< Terug naar vorige pagina

Publicatie

Beyond Conventional Security in Sponge-Based Authenticated Encryption Modes

Tijdschriftbijdrage - Tijdschriftartikel

© 2018 The Author(s) The Sponge function is known to achieve (Formula presented.) security, where c is its capacity. This bound was carried over to its keyed variants, such as SpongeWrap, to achieve a (Formula presented.) security bound, with (Formula presented.) the key length. Similarly, many CAESAR competition submissions were designed to comply with the classical (Formula presented.) security bound. We show that Sponge-based constructions for authenticated encryption can achieve the significantly higher bound of (Formula presented.), with (Formula presented.) the permutation size, by proving that the CAESAR submission NORX achieves this bound. The proof relies on rigorous computation of multi-collision probabilities, which may be of independent interest. We additionally derive a generic attack based on multi-collisions that matches the bound. We show how to apply the proof to five other Sponge-based CAESAR submissions: Ascon, CBEAM/STRIBOB, ICEPOLE, Keyak, and two out of the three PRIMATEs. A direct application of the result shows that the parameter choices of some of these submissions are overly conservative. Simple tweaks render the schemes considerably more efficient without sacrificing security. We finally consider the remaining one of the three PRIMATEs, APE, and derive a blockwise adaptive attack in the nonce-respecting setting with complexity (Formula presented.), therewith demonstrating that the techniques cannot be applied to APE.
Tijdschrift: Journal of Cryptology
ISSN: 0933-2790
Issue: 3
Volume: 32
Pagina's: 895 - 940
Jaar van publicatie:2019