Extended Abstract: Provable-Security Analysis of Authenticated Encryption in Kerberos

2007 ◽  
Author(s):  
Alexandra Boldyreva ◽  
Virendra Kumar
Keyword(s):  
Provable Security ◽  
Security Analysis ◽  
Authenticated Encryption

scholarly journals Cryptanalysis of PMACx, PMAC2x, and SIVx

2017 ◽  
pp. 162-176
Author(s):  
Kazuhiko Minematsu ◽  
Tetsu Iwata
Keyword(s):  
Provable Security ◽  
Block Cipher ◽  
Query Complexity ◽  
Block Length ◽  
Encryption Scheme ◽  
Authenticated Encryption ◽  
Pseudorandom Functions ◽  
Tweakable Block Cipher ◽  
Deterministic Authenticated Encryption ◽  
Provably Secure

At CT-RSA 2017, List and Nandi proposed two variable input length pseudorandom functions (VI-PRFs) called PMACx and PMAC2x, and a deterministic authenticated encryption scheme called SIVx. These schemes use a tweakable block cipher (TBC) as the underlying primitive, and are provably secure up to the query complexity of 2n, where n denotes the block length of the TBC. In this paper, we falsify the provable security claims by presenting concrete attacks. We show that with the query complexity of O(2n/2), i.e., with the birthday complexity, PMACx, PMAC2x, and SIVx are all insecure.

Security Analysis of a Convertible Multiauthenticated Encryption Scheme

2010 ◽  
Vol 159 ◽  
pp. 111-115 ◽  
Author(s):  
Jian Hong Zhang ◽  
Xue Liu ◽  
Cheng Lian Liu
Keyword(s):  
Security Analysis ◽  
Hash Functions ◽  
Encryption Scheme ◽  
Authenticated Encryption ◽  
Transmission Scheme ◽  
Message Transmission

Multi-authenticated encryption scheme is message transmission scheme, which sends message in a secure and authentic way, and allows a group of signers to cooperatively produce a valid authenticated ciphertext so that only the specific recipient can recover the message and verify the signature. Recently, Wu et al. proposed a convertible multi-authenticated encryption scheme and claimed that the scheme was secure. In this paper, we show that Wu et. al’s scheme is not secure against rogue-key attacks. To overcome such attack, we give an improved multi-authenticated encryption scheme by including two hash functions. And our improved scheme is the same efficiency as Wu et.al.’s scheme.

scholarly journals Revisiting Variable Output Length XOR Pseudorandom Function

2018 ◽  
pp. 314-335 ◽  
Author(s):  
Srimanta Bhattacharya ◽  
Mridul Nandi
Keyword(s):  
Linear Equations ◽  
Security Analysis ◽  
Basic Structure ◽  
Authenticated Encryption ◽  
Security Proof ◽  
Simple Variant ◽  
Encryption Algorithms ◽  
The Cost ◽  
Mirror Theory ◽  
Pseudorandom Function

Let σ be some positive integer and C ⊆ {(i, j) : 1 ≤ i < j ≤ σ}. The theory behind finding a lower bound on the number of distinct blocks P1, . . . , Pσ ∈ {0, 1}n satisfying a set of linear equations {Pi ⊕Pj = ci,j : (i, j) ∈ C} for some ci,j ∈ {0, 1}n, is called mirror theory. Patarin introduced the mirror theory and provided a proof for this. However, the proof, even for a special class of equations, is complex and contains several non-trivial gaps. As an application of mirror theory, XORP[w] (known as XOR construction) returning (w−1) block output, is a pseudorandom function (PRF) for some parameter w, called width. The XOR construction can be seen as a basic structure of some encryption algorithms, e.g., the CENC encryption and the CHM authenticated encryption, proposed by Iwata in 2006. Due to potential application of XORP[w] and the nontrivial gaps in the proof of mirror theory, an alternative simpler analysis of PRF-security of XORP[w] would be much desired. Recently (in Crypto 2017) Dai et al. introduced a tool, called the χ2 method, for analyzing PRF-security. Using this tool, the authors have provided a proof of PRF-security of XORP[2] without relying on the mirror theory. In this paper, we resolve the general case; we apply the χ2 method to obtain a simpler security proof of XORP[w] for any w ≥ 2. For w = 2, we obtain a tighter bound for a wider range of parameters than that of Dai et al.. Moreover, we consider variable width construction XORP[∗] (in which the widths are chosen by adversaries adaptively), and also provide variable output length pseudorandom function (VOLPRF) security analysis for it. As an application of VOLPRF, we propose an authenticated encryption which is a simple variant of CHM or AES-GCM and provides much higher security than those at the cost of one extra blockcipher call for every message.

