DOCSLIB.ORG

A Advanced Encryption Standard See AES AES 35–64 AES Process And

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Index A DFC and DFC v2 196, 199 E2 196 Advanced Encryption Standard see AES FEAL and FEAL-NX 194, 198, 202–203 AES 35–64 FOX 199 AES process and finalists 196 FROG 196 algebraic attack 60 GOST 194 bottleneck attack 58 Grand Cru 198 key schedule 45, 178 Hasty Pudding Cipher 196 related-key attack 62 Hierocrypt-L1 and Hierocrypt-3 198 s-box 44, 50, 191 Hight 200 side-channel cryptanalysis 63 ICE 195 square attack 55 IDEA 194, 198, 205–207 algebraic attack see AES KASUMI 178, 185, 207–212 amplified boomerang attack see differential KFC 199 cryptanalysis Khazad 198 authenticated encryption 82–85 Khufu and Khafre 194 CCM 83 LION and LIONESS 195 EAX 84 LOKI, LOKI91, and LOKI97 194, 196 Lucifer 13, 194 B Madygra 194 Magenta 196 block cipher MARS 196, 198 3-way 195 mCrypton 200 Akelarre 195 Mercy 199 Anubis 191, 198 MISTY 185, 191, 195, 198, 207 BaseKing 195 MULTI2 194 BEAR 195 Nimbus 198 Blowfish 195 Noekeon 198 Camellia 198 NUSH 198 CAST-128 and CAST-256 195, 196 PES and IPES 194 CIPHERUNICORN-A 198 PRESENT 191, 200, 217–218 CIPHERUNICORN-E 198 Q 198 Clefia 200 RC2 194 Crypton 196 RC5 179, 195, 212–214 CS-Cipher 198 RC6 196, 198 DEAL 179, 196 REDOC II 194 DES-based variants see DES Rijndael see AES, 195 L.R. Knudsen and M.J.B. Robshaw, The Block Cipher Companion, Information Security 221 and Cryptography, DOI 10.1007/978-3-642-17342-4, © Springer-Verlag Berlin Heidelberg 2011 222 Index SAFER and variants 195, 196, 198 boomerang attack 162 SC2000 198 countermeasures 184 SEA 200 definition of difference 145 Serpent 178, 196, 197 difference distribution table 115 SHACAL 93, 198 differential characteristics 116, 146 SHARK 195 differentials 122, 147 Skipjack 214–216 filtering 124, 149 SMS4 199 higher-order differentials 162 SPEED 195 hypothesis of stochastic equivalence 148 SQUARE 195 impossible differentials 152, 159–160 TEA and XTEA 195, 200 miss-in-the-middle 159 Twofish 191, 196, 197 rectangle attack 165 UES 195 right and wrong pairs 148 Wake 195 signal-to-noise ratio 151 XMX 195 structures of texts 153 block cipher topology 181 truncated differentials 154 boomerang attack see differential wrong-key randomisation 150 cryptanalysis differential-linear cryptanalysis 174–175 bottleneck attack see AES diffusion 5 branch number 52 distinguished points see time–memory brute force attack trade-off DES 14, 95 generic 95–108 E true cost 95 exhaustive search see brute force attack C F central limit theorem 170 ciphertext stealing see modes of operation Feistel cipher 14 confusion 5 field arithmetic 37 cryptanalysis data type 8 H resources 9 CRYPTREC 198 hash function 3, 86–93 compression function 87 D Davies-Meyer 87 double block length 90 Data Encryption Standard see DES Hirose 92 DES 13–34, 193 Matyas-Meyer-Oseas 87 brute force attack 14, 95 MDC-2 and MDC-4 90 complementation property 27 Miyaguchi-Preneel 87 DESX 32 rate 89 DESXL 200 SHA-3 92 differential cryptanalysis of 14 single block length 87 GDES 194 higher-order differentials see differential hardware implementation 200 cryptanalysis key schedule 18, 178 hypothesis of stochastic equivalence linear cryptanalysis of 14 differential cryptanalysis 148 RDES 194 linear cryptanalysis 168 s-boxes 22–23 triple-DES 30–32 I weak and semi-weak keys 28 differential cryptanalysis 109–126, 145–165 impossible differentials see differential amplified boomerang attack 164 cryptanalysis Index 223 initial value see modes of operation Moore’s law 95 initialisation value see modes of operation multiple encryption initialisation vector see modes of operation double 103 interpolation attack 177 triple 105 irreducible polynomial 37 N K NESSIE 197 Kerckhoffs’ principle 8 nonce see modes of operation key schedule 7, 178–180 P L partitioning