Parallelizable Encryption Mode With

Parallelizable Encryption Mo de with Almost Free Message Integrity Charanjit S. Jutla IBM T. J. Watson Research Center, Yorktown Heights, NY 10598-704 1 Intro duction In this do cument we prop ose a new mo de of op eration for symmetric key blo ck cipher algorithms. The main feature distinguishing the prop osed mo de from existing mo des is that along with providing confdentiality of the message, it also provides message integrity. In other words, the new mo de is not just a mo de of op eration for encryption, but a mo de of op eration for authenticated encryption. As the title of the do cument suggests, the new mo de achieves the additional prop erty with little extra overhead, as will b e explained b elow. The new mo de is also highly parallelizable. In fact, it has critical path of only two blo ck cipher invocations. By one estimate, a hardware implementation of this mo de on a single b oard (housing 1000 blo ck cipher units) achieves terabits/sec 12 (10 bits/sec) of authenticated encryption. Moreover, there is no p enalty for doing a serial implementation of this mo de. The new mo de also comes with pro ofs of security, assuming that the underlying blo ck ciphers are secure. For confdentiality, the mo de achieves the same provable security b ound as CBC. For authentication, the mo de achieves the same provable security b ound as CBC-MAC. The new parallelizable mo de removes chaining from the well known CBC mo de, and instead do es an input whitening (as well an output whitening) with a pairwise indep endent sequence. Thus, it b ecomes similar to the ECB mo de. However, with the input whitening with the pairwise indep endent sequence the new mo de has provable security similar to CBC (Note: ECB do es not have security guarantees like CBC). Also, the output whitening with the pairwise indep endent sequence guarantees message integrity. The pairwise indep endent sequence can b e generated with little overhead. In fact, the input and output whitening sequence need only b e pairwise diferentially uniform, which is a weaker prop erty than pairwise indep endence, as explained in the details b elow. The weaker pairwise diferentially uniform sequence can b e generated with even lesser overhead. The parallelizable mo de comes in two favors. These favors refer to how the pairwise diferentially uniform sequence is generated. In one mo de, we just use a pairwise indep endent sequence generated by a subset construction. In another mo de, the pairwise diferentially uniform sequence is generated by (a * i) mo dulo a fxed prime numb er. There will b e one standard prime numb er for each bit-size 64 blo ck cipher. Thus, for 64 bit blo ck ciphers the prime could b e 2 ; 257. For 128 128 bit blo ck ciphers, the prime could b e 2 ; 159. The mo des are describ ed b elow in more detail. We frst give defnitions of pairwise indep endence and related concepts. Then we describ e the parallelizable mo de using the algebraic construction a * i mo dulo a fxed prime. Next, we describ e the mo de using only exclusive-or op erations. In section 5, the diferent notions of security are defned. In section 6, we prove that the IAPM construction is secure for message integrity. We frst start by proving the theorem for the construction in Fig 2 with t=1. In section 6.1 we give an alternative pro of of this theorem inspired by Johan Haastad. In section 6.2 we extend the pro of to arbitrary t. Then, in section 6.3 we prove the theorem for the construction in Fig 1, i.e.the IAPM mo de using GFp. Finally, in section 7 we prove that the IAPM scheme is secure for message secrecy as well. 2 Defnitions Defnition 1 (pair-wise indep endence) A sequence of uniformly distributed n- bit random numbers s , s , :::, s , is called pair-wise independent if for every pair 1 2 m i, j, i 6= j , and every pair of n bit constants c and c , probability that s = c 1 2 i 1 ;2n