Evaluation of Some Blockcipher Modes of Operation Phillip Rogaway University of California, Davis Dept. of Computer Science Davis, California, USA E-mail: [email protected] URL: http://www.cs.ucdavis.edu/∼rogaway February 10, 2011 Evaluation carried out for the Cryptography Research and Evaluation Committees (CRYPTREC) for the Government of Japan ii Contents 1. Summary .......................................... 1 2. Preliminaries ....................................... 10 I Confidentiality Modes 15 3. ECB Mode ......................................... 24 4. CBC, CFB, and OFB Modes ............................. 30 5. CTR Mode ......................................... 45 6. XTS Mode ......................................... 53 II Authenticity Modes 66 7. CBC-MAC Algorithms 1–6 .............................. 72 8. CMAC Mode ....................................... 92 9. HMAC Mode ....................................... 97 10. GMAC Mode .......................................106 III Authenticated-Encryption Modes 112 11. CCM Mode ........................................117 12. Galois/Counter Mode ..................................125 Bibliography 138 End ................................................153 iii iv Acknowledgments Many thanks to Mihir Bellare for his drafting the chapter on HMAC. We also corresponded on other random matters that came up as I carried out this study. More broadly, many of the viewpoints embodied in this evaluation were co-developed with Mihir over a great many years. I received numerous insightful and useful comments, corrections, and answers to questions from colleagues Morris Dworkin, Niels Ferguson, Shai Halevi, Viet Tung Hoang, Ted Krovetz, David McGrew, Chanathip Namprempre, Bart Preneel,andKan Yasuda. My heartfelt thanks to everyone named for all your time and kind assistance. The work of this report was supported by the Cryptography Research and Evaluation Com- mittees (CRYPTREC), Japan. My contacts at the Mitsubishi Research Institute have included Dai Mochinaga, Miyako Ohkubo,andSachiko Yamada. Thanks for arranging contract formalities, answering questions, and providing documentation. I hope my report will serve your needs well. Phillip Rogaway February 2011 v vi Chapter 1 Summary 1.1. Overview. This report analyzes the security of some 17 cryptographic modes of operation described within some eight U.S. or international standards. Most of the schemes are well- known; many are widely used. The modes under consideration are the encryption schemes ECB, CBC, CFB, OFB, CTR, and XTS; the message authentication codes CMAC, HMAC, GMAC, and MAC Algorithms 1–6 of ISO 9797-1:1999; and the authenticated-encryption schemes CCM and GCM. The containing standards are FIPS 198-1, ISO/IEC 9797-1:1999, NIST SP 800-38A, NIST SP 800-38B, NIST SP 800-38C, NIST SP 800-38D, NIST SP 800-38E, and by reference from the last standard, IEEE 1619-2007 [61–65, 90, 91, 159]. Despite the modes being standardized and well-known, the quality varies. Some schemes are quite sensible and modern, while the value of others seems to be mostly in their legacy significance, or as building blocks for other schemes. In many cases it is unclear, to me, if a mode “ought” to be included in the CRYPTREC portfolio; the problem is that some well-entrenched schemes are, in fact, rather poor and dated designs. Correspondingly, I take my main goal as the description of what is known about each scheme, rather than an explication of what I think “should” be done. Still, I sometimes do offer opinions. I have tried to avoid being overly technical in these pages. The scope is too large, and the schemes too well-studied, for it to make sense to try to write up fresh proofs for everything. Doing so would easily turn this already-long manuscript into a book-length treatment. Instead, I have tried to explain the various results, point the reader to the relevant literature, and explain how, I think, the results should be interpreted. I divide the modes into three categories: (I) confidentiality modes, (II) authenticity modes, and (III) authenticated-encryption modes. See Figure 1.1. When I contracted for this project, CRYPTREC organized matters differently: eight techniques partitioned into two categories, named “modes of operation” and “message authentication codes.” I would like to clarify that all the schemes of this report can be viewed as modes of operation. 