cryptanalysis 173 lightweight block ciphers 199 permutation linear cryptanalysis 127–144, 165–174 as a component 7 bilinear cryptanalysis 174 block cipher 4, 5 complexity of attacks 169 pseudorandom 181 correlation 143 super pseudorandom 182, 183 countermeasures 184 piling-up lemma see linear cryptanalysis hypothesis of stochastic equivalence 168 iterative characteristic 167 R linear approximation table 133 linear characteristic 167 rectangle attack see differential cryptanalysis linear hulls 141, 142, 168 redundancy 5 multiple approximations 172 related-key attack 180 non-linear approximations 174 AES 62 piling-up lemma 133, 139, 140, 143, 166 KASUMI 208 squared correlation 143, 144 triple-DES 180 linear hulls see linear cryptanalysis Luby-Rackoff 181 S M S-boxes 186–191 algebraic degree 188 Markov cipher algebraic normal form 188 differential cryptanalysis 147 IO degree 188, 190 linear cryptanalysis 168 non-linear degree 188, 189 MDS matrix 52, 53 power mappings 187, 191 meet-in-the-middle attack 103–108 strict avalanche criterion 187 double encryption 103 signal-to-noise ratio see differential three-key triple encryption 107 cryptanalysis two-key triple encryption 105 slide attack 180 message authentication codes 3, 77–82 SP-network 7 CBC-MAC 78 square attack see AES OMAC 80 stream cipher 3, 69–73 message-digest algorithm see hash function substitution 6 modes of operation 65 cipher block chaining 65, 67 T cipher feedback 65, 69 ciphertext stealing 76 time–memory trade-off 96–103 counter mode 65, 73 distinguished points 100 electronic code book 65, 66 Hellman 96 initial value 74 Oechslin 101 nonce 75, 84 rainbow tables 101 output feedback 65, 70 triple-DES see DES padding 75 truncated differentials see differential modulo n cryptanalysis 174 cryptanalysis References 1. C. M. Adams. Constructing symmetric ciphers using the CAST design procedure. Designs, Codes, and Cryptography, 12(3):283–316, 1997. 2. C. M. Adams and S. E. Tavares. Good S-boxes are easy to find. In G. Brassard, editor, Advances in Cryptology - CRYPTO ’89, volume 435 of Lecture Notes in Computer Science, Springer, pages 612–615, 1990. 3. C. M. Adams and S. E. Tavares. The structured design of cryptographically good S-boxes. J. Cryptology, 3(1):27–41, 1990. 4. W. Aiello and R. Venkatesan. Foiling birthday attacks in length-doubling transformations - Benes: A non-reversible alternative to Feistel. In U. Maurer, editor, Advances in Cryptology - EUROCRYPT ’96, volume 1070 of Lecture Notes in Computer Science, Springer, pages 307–320, 1996. 5. M.-L. Akkar and C. Giraud. An implementation of DES and AES, secure against some attacks. In C¸ .K. Koc¸, D. Naccache and C. Paar, editors, Cryptographic Hardware and Em- bedded Systems - CHES 2001, volume 2162 of Lecture Notes in Computer Science, Springer, 2001, pages 309–318, 2001. 6. M. Albrecht and C. Cid. Algebraic techniques in differential cryptanalysis. In O. Dunkelman, editor, Fast Software Encryption, FSE 2009, volume 5665 of Lecture Notes in Computer Science, Springer, pages 193–208, 2009. 7. American Bankers Association. American national standard - financial institution key man- agement (wholesale), ANSI X9.17. ASC X9 Secretariat, 1985. 8. American Bankers Association. American national standard - financial institution retail mes- sage authentication, ANSI X9.19. ASC X9 Secretariat, 1985. 9. H. Amirazizi and M. E. Hellman. Time-memory-processor trade-offs. IEEE Trans. Informa- tion Theory, 34(3):505–512, May 1988. 10. R. J. Anderson and E. Biham. Two practical and provably secure block ciphers BEAR and LION. In D. Gollmann, editor, Fast Software Encryption, FSE 1996, volume 1039 of Lecture Notes in Computer Science, Springer, pages 113–120, 1996. 