and s = c is 2 . j 2 Defnition 2 (pair-wise diferentially-uniform) A sequence of uniformly distributed n-bit random numb ers s , s , :::, s , is called pair-wise diferentially- 1 2 m uniform if for every pair i, j, i 6= j , and every n bit constant c, probability that ;n s E s is c is 2 . i j It is a fact that a pair-wise indep endent uniformly distributed sequence is also pair-wise diferentially uniform. Defnition 3 (pair-wise diferentially-uniform in GFp) A sequence of random numb ers s , s , :::, s uniformly distributed in GFp, is called pair-wise diferentially- 1 2 m uniform in GFp if for every pair i, j, i 6= j , and every constant c in GFp, probability that (s ; s ) mo d p is c is 1/p. i j A sequence of m pair-wise indep endent numbers can b e generated from ab out log m indep endent random numb ers by a subset construction. The subset construction only involves exclusive-or op erations. A pair-wise indep endent sequence can also b e generated by an algebraic construction in GFp, by using two indep endent random numb ers a and b in GFp. The sequence is given by s = (a + i * b) mo d p. i A pair-wise diferentially uniform in GFp sequence can b e generated from only a single random numb er a in GFp by defning s = (i * a) mo d p. i 3 Integrity Aware Parallelizable Mo de (IAPM) using a prime numb er Let n b e the blo ck size of the underlying blo ck cipher. We will restrict our attention to n = 128 in this pap er. If the blo ck cipher requires keys of length k , then this mo de requires two indep endent keys of length k . Let these keys b e called K 0 and K 1. From now on, we will use f to denote the encryption K function under key K . The message to b e encrypted P , is divided into blo cks of length n each. Let these blo cks b e P , P , :::, P . As in CBC, a random initial vector r of length n 1 2 m;1 bits is chosen. The vector r need not b e chosen randomly, as long as it is unique for each message. This random vector is used to generate a new random vector a using the blo ck cipher and key K0, which in turn is used to prepare m + 1 new pairwise diferentially uniform vectors S , S , :::, S . 0 1 m 128 Let p = 2 ; 159. The numb er p is known to b e a prime. This prime will b e fxed for all invocations of this mo de using blo ck ciphers of blo ck size 128 bit. 64 For 64-bit ciphers p = 2 ; 257 is recommended. Now, the sequence S , S , :::S is generated by the following pro cedure: m 0 1 dif uniform sequence(in r, m, K 0; out S ) procedure pairwise f a = f (r ) K 0 128 128 if (a 2 (2 ; 159)) a = (a + 159) mo d 2 S = a 0 for j = 1 to m do 128 S = (S + a) mo d 2 j j ;1 if (a > S ) S = S + 159 j j j end for g The condition (a > S ) is equivalent to 128-bit integer addition overfow in j 128 the previous step. Note that we do not reduce mo dulo p if (S + a) < 2 , but j ;1 128 we do comp ensate by 159 if (S + a) 2 2 , as in the latter case, (S + a) j ;1 j ;1 128 128 mo d p = S + a ; (2 ; 159) = (S + a ; 2 ) + 159. j ;1 j ;1 In this mo de, the input and output whitening is done by 128-bit integer addition. The ciphertext message C =< C , C , :::, C > is generated as follows (see fg 0 1 m 1): C = r 0 for i = 1 to m ; 1 do 128 M = (P + S ) mo d 2 i i i N = f (M ) i K 1 i 128 C = (N + S ) mo d 2 i i i end for checksum = P E P E ::: E P 1 2 m;1 128 M = (checksum + S ) mo d 2 m m N = f (M ) m K 1 m 128 C = (N + S ) mo d 2 m m 0 Note that for computing the checksum we use xor instead of addition mo dulo 128 128 2 . The scheme is secure even if the checksum is computed by a mo dulo 2 sum, but for the standard we prefer that the checksum b e computed by an xor-sum. Note that S is used in the last step. 0 The ab ove scheme is invertible. The inversion pro cess yields blo cks P , P , :::, P . 1 2 m r P P r 1 2 Pm−1 checksum S S S S 1 2 m−1 m M M M 1 2 m f f f ..... K0 f ff K1 K1 K1 K1 K1 N N N m a 1 2 S S S S 1 2 m−1 0 mod p constr. C C C Cm 0 1 C2 m−1 S S ......

Load more