paper succinct, we follow exactly the same notation used in [1],and we omit the description of OCB2.2 Plaintext Recovery Attack ModelWe consider an attack model that closely follows [2]. A challenger has a secret keyK. Let (C∗, T ∗) be the encryption of (N∗, A∗,M∗), where a nonce N∗, associateddata A∗, and a plaintext M∗ are arbitrarily chosen by the challenger. However,we make assumptions that M∗ is long and C∗ has many blocks (for instance 3or more blocks), and that when C∗ is broken into blocks as (C∗[1], . . . , C∗[m∗]),there exist indices j, k ∈ {1, . . . ,m∗ − 1} such that C∗[j] 6= C∗[k].Then (N∗, A∗, C∗, T ∗) is given to the adversary as a challenge. The adversaryhas access to the encryption and decryption oracles, and the goal is to recoverM∗. The encryption oracle takes (N,A,M) as input and returns (C, T ). Thedecryption oracle takes (N ′, A′, C ′, T ′) as input and returns the correspondingplaintext M ′ or the reject symbol ⊥.The adversary cannot use N∗ as a nonce in encryption queries (as N∗ wasalready used in encryption to generate the challenge). Also, the adversary isnonce-respecting and hence cannot repeat the same nonce in encryption queries.To avoid a trivial win, the adversary cannot use the challenge (N∗, A∗, C∗, T ∗)in decryption queries.3 Plaintext Recovery AttackLet (C∗, T ∗) be the encryption of (N∗, A∗,M∗), and (N∗, A∗, C∗, T ∗) is givento the adversary as a challenge. The goal is to recover M∗.We first recover L∗ = EK(N∗). For this, we first perform the attack in [1,Sect. 4.1].1. Fix any N,M [2] ∈ {0, 1}n such that N 6= N∗, and let M = (M [1],M [2]) =(len(0n),M [2]).2. Next, make an encryption query (N,A,M), where A is empty, and obtain(C[1], C[2], T ).3. Let C ′ = C[1]⊕ len(0n) and T ′ = M [2]⊕ C[2].4. Make a decryption query (N ′, A′, C ′, T ′), where N ′ = N and A′ is empty,and obtain M ′ = 2L⊕ len(0n).2As explained in [1, Sect. 4.3], the adversary can recover three input-outputpairs (X[1], Y [1]), (X[2], Y [2]), (X[3], Y [3]) of the block cipher, where Y [i] =EK(X[i]). If X[i] = N∗ for some i, then L∗ is Y [i]. Otherwise, let (N ′′, L′′)be one of (X[i], Y [i]) that satisfies N ′′ 6= N . We note that there is a negligibleprobability that this fails. However, this can be avoided by repeating the aboveSteps 1–4 with a different nonce N . We could also follow [1, Sect. 4.2] to obtainmore input-output pairs. We then proceed as follows:1. Fix any A′′ ∈ {0, 1}∗ and M ′′[2] ∈ {0, 1}n, and let M ′′ = (M ′′[1],M ′′[2]) =(N∗ ⊕ 2L′′,M ′′[2]).2. Make an encryption query (N ′′, A′′,M ′′) and obtain (C ′′[1], C ′′[2], T ′′).3. Let L∗ be C ′′[1]⊕ 2L′′.We see that Step 3 indeed gives L∗. See Fig. 1 for the generation process of C ′′[1]for the encryption query (N ′′, A′′,M ′′) of Step 2.C ′′[1]2L′′2L′′EKEKN ′′L′′M ′′[1] = N∗ ⊕ 2L′′Fig. 1. The generation process of C′′[1] for the encryption query (N ′′, A′′,M ′′) ofStep 2. L∗ = EK(N∗) is obtained as C′′[1] ⊕ 2L′′.With the knowledge of L∗, following [1, Sect. 4.3], we modify C∗ to makea decryption query. Specifically, let C∗ = (C∗[1], . . . , C∗[m∗]) be the challengeciphertext broken into blocks, and we first fix indices j, k ∈ {1, . . . ,m∗− 1} thatsatisfy C∗[j] 6= C∗[k]. We then define C$ = (C$[1], . . . , C$[m∗]) as follows:– C$[i] = C∗[i] for i ∈ {1, . . . ,m∗} \ {j, k}– C$[j] = C∗[k]⊕ 2kL∗ ⊕ 2jL∗– C$[k] = C∗[j]⊕ 2kL∗ ⊕ 2jL∗Next, the adversary makes a decryption query (N∗, A∗, C$, T ∗), i.e, this is almostthe same as the challenge, but the j-th and k-th blocks of C∗ are modified. Fromthe reasoning of [1, Sect. 4.3], the query will be accepted, and the adversaryobtains M$. The goal of the attack, M∗, is obtained by swapping the j-th andk-th blocks of M$ and making necessary modifications. More precisely, fromM$ = (M$[1], . . . ,M$[m∗]), we obtain M∗ = (M∗[1], . . . ,M∗[m∗]) as follows:– M∗[i] = M$[i] for i ∈ {1, . . . ,m∗} \ {j, k}– M∗[j] = M$[k]⊕ 2kL∗ ⊕ 2jL∗3– M∗[k] = M$[j]⊕ 2kL∗ ⊕ 2jL∗See Fig. 2 for the encryption process of (N∗, A∗,M∗) and the decryption processof (N∗, A∗, C$, T ∗).EKEKN∗L∗M∗[j] M∗[k]C∗[j] C∗[k]2jL∗ 2kL∗2jL∗EK2kL∗EKN∗L∗2jL∗ 