11. R. J. Anderson, E. Biham, and L. R. Knudsen. SERPENT - a 128-bit block cipher. A candidate for the Advanced Encryption Standard. Available via www.nist.gov/aes. 12. K. Aoki. On maximum non-averaged differential probability. In S.E. Tavares and H. Mei- jer, editors, Selected Areas in Cryptography, SAC 1998, volume 1556 of Lecture Notes in Computer Science, Springer, pages 118–130, 1999. 13. K. Aoki. Efficient evaluation of security against generalized interpolation attack. In H.M. Heys and C.M. Adams, editors, Selected Areas in Cryptography, SAC 1999, volume 1758 of Lecture Notes in Computer Science, Springer, pages 135–146, 2000. 14. K. Aoki, T. Ichikawa, M. Kanda, M. Matsui, S. Moriai, J. Nakajima, and T. Tokita. Camellia: A 128-bit block cipher suitable for multiple platforms - design and analysis. In D.R. Stin- 225 226 References son and S.E. Tavares, editors, Selected Areas in Cryptography, SAC 2000, volume 2012 of Lecture Notes in Computer Science, Springer, pages 39–56, 2001. 15. K. Aoki, K. Kobayashi, and S. Moriai. Best differential characteristic search of FEAL. In E. Biham, editor, Fast Software Encryption, FSE 1997, volume 1267 of Lecture Notes in Computer Science, Springer, pages 41–53, 1997. 16. K. Aoki and K. Ohta. Differential-linear cryptanalysis of FEAL-8. In IEICE Transactions: Fundamentals of Electronics, Communications, and Computer Sciences (Japan), volume E79-A, 1, pages 20–27, 1996. 17. G. Ars, J.-C. Faugere,´ M. K. Hideki Imai, and M. Sugita. Comparison between XL and Grobner¨ basis algorithms. In P.J. Lee, editor, Advances in Cryptology - ASIACRYPT 2004, volume 3329 of Lecture Notes in Computer Science, Springer, pages 338–353, 2004. 18. J.-P. Aumasson, J. Nakahara, and P. Sepehrdad. Cryptanalysis of the ISDB scrambling al- gorithm (MULTI2). In O. Dunkelman, editor, Fast Software Encryption, FSE 2009, volume 5665 of Lecture Notes in Computer Science, Springer, pages 296–307, 2009. 19. E. S. Ayaz and A. A. Selc¸uk. Improved DST cryptanalysis of IDEA. In E. Biham and A.M. Youssef, editors, Selected Areas in Cryptography, SAC 2006, volume 4356 of Lecture Notes in Computer Science, Springer, pages 1–14, 2007. 20. S. Babbage and L. Frisch. On MISTY1 higher order differential cryptanalysis. In D. Won, editor, 3rd International Conference on Information Security and Cryptology (ICISC 2000), volume 2015 of Lecture Notes in Computer Science, pages 22–36.
Recommended publications
  • The Design of Rijndael: AES - the Advanced Encryption Standard/Joan Daemen, Vincent Rijmen

    The Design of Rijndael: AES - the Advanced Encryption Standard/Joan Daemen, Vincent Rijmen

    Joan Daernen · Vincent Rijrnen Theof Design Rijndael AES - The Advanced Encryption Standard With 48 Figures and 17 Tables Springer Berlin Heidelberg New York Barcelona Hong Kong London Milan Paris Springer TnL-1Jn Joan Daemen Foreword Proton World International (PWI) Zweefvliegtuigstraat 10 1130 Brussels, Belgium Vincent Rijmen Cryptomathic NV Lei Sa 3000 Leuven, Belgium Rijndael was the surprise winner of the contest for the new Advanced En­ cryption Standard (AES) for the United States. This contest was organized and run by the National Institute for Standards and Technology (NIST) be­ ginning in January 1997; Rij ndael was announced as the winner in October 2000. It was the "surprise winner" because many observers (and even some participants) expressed scepticism that the U.S. government would adopt as Library of Congress Cataloging-in-Publication Data an encryption standard any algorithm that was not designed by U.S. citizens. Daemen, Joan, 1965- Yet NIST ran an open, international, selection process that should serve The design of Rijndael: AES - The Advanced Encryption Standard/Joan Daemen, Vincent Rijmen. as model for other standards organizations. For example, NIST held their p.cm. Includes bibliographical references and index. 1999 AES meeting in Rome, Italy. The five finalist algorithms were designed ISBN 3540425