Search

We consider the problem of constructing secure cryptographic hash functions from subverted ideal primitives. Hash functions are used to instantiate Random Oracles in cryptographic protocols. The indifferentiability security notion is a popular tool to certify the structural soundness of a hash design for such instantiations. In CRYPTO 2018, Russell, Tang, Yung, and Zhou introduced the notion of crooked-indifferentiability to extend this paradigm even when the underlying primitive of the hashing mode is subverted. They showed that an $n$ -to- $n$ -bit function implemented using Enveloped XOR construction (EXor) with $3n+1$ many independent $n$ -to- $n$ -bit functions and $3n^{2}$ -bit random seed can be proven secure asymptotically in the crooked-indifferentiability setting. Unfortunately, known techniques to prove crooked-indifferentiability are extremely complicated, and no practical hashing mode has been analyzed in this setting. 1) We introduce new techniques to prove crooked-indifferentiability. We establish that upper bounding the subversion probability of a chaining query is sufficient to argue subversion resistance of a standard indifferentiable mode of operation. Our technique links standard indifferentiability and crooked-indifferentiability and circumvents the complications of proving the consistency of the simulator in the crooked setting. 2) We prove crooked-indifferentiability of the sponge construction when the underlying primitive is modelled as an $n$ -to- $n$ -bit random function. Our proofs only require $n$ -bit randomly chosen but fixed IV and do not mandate any independent function requirement. The result naturally extends to the Merkle-Damgård domain extension with prefix-free padding. Our results minimize required randomness and solve the main open problem raised by Russell, Tang, Yung, and Zhou.

In 2011, Yamada et al. proposed CPA to CCA-secure conversions for attribute-based encryption (ABE) based on the properties, verifiability and delegation. Later, the verifiability-based conversion was generalised from ABE to predicate encryption (PE) by Yamada et al. (2012) and Nandi et al. (2017). We observe that for bilinear-pairing based PE schemes, the cost of CCA-decryption blows up to the double of the cost of CPA-decryption due to verifiability testing. Therefore, the conversion based on delegation is mostly acceptable whenever a delegation-based conversion is available for the primitive PE scheme. In this paper, we investigate a generic delegation-based conversion from CPA to CCA-secure predicate encryption schemes. Our conversion generalises the delegation-based conversion of Yamada et al. (2011) from ABE to PE. We show that our conversion captures many subclasses of PE, e.g., (hierarchical) inner-product encryption, (doubly-)spatial encryption and functional encryption for regular languages.

In this paper, we propose two hardware optimized authenticated encryption schemes: TriviA-v2and uTriviA. Both TriviA-v2, an efficient hardware optimization of TriviA-0-v1, and uTriviAare based on (i) a stream cipher for generating keys for the ciphertext and the tag, and (ii) a pairwise independent hash to compute the tag. We have adopted one of the ISO-standardized stream ciphers for lightweight cryptography, namely Trivium, to obtain our underlying stream cipher. The main structure of TriviA-v2remains same as TriviA-0-v1, except some changes in the internal functions. The stream cipher used both in TriviA-v2and uTriviAhas a 384-bit state, slightly larger than Trivium, and can accommodate a 128-bit secret key and IV. TriviA-v2uses a pairwise independent hash which is an adaptation of the EHCor “Encode-Hash-Combine” hash that requires the optimum number of field multiplications and hence requires small hardware footprint. uTriviAuses a pairwise independent hash which is an adaptation of the HCor “Hash-Combine” hash which is close to EHCbut does not use any encode function. We prove that TriviA-v2construction has at least 128-bit security for privacy and 124-bit security of authenticity under the assumption that the underlying stream cipher produces a pseudorandom bit stream. The uTriviAconstruction achieves at least 128-bit security for privacy and 93-bit security of authenticity under the same assumption. We have implemented the designs in synthesizable RTL. Pre-layout synthesis using 65 nm standard cell technology reveals that TriviA-v2is able to achieve a high throughput of 65.9 Gbps for an area of 21.2 KGE, whereas TriviA-0-v1achieved a much higher hardware area. The uTriviAdesign achieves a hardware area of only 16.74 KGE, which is lowest among all the TriviAvariants but with a lower throughput of 36.76 Gbps. Finally, we provide a brief comparison between the three constructions TriviA-0-v1, TriviA-v2and uTriviAand the other standard implementations in terms of hardware area-efficiency metric.

CLOC and SILCare two block cipher-based authenticated encryption schemes, submitted to the CAESAR competition, that aims to use low area buffer and handle short input efficiently. The designers of CLOCand SILCclaimed n2 $\frac {n}{2}$-bit integrity security against nonce-reusing adversaries, where nis the blockcipher state size in bits. In this paper, we present single fault-based almost universal forgeries on both CLOC and SILC with only one single bit fault at a fixed position of a specific blockcipher input. In the case of CLOC, the forgery can be done for almost any nonce, associated data and message triplet, except some nominal restrictions on associated data. In the case of SILC, the forgery can be done for almost any associated data and message, except some nominal restrictions on associated data along with a fixed nonce. Both the attacks on CLOC and SILCrequire several nonce-misusing encryption queries This attack is independent of the underlying block cipher and works on the encryption mode. In this paper, we also validate the proposed fault-based forgery methodology by performing actual fault attacks by electromagnetic pulse injection which shows practicality of the proposed forgery procedure. Next, we provide updated constructions that can resist the fault-based forgery on the mode assuming the underlying block cipher is fault resistant. Finally, we show that, if the underlying block cipher is not fault resistant, then for both CLOCand SILC, the key recovery can be done by injecting fault into the block cipher operations. We have considered the example with AES as the underlying block cipher. We would like to note that our attacks do not violate the designers’ claims as our attacks require fault. However, it shows some vulnerability of the schemes when fault is feasible.

AbstractIn this paper we provide a simple, concrete and improved security analysis of Parallelizable Message Authentication Code or PMAC. In particular, we show that the advantage of any distinguisher at distinguishing PMAC from a random function is at most (5qσσ –– 3.5q2)/2n. Here, σσ is the total number of message blocks in all qqueries made by and PMAC is based on a random permutation over {0, 1}n. In the original paper of PMAC by Black and Rogaway in Eurocrypt-2002, the bound was shown to be (σσ + 1)2/2n––1. In FSE-2007, Minematsu and Matsushima provided a bound 5ℓq2/(2n–– 2ℓ), where ℓ is the number of blocks of the longest queried made by the distinguisher. Our proposed bound is sharper than these two previous bounds.