Jovanovic, Philipp; Luykx, Atul; Mennink, Bart; Sasaki, Yu; Yasuda, Kan; (2023) Beyond conventional security in sponge-based authenticated encryption modes. Journal of Cryptology , 32 pp. 895-940. 10.1007/s00145-018-9299-7.

Preview

Text Beyond Conventional Security in Sponge-Based Authenticated Encryption Modes.pdf - Other Download (1MB) | Preview

Abstract

The Sponge function is known to achieve 2c/2 security, where c is its capacity. This bound was carried over to its keyed variants, such as SpongeWrap, to achieve a min{2c/2, 2κ } security bound, with κ the key length. Similarly, many CAESAR competition submissions were designed to comply with the classical 2c/2 security bound. We show that Sponge-based constructions for authenticated encryption can achieve the significantly higher bound of min{2b/2, 2c, 2κ }, with b > c the permutation size, by proving that the CAESAR submission NORX achieves this bound. The proof relies on rigorous computation of multi-collision probabilities, which may be of independent interest. We additionally derive a generic attack based on multi-collisions that matches the bound. We show how to apply the proof to five other Sponge-based CAESAR submissions: Ascon, CBEAM/STRIBOB, ICEPOLE, Keyak, and two out of the three PRIMATEs. A direct application of the result shows that the parameter choices of some of these submissions are overly conservative. Simple tweaks render the schemes considerably more efficient without sacrificing security. We finally consider the remaining one of the three PRIMATEs, APE, and derive a blockwise adaptive attack in the noncerespecting setting with complexity 2c/2, therewith demonstrating that the techniques cannot be applied to APE.

Download activity - last month

Export as JSONXMLCSV

Download activity - last 12 months

Export as JSONCSVXML

Downloads by country - last 12 months

Export as XMLCSVJSON

Archive Staff Only

View Item