2kL∗2jL∗ 2kL∗C$[j] C$[k]M$[j] M$[k]E−1KE−1KFig. 2. The encryption process of (N∗, A∗,M∗) (left) and the decryption process of(N∗, A∗, C$, T ∗) (right). In the right figure, we have C$[j] = C∗[k] ⊕ 2kL∗ ⊕ 2jL∗ andC$[k] = C∗[j] ⊕ 2kL∗ ⊕ 2jL∗, and it follows that M∗[j] = M$[k] ⊕ 2kL∗ ⊕ 2jL∗ andM∗[k] = M$[j] ⊕ 2kL∗ ⊕ 2jL∗.4 Block Cipher DecryptionWe show that, for any Y ∗, the adversary can compute X∗ = E−1K (Y∗).We first perform the attack in [1, Sect. 4.1] by using any nonce N ∈ {0, 1}n.The adversary can recover L = EK(N), and from this, the adversary obtainsthree input-output pairs (X[1], Y [1]), (X[2], Y [2]), (X[3], Y [3]) of the block ci-pher, where Y [i] = EK(X[i]).Let (N ′, L′) = (X[1], Y [1]), where we assume that N ′ 6= N , and defineM∗ = (X∗ ⊕ 2L′, X∗ ⊕ 22L′, 0n) ∈ {0, 1}3n.The approach we take is to compute C∗ and T ∗ under the nonce N ′ and emptyA∗, and make a decryption query (N ′, A∗, C∗, T ∗). The adversary obtains M∗,and X∗ can be obtained in an obvious way.The observation here is that the check sum of M∗ is Σ∗ = 2L′⊕22L′, which isindependent of X∗, and we know all the block cipher input values to compute C∗and T ∗. See Fig. 3 for the encryption process of (N ′, A∗,M∗). We need to derivethe values of C∗[3] and T ∗ in Fig. 3. This can be done as in the computation ofL∗ from N∗ in the previous section.1. Let (N ′′, L′′) = (X[2], Y [2]), where we assume that N ′′ 6= N ′ and N ′′ 6= N .2. Fix any A′′ ∈ {0, 1}∗, and let M ′′ = (M ′′[1],M ′′[2],M ′′[3]) = (len(0n) ⊕23L′ ⊕ 2L′′, 2L′ ⊕ 22L′ ⊕ 233L′ ⊕ 22L′′,M ′′[3]), where M ′′[3] ∈ {0, 1}n canbe arbitrarily fixed.43. Make an encryption query (N ′′, A′′,M ′′) and obtain (C ′′[1], C ′′[2], C ′′[3], T ′′).4. Let C∗[3] be C ′′[1]⊕ 2L′′ and T ∗ be C ′′[2]⊕ 22L′′.See Fig. 4 for this step.The final step is to make a decryption query (N ′, A∗, C∗, T ∗), where A∗is empty, C∗ = (Y ∗ ⊕ 2L′, Y ∗ ⊕ 22L′, C∗[3]), and C∗[3] and T ∗ are obtained asabove. The query will be accepted, and the oracle returns M∗ = (X∗⊕2L′, X∗⊕22L′, 0n). The adversary can compute X∗ from the knowledge of L′, and we seethat the entire process succeeds with an overwhelming probability.N ′L′X∗ 2L′2L′Y ∗ 2L′EKEK EK2L′EK EK22L′22L′ 23L′ 233L′0nX∗ 22L′Y ∗ 22L′len(0n)C∗[3]2L′ 22L′T ∗C∗Fig. 3. The encryption process of (N ′, A∗,M∗). C∗[3] and T ∗ are unknown.N ′′L′′EKEK EK(len(0n)⊕ 23L′)⊕ 2L′′ (2L′ ⊕ 22L′ ⊕ 233L′)⊕ 22L′′2L′′2L′′ 22L′′22L′′C ′′[1] C ′′[2]Fig. 4. The encryption process of (N ′′, A′′,M ′′). We see that C∗[3] = C′′[1]⊕ 2L′′ andT ∗ = C′′[2] ⊕ 22L′′.5 ConclusionsIn this short note, based on the results of [1,3], we presented a plaintext recoveryattack against OCB2 in the chosen plaintext and ciphertext setting. The distin-guishing attack by Poettering [3] has already broken the confidentiality of OCB25in the sense of IND-CCA. The result of this note shows that the confidentialitycan also be broken in the sense of plaintext recovery. We also showed that if theadversary has access to the encryption and decryption oracles of OCB2, it cansimulate the decryption oracle of the underlying block cipher.Acknowledgements. The author would like to thank Kazuhiko Minematsu foruseful comments.References1. A. Inoue and K. Minematsu. Cryptanalysis of OCB2. IACR Cryptology ePrintArchive, 2018:1040, 2018.2. K. Minematsu, S. Lucks, H. Morita, and T. Iwata. Attacks and Security Proofs ofEAX-Prime. In S. Moriai, editor, FSE 2013, volume 8424 of LNCS, pages 327–347.Springer, 2013.3. B. Poettering. Breaking the confidentiality of OCB2. IACR Cryptology ePrintArchive, 2018:1087, 20181109:191507, 2018.4. B. Poettering. Breaking the confidentiality of OCB2. IACR Cryptology ePrintArchive, 2018:1087, 20181111:223450, 2018.5. B. Poettering. Breaking the confidentiality of OCB2. IACR Cryptology ePrintArchive, 2018:1087, 20181112:161425, 2018.6. P. Rogaway. Efficient Instantiations of Tweakable Blockciphers and Refinements toModes OCB and PMAC. In P. J. Lee, editor, ASIACRYPT 2004, volume 3329 ofLNCS, pages 16–31. Springer, 2004.6

Plaintext Recovery Attack of OCB2

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive