Masaryk University Faculty of Informatics Optimizing authenticated encryption algorithms Master’s Thesis Ondrej Mosnáček Brno, Fall 2017 Masaryk University Faculty of Informatics Optimizing authenticated encryption algorithms Master’s Thesis Ondrej Mosnáček Brno, Fall 2017 This is where a copy of the official signed thesis assignment and a copy ofthe Statement of an Author is located in the printed version of the document. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out on my own. All sources, references, and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Ondrej Mosnáček Advisor: Ing. Milan Brož i Acknowledgement I would like to thank my advisor, Milan Brož, for his guidance, pa- tience, and helpful feedback and advice. Also, I would like to thank my girlfriend Ludmila, my family, and my friends for their support and kind words of encouragement. If I had more time, I would have written a shorter letter. — Blaise Pascal iii Abstract In this thesis, we look at authenticated encryption with associated data (AEAD), which is a cryptographic scheme that provides both confidentiality and integrity of messages within a single operation. We look at various existing and proposed AEAD algorithms and compare them both in terms of security and performance. We take a closer look at three selected candidate families of algorithms from the CAESAR competition. Then we discuss common facilities provided by the two most com- mon CPU architectures – x86 and ARM – that can be used to implement cryptographic algorithms efficiently. Finally, we introduce our con- tribution of implementing the selected CAESAR candidates for the Linux kernel Crypto API. iv Keywords authenticated encryption, AEAD, CAESAR, GCM, Linux, cryptogra- phy, optimization, assembly, MORUS, AEGIS, OCB, AES-NI, SSE2, AVX2 v Contents 1 Introduction1 1.1 Goals .............................2 1.2 Chapter contents .......................2 2 Authenticated encryption3 2.1 Properties ...........................5 2.2 Generic composition .....................7 2.2.1 Encrypt-then-MAC.................8 2.2.2 Encrypt-and-MAC.................9 2.2.3 MAC-then-Encrypt.................9 2.2.4 Properties of generic composition........ 10 2.3 GCM ............................. 10 2.3.1 Properties...................... 13 2.4 ChaCha20-Poly1305 ..................... 14 2.4.1 Properties...................... 16 2.5 CCM ............................. 17 2.5.1 Properties...................... 18 2.6 SIV .............................. 19 2.6.1 Properties...................... 20 2.7 GCM-SIV ........................... 21 2.7.1 Properties...................... 22 3 CAESAR competition 25 3.1 What is CAESAR? ...................... 25 3.2 Third round candidates .................... 26 3.3 MORUS ............................ 28 3.3.1 Operation...................... 29 3.3.2 Properties...................... 30 3.4 AEGIS ............................. 31 3.4.1 Operation...................... 31 3.4.2 Properties...................... 32 3.5 OCB .............................. 33 3.5.1 Operation...................... 34 3.5.2 Properties...................... 35 3.6 Comparison .......................... 36 vii 4 Linux Kernel Crypto API 39 4.1 Architecture .......................... 40 4.1.1 Cipher and driver names............. 40 4.1.2 Templates...................... 40 4.1.3 Synchronous and asynchronous operations... 40 4.1.4 Priorities....................... 40 4.1.5 Input parameter sizes............... 41 4.1.6 Scatter-gather lists................. 41 4.2 AEAD interface ........................ 42 4.2.1 Input/output data layout............. 42 4.2.2 For users....................... 42 4.2.3 For implementations................ 44 5 Software optimization of cryptographic algorithms 47 5.1 Intel/AMD (x86 architecture) ................ 48 5.1.1 SSE, AVX....................... 48 5.1.2 AES-NI........................ 49 5.1.3 SHA extensions................... 50 5.1.4 CLMUL....................... 50 5.2 ARM ............................. 50 6 Implementation of selected CAESAR candidates 51 6.1 Contents of the attached source code ............. 51 6.1.1 Implementation limitations............ 53 6.1.2 Merging into the upstream Linux repository.. 54 6.2 Performance measurements .................. 54 6.2.1 Direct speed comparison.............. 55 6.2.2 Comparison of Dm-crypt performance..... 56 6.2.3 Summary of results................. 58 7 Conclusion 59 7.1 Contribution ......................... 59 7.2 Future work .......................... 