Lightweight authenticated encryption mode suitable for threshold implementation
This paper proposes tweakable block cipher (TBC) based modes $\text{PFB}_-\text{Plus}$ and $\text{PFB}\omega$ that are efficient in threshold implementations (TI). Let $t$ be an algebraic degree of a target function, e.g. $t = 1$ (resp. $t > 1$) for linear (resp. non-linear) function. The $d\text{-}th$ order TI encodes the internal state into $dt+1$ shares. Hence, the area size increases proportionally to the number of shares. This implies that TBC-based modes can be smaller than block cipher (BC) based modes in TI because TBC requires an $s$-bit block to ensure $s$-bit security, e.g. PFB and Romulus, while BC requires a 2s-bit block. However, even with those TBC based modes, the minimum they can reach is 3 shares of $s$-bit state with $t = 2$ and the first-order TI $(d = 1)$. Their first design $\text{PFB}_-\text{Plus}$ aims to break the barrier of the $3s$-bit state in TI. The block size of an underlying TBC is $s/2$ bits and the output of TBC is linearly expanded to $s$ bits. This expanded state requires only 2 shares in the first-order TI, which makes the total state size $2.5s$ bits.They also provide rigorous security proof of $\text{PFB}_-\text{Plus}$. Their second design $\text{PFB}\omega$ further increases a parameter $\omega$: a ratio of the security level s to the block size of an underlying TBC. They prove the security of $\text{PFB}\omega$ for any $\omega$ under some assumptions for an underlying TBC and for parameters used to update a state. Next, they show a concrete instantiation of $\text{PFB}_-\text{Plus}$ for 128-bit security. It requires a TBC with a 64-bit block, 128-bit key, and 128-bit tweak, while no existing TBC can support it. They design a new TBC by extending SKINNY and provide basic security evaluation. Finally, they give hardware benchmarks of $\text{PFB}_-\text{Plus}$ in the first-order TI to show that TI of $\text{PFB}_-\text{Plus}$ is smaller than that of PFB by more than one thousand gates and is the smallest within the schemes having 128-bit security. For the entire collection see [Zbl 1482.94003].
- Improving first-order threshold implementations of \textsf{SKINNY}
- Threshold implementations of small S-boxes
- A Tale of Two Shares: Why Two-Share Threshold Implementation Seems Worthwhile—and Why It Is Not
- Blockcipher-based authenticated encryption: how small can we go?
- A more efficient AES threshold implementation
- A new variant of PMAC: beyond the birthday bound
- A practical forgery attack on Lilliput-AE
- A Tale of Two Shares: Why Two-Share Threshold Implementation Seems Worthwhile—and Why It Is Not
- Advances in Cryptology - CRYPTO 2003
- Authenticated encryption in the face of protocol and side channel leakage
- Authenticated encryption with nonce misuse and physical leakage: definitions, separation results and first construction (extended abstract)
- Beyond conventional security in sponge-based authenticated encryption modes
- Ciphers for MPC and FHE
- Constructing TI-friendly substitution boxes using shift-invariant permutations
- Duplexing the sponge: Single-pass authenticated encryption and other applications
- How to use metaheuristics for design of symmetric-key primitives
- scientific article; zbMATH DE number 1088930 (Why is no real title available?)
- Leakage resilience of the duplex construction
- Masking AES with \(d+1\) shares in hardware
- MiMC: efficient encryption and cryptographic hashing with minimal multiplicative complexity
- Pushing the limits: a very compact and a threshold implementation of AES
- Reducing the cost of authenticity with leakages: a CIML2-secure AE scheme with one call to a strongly protected tweakable block cipher
- Related-key impossible-differential attack on reduced-round \textsc{Skinny}
- Side-channel resistant crypto for less than 2,300 GE
- Speeding up MILP Aided Differential Characteristic Search with Matsui’s Strategy
- Sponges resist leakage: the case of authenticated encryption
- The SKINNY Family of Block Ciphers and Its Low-Latency Variant MANTIS
- The software performance of authenticated-encryption modes
- Threshold Implementations Against Side-Channel Attacks and Glitches
- Tweaks and Keys for Block Ciphers: The TWEAKEY Framework
- Uniform first-order threshold implementations
- \textsf{TEDT2} -- highly secure leakage-resilient TBC-based authenticated encryption
- Blockcipher-based authenticated encryption: how small can we go?
- Finding the impossible: automated search for full impossible-differential, zero-correlation, and integral attacks
- Secret can be public: low-memory AEAD mode for high-order masking
- Mind the \texttt{TWEAKEY} schedule: cryptanalysis on \texttt{SKINNYe-64-256}
- Double-block-length hash function for minimum memory size
- On the security of triplex- and multiplex-type constructions with smaller tweaks
- Optimizing key recovery in impossible cryptanalysis and its automated tool
- Towards optimally secure deterministic authenticated encryption schemes
- Generalized impossible differential attacks on block ciphers: application to SKINNY and ForkSKINNY
- Generic differential key recovery attacks and beyond
- A long tweak goes a long way: high multi-user security authenticated encryption from tweakable block ciphers
This page was built for publication: Lightweight authenticated encryption mode suitable for threshold implementation
Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q2119030)