1.2. Evaluative approach. I have tried to instill a degree of uniformity in the evaluative process. I will, for each mode, be answering some or all of the following questions 1.2.1 What cryptographic problem does the mode try to solve? Problem identification is crucial, yet often ignored. A definition is sought, in the tradition of provable-security cryptography. Sometimes problem identification is trivial; we know, for example, that CCM is supposed to be a nonce-based authenticated-encryption scheme because the 1 1. Summary 2. Preliminaries Part III. Part I. Part II. Authenticated Confidentiality Authenticity Encryption 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. ECB CBC, CFB, OFB CTR XTS CBC-MACs CMAC HMAC GMAC CCM GCM blockcipher IV-based encryption schemes Conventional MACs nonce-based MAC nonce-based AEAD schemes Figure 1.1: Roadmap. The chart shows organization and logical dependencies among the chapters and parts of this documents. designers said this, and because the mode springs from that tradition. But what is the cryptographic problem a mode like ECB or XTS is supposed to solve? This is a less trivial question, and sometimes one that cannot be as definitively answered. Modes are often designed to achieve many aims, not all of them clear, formalized, or well understood. 1.2.2 What does the apparatus of provable security have to say about the mode’s security? Can one establish that the mode does its now-identified job under well-believed crypto- graphic assumptions? If so, under what assumptions? For blockcipher-based schemes, the preferred assumption is security as a pseudorandom-permutation (PRP). How tight are the reductions to breaking the underlying PRP? 1.2.3 What attacks are known against the scheme? Is there a quantitative gap between the known attacks and the proven bounds? Does the gap matter? 1.2.4 How efficient is the scheme? There are multiple characteristics that can matter for efficiency, and the relevant ones depend on that scheme’s goal. 1.2.5 How widely-used is the scheme already? If a mode has a long history or is extensively deployed, this alone can be a reason for standardization, other problems with the scheme notwithstanding. 1.2.6 How simple is the scheme? Good modes of operation are pretty things, elegant and minimal for accomplishing their aims. 1.2.7 How robust is the scheme against misuse? If one can expect that a scheme will rou- tinely be misused—used in ways contrary to what is required of the mode or guaranteed by the mode—this is certainly a problem. 1.2.8 How well understood is the scheme? Has the mechanism been widely studied? Have the important questions been answered, or do there remain important gaps in what we know? 1.2.9 How good is the specification document that describes the mode? While some might claim that a mechanism transcends the virtues or failings of its description, I believe the opposite, that the quality of the specification is part and parcel of the quality of the 2 scheme. For one thing, the specification document impacts the likelihood of a scheme being correctly or incorrectly used. Another aspect of this report is the simple fact of organizing this menagerie of modes in some coherent way. The taxonomy of Figure 1.1 was not the only possible approach. 1.3. The positive role of the standards bodies. This report takes a fresh look at eight different standards—six from NIST and one each from the IEEE and ISO/IEC. Overall, the assessment I will give may sound fairly critical about this body of work. This does not repre- sent my actual view. Quite the opposite; the modes are, collectively, quite good, and NIST, in particular, has shown commendable leadership in their work on standardizing (or “recommend- ing”) modes of operation. If it was once true that, in cryptography, each standards body liked to wait around for the other to act, this most definitely is not the case today. Some of the negativism one will see in this report may be a bit half-hearted and pro forma: academics are supposed to be critical of what we review; it is wired in our brains. Any piece of completed work could have been better done, and a critique should bring out these shortcomings. A negative-sounding critique should not be understood as an overall negative opinion of a standard or a mode contained therein; it is par for the course. More concretely, I would make the following comments to help balance the possibly negative- sounding tenor of this report. First, that all of the modes embodied in FIPS 198-1 and NIST Recommendations SP 800-38B (CMAC), SP 800-38C (CCM), SP 800-38D (GCM), and SP 800- 38E—standards for HMAC, CMAC, CCM, GCM, and XTS, respectively—owe their existence to the provable-security tradition. In standardizing this set of techniques, NIST has ushered in a new age in symmetric cryptography, one where everything “above” the level of a blockcipher (or hash function or compression function) is designed using, and proven with, the provable- security chest of tools and ideas. Recommendation SP 800-38A, while not standardizing any fundamentally new technique, expanded the repertoire of sanctioned modes by including a method—CTR mode—that gains its importance equally