scholarly journals Stronger Security Variants of GCM-SIV

2016 ◽  
pp. 134-157 ◽  
Author(s):  
Tetsu Iwata ◽  
Kazuhiko Minematsu
Keyword(s):  
Provable Security ◽  
Query Complexity ◽  
Authenticated Encryption ◽  
Standard Assumption ◽  
Distinguishing Attack ◽  
Pseudorandom Permutation ◽  
Minor Variant ◽  
A Minor ◽  
Security Bound ◽  
Provably Secure

At CCS 2015, Gueron and Lindell proposed GCM-SIV, a provably secure authenticated encryption scheme that remains secure even if the nonce is repeated. While this is an advantage over the original GCM, we first point out that GCM-SIV allows a trivial distinguishing attack with about 248 queries, where each query has one plaintext block. This shows the tightness of the security claim and does not contradict the provable security result. However, the original GCM resists the attack, and this poses a question of designing a variant of GCM-SIV that is secure against the attack. We present a minor variant of GCM-SIV, which we call GCM-SIV1, and discuss that GCM-SIV1 resists the attack, and it offers a security trade-off compared to GCM-SIV. As the main contribution of the paper, we explore a scheme with a stronger security bound. We present GCM-SIV2 which is obtained by running two instances of GCM-SIV1 in parallel and mixing them in a simple way. We show that it is secure up to 285.3 query complexity, where the query complexity is measured in terms of the total number of blocks of the queries. Finally, we generalize this to show GCM-SIVr by running r instances of GCM-SIV1 in parallel, where r ≥ 3, and show that the scheme is secure up to 2128r/(r+1) query complexity. The provable security results are obtained under the standard assumption that the blockcipher is a pseudorandom permutation.

scholarly journals Minimizing Key Materials: The Even–Mansour Cipher Revisited and Its Application to Lightweight Authenticated Encryption

2020 ◽  
Vol 2020 ◽  
pp. 1-6
Author(s):  
Ping Zhang ◽  
Qian Yuan
Keyword(s):  
Open Problem ◽  
Provable Security ◽  
Simple Structure ◽  
Block Ciphers ◽  
Authenticated Encryption ◽  
Maximal Multiplicity ◽  
Symmetric Key ◽  
Security Bound

The Even–Mansour cipher has been widely used in block ciphers and lightweight symmetric-key ciphers because of its simple structure and strict provable security. Its research has been a hot topic in cryptography. This paper focuses on the problem to minimize the key material of the Even–Mansour cipher while its security bound remains essentially the same. We introduce four structures of the Even–Mansour cipher with a short key and derive their security by Patarin’s H-coefficients technique. These four structures are proven secure up to O˜2k/μ adversarial queries, where k is the bit length of the key material and μ is the maximal multiplicity. Then, we apply them to lightweight authenticated encryption modes and prove their security up to about minb/2,c,k−log μ-bit adversarial queries, where b is the size of the permutation and c is the capacity of the permutation. Finally, we leave it as an open problem to settle the security of the t-round iterated Even–Mansour cipher with short keys.

Sign in / Sign up

Export Citation Format

Share Document