Session E1: Hardening Crypto CCS’17, October 30-November 3, 2017, Dallas, TX, USA Beer Bounds for Block Cipher Modes of Operation via Nonce-Based Key Derivation Shay Gueron Yehuda Lindell University of Haifa and Amazon Web Services Bar-Ilan University [email protected] [email protected] ABSTRACT block size of 3DES is 64 bits, and thus collisions occur at just 232 Block cipher modes of operation provide a way to securely en- blocks, or 32GB of data, which can be transferred in under an hour crypt using a block cipher. The main factors in analyzing modes on a fast Internet connection, and in seconds within a data center. of operation are the level of security achieved (chosen-plaintext At rst sight, this problem of birthday collisions is a problem security, authenticated encryption, nonce-misuse resistance, and that is only of relevance for 3DES. Modern block ciphers, like AES, 64 so on) and performance. When measuring the security level of a have a block size of 128, and the birthday bound is thus 2 , which mode of operation, it does not suce to consider asymptotics, and corresponds to a whopping 1 million Petabytes of data. However, a concrete analysis is necessary. This is especially the case today, in reality, birthday collisions are a concern, even for AES or other when encryption rates can be very high, and so birthday bounds 128-bit block ciphers. This is because the standard NIST recom- may be approached or even reached. mendation is to stop using a key when the probability of some −32 48 In this paper, we show that key-derivation at every encryp- leakage exceeds 2 . Thus, after encrypting 2 blocks, keys must tion signicantly improves the security bounds in many cases. We be changed. Furthermore, in many popular modes of operation, present a new key-derivation method that utilizes a truncated block birthday bounds are actually reached far earlier. Two important cipher, and show that this is far better than standard block-cipher examples are counter (CTR) mode and AES-GCM, when using ran- based key derivation. We prove that by using our key derivation dom IVs. In both of these case, the standard implementation used a −32 method, we obtain greatly improved bounds for many modes of 96-bit IV, and thus collisions occur in the IV with probability 2 32 operation, with a result that the lifetime of a key can be signicantly after encrypting only 2 dierent messages (with fresh random extended. We demonstrate this for AES-CTR (CPA-security), AES- IVs). Therefore, the number of messages that can be encrypted with GCM (authenticated encryption) and AES-GCM-SIV (nonce-misuse a single key is actually quite low. resistance). Finally, we demonstrate that when using modern hard- A real example – QUIC. QUIC [19] is a new transport protocol ware with AES instructions (AES-NI), the performance penalty of that is designed to improve the performance of connection-oriented deriving keys at each encryption is insignicant for most uses. web applications that are currently using TCP, while providing 1 INTRODUCTION security protection that is comparable to that of TLS. QUIC encrypts “source-address tokens”, with the property that a cluster of servers Block ciphers are a basic building block in encryption. Modes of can recognize them in the future, but without clients being able operation are ways of using block ciphers in order to obtain se- to forge them. Simply adding a MAC would suce, but for future- cure encryption, and have been studied for decades. Nevertheless, proong they should also be condential. All servers can share a new computing settings and threats make the design of new and fairly long-lived secret key, but the servers need to be able to create better modes of operation a very active eld of research. For just these tokens quickly, and independently. Since a central allocation one example, the construction of nonce-misuse resistant modes system for nonces is not operationally viable, random selection of operation, that remain secure even if a nonce repeats, is one of nonces is the only possibility. AES-GCM’s limit of 232 random consideration in the recent CAESAR competition. nonces (per key) suggests that, even if the system rotates these One issue that has recently become a concern is the block size secret keys daily, it could not issue more than about 50K tokens per of block ciphers and the ramication that this has on security. second. However, in order to process DDoS attacks the system may Specically, when a block cipher with block size n is used to encrypt need to be able to issue hundreds of millions of tokens per second. n=2 2 blocks, then birthday collisions occur with high probability, A similar problem arises in TLS with session tickets [2]. Although potentially resulting in a security breach. Although the threat due the demands are signicantly reduced in this context, a limit of 50K to such collisions is often thought to be theoretical in nature, it was tickets per second is still insucient for many sites, and thus plain recently shown that real attacks can be carried out when 3DES is AES-GCM is unsuitable for this as well. used in TLS, because of the small block size [5]. Specically, the Permission to make digital or hard copies of all or part of this work for personal or 1.1 Our Results classroom use is granted without fee provided that copies are not made or distributed for prot or commercial advantage and that copies bear this notice and the full citation We introduce a generic technique for signicantly extending the life- on the rst page. Copyrights for components of this work owned by others than ACM time of a key. The idea is very simple: rst derive a per-message key must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specic permission and/or a by applying a key-derivation function with the master-key and nonce, fee. Request permissions from [email protected]. and then use the per-message key to encrypt the message. Intuitively, CCS’17, Oct. 30–Nov. 3, 2017, Dallas, TX, USA. this ensures that no single key is used too much, and so many more © 2017 ACM. 978-1-4503-4946-8/17/10...$15.00 DOI: 10.1145/3133956.3133992 blocks can be encrypted. Furthermore, it requires only minimal 1019 Session E1: Hardening Crypto CCS’17, October 30-November 3, 2017, Dallas, TX, USA changes to existing schemes, which is important for deployment. we achieve to the bounds of the basic modes without key generation, However, implementing this idea has two major challenges: and show that the lifetime of keys can be greatly extended using (1) On the one hand, key derivation based on a hash function would our technique. To illustrate this, with a standard 96-bit nonce, AES- yield good bounds but is very slow. On the other hand, stan- CTR and AES-GCM can be used to encrypt at most 248 blocks (e.g., dard key derivation based on AES in counter mode yields poor 232 messages of length 216 each), while keeping the adversarial bounds. In particular, collisions would occur with probability advantage below 2−32. In contrast, using our key derivation, the 2−32 after 248 derivations. same modes can be used to encrypt 264 messages of length 216 each, (2) Even if one were to overcome the key derivation bound using a with an adversarial advantage of at most 2−32. block cipher, this would require running an AES key expansion Encryption with a nonce vs a random IV. Throughout this paper, for every message. Standard methods of key expansion, e.g., we refer to a nonce as a non-repeating value that is unique but not aeskeygenassist using the AES-NI instruction, are very slow. necessarily random. This is in contrast to an IV that is considered We address the above challenges and show how to use continual random. It is well known that for modes of operation for which key derivation in an ecient way, and with very good bounds. nonce uniqueness suces (like CTR), if nonce uniqueness can be guaranteed, then this is preferable to choosing a random IV. This Continual key derivation. We indeed use AES-based key deriva- is because random IVs collide at the birthday bound, and possibly tion. However, in contrast to the standard counter-mode based key earlier if the device encrypting has poor entropy. It is interesting to derivation [4], we use a truncated block cipher. For example, in note that our key-derivation method does not increase the number order to derive a 128-bit key, two AES encryptions are computed of messages that one can encrypt, when a random IV is used. This and the key is taken to be the concatenation of the rst half of each is due to the fact that IV collisions still happen with the same output block; likewise, to derive a 256-bit key, four AES encryptions probability, and when they collide the same key and nonce is used are used. The reason that this key derivation is preferable is due even with key derivation. Nevertheless, in these cases, our method to the fact that the “best” key derivation utilizes a pseudorandom does enable one to encrypt longer messages (and so overall many function, whereas block ciphers are pseudorandom permutations. more blocks). However, in the unique nonce setting, where we Thus, as the number of derivations approaches the birthday bound, assume that the parties can guarantee uniqueness (e.g., by keeping the keys derived can no longer be assumed to be random.