60 Bibliography 61 viii 1 Introduction When cryptographically protecting data, we often use encryption to ensure confidentiality of the payload, which means that only authorized parties are able to read it [57, 27]. However, in practice, confidentiality alone is not sufficient to protect users from certain attacks. For example, when sending an encrypted message over the net- work, an attacker might be able to (depending on the encryption method used) modify the message in such a way that the decrypted message is still meaningful but different and the receiver is unable to detect the malicious modification. In order to protect from similar attacks, it is necessary to use addi- tional cryptographic mechanisms that achieve integrity of the payload, which means that unauthorized parties cannot modify the payload without detection. When one aims to achieve both confidentiality and integrity of data, there are generally two possible approaches: 1. To use a traditional stream cipher to achieve confidentiality and to ensure integrity in some other way, e.g. using message authentication code (MAC) or digital signature. 2. To use a dedicated scheme for authenticated encryption with as- sociated data (AEAD), which provides both confidentiality and integrity in a single package. Since authenticated encryption is needed in many applications, especially in network protocols/applications and file encryption, it is a frequent target of research in cryptography. Since the introduction of the concept in 2000 [39], there have been many proposed schemes for authenticated encryption. However, the most widely adopted al- gorithm – AES-GCM1 – has several drawbacks and there is generally a lack of consensus on the best alternative. This situation has motivated the initiation of the CAESAR competi- tion, which is an open competition with the goal of selecting a portfolio of the best authenticated encryption schemes in terms of security and both hardware and software performance. 1. AES-GCM = Advanced Encryption Standard in Galois-Counter Mode 1 1. Introduction 1.1 Goals The goals of this thesis are: 1. to compare some of the existing and proposed AEAD algo- rithms in terms of security and performance, 2. to produce implementations of selected CAESAR competition candidates for the Linux kernel cryptographic subsystem, 3. and to perform and analyze performance measurements of these implementations. 1.2 Chapter contents The thesis consists of seven chapters. The first chapter is the introduction. In the second chapter wede- fine authenticated encryption and describe some of the most common existing AEAD algorithms and modes. In the third chapter we intro- duce the CAESAR competition, shortly characterize the third-round candidates, and select three candidates that we describe in more detail. In the fourth chapter we shortly describe the Linux kernel Crypto API with focus on its AEAD interface. In the fifth chapter we discuss the possibilities of software optimization of cryptographic algorithms with focus on the x86 and ARM architectures. In the sixth chapter we describe implementations of the three se- lected CAESAR candidates that we developed as part of the thesis, targeting the Linux kernel Crypto API. At the end of this chapter we provide and analyze performance measurements of our implementa- tions. The seventh chapter contains the conclusion. 2 2 Authenticated encryption Authenticated encryption (also referred to as authenticated encryption with additional data – AEAD) in practice uses symmetric-key cryptogra- phy and is usually based on a stream cipher and a message authen- tication code (MAC), even though the computation of both is often merged into a single operation. Encryption using an AEAD scheme takes the following inputs: ∙ a symmetric key (K) of some fixed size, ∙ a nonce (N) of some fixed size1, ∙ an optional stream of associated data (A) that is only authenti- cated, not encrypted, ∙ the message plaintext (P) of any length (subject to some practical constraints), which is both authenticated and encrypted. The output of the AEAD encryption process is the encrypted mes- sage ciphertext (C) and a fixed-size authentication tag (T), which carries the information needed to verify the authenticity of the message and associated data. We will denote AEAD encryption as follows: (C, T) = AEAD-EK(N, A, P) 1. In some cases the nonce size can be variable or configurable. Nonce AD Plaintext Key AEAD-E Ciphertext Tag Figure 2.1: AEAD encryption diagram 3 2. Authenticated encryption Nonce AD Ciphertext Tag Key AEAD-D Plaintext Verification OK? Figure 2.2: AEAD decryption diagram Some AEAD schemes can also produce a truncated authentication tag which is shorter but provides smaller guarantee against message forgery. The decryption process takes the following inputs: ∙ the key (K) as used when encrypting, ∙ the nonce (N) as used when encrypting, ∙ an optional stream of associated