Encrypted Davies-Meyer and Its Dual: Towards Optimal Security Using Mirror Theory

112 Pages·2017·0.88 MB·English

Encrypted Davies-Meyer and Its Dual:
Towards Optimal Security Using Mirror Theory
Bart Mennink, Samuel Neves
Radboud University (The Netherlands),
University of Coimbra (Portugal)
CRYPTO 2017
August 24, 2017
1/23
Luby-Racko(cid:27) / Feistel
Now
Introduction
PRP PRF
2/23
Now
Introduction
Luby-Racko(cid:27) / Feistel
PRP PRF
2/23
Introduction
Luby-Racko(cid:27) / Feistel
PRP PRF
Now
2/23
Xor of Single Permutation
p
0(cid:107)·
x p y
1(cid:107)·
• Single permutation using domain separation
Xor of Permutations
Xor of Permutations
p
1
x p y
2
• First suggested by Bellare et al. [BKR98]
• Secure up to 2n queries [BI99,Luc00,Pat08]
• Application: CENC, SCT
3/23
Xor of Permutations
Xor of Permutations Xor of Single Permutation
p p
1 0(cid:107)·
x p y x p y
2 1(cid:107)·
• First suggested by Bellare et al. [BKR98]
• Secure up to 2n queries [BI99,Luc00,Pat08]
• Application: CENC, SCT
• Single permutation using domain separation
3/23
EWCDM
ν p1 p2 t
h(m)
• Message authentication using EWCDM
Encrypted (Wegman-Carter) Davies-Meyer
EDM
x p p y
1 2
• By Cogliati and Seurin [CS16]
• Secure up to 22n/3 queries
• Conjecture: optimal 2n security
4/23
Encrypted (Wegman-Carter) Davies-Meyer
EDM EWCDM
x p1 p2 y ν p1 p2 t
h(m)
• By Cogliati and Seurin [CS16]
• Secure up to 22n/3 queries
• Conjecture: optimal 2n security
• Message authentication using EWCDM
4/23
EDMD
x p p y
1 2
→
−
−
−−
Earlierproposal
EWCDMDremovedafter
observationbyNandi
EDMD (cid:22)(cid:22) 2n
Backbone of analysis: mirror theory
Our Contribution
EDM and EWCDM (dashed)
x p p y
1 2
h(m)
scheme [CS16] now
EDM 22n/3 2n/n
EWCDM 22n/3 2n/n
5/23
→
−
−
−−
Earlierproposal
EWCDMDremovedafter
observationbyNandi
Backbone of analysis: mirror theory
Our Contribution
EDM and EWCDM (dashed) EDMD
x p p y x p p y
1 2 1 2
h(m)
scheme [CS16] now
EDM 22n/3 2n/n
EWCDM 22n/3 2n/n
EDMD (cid:22)(cid:22) 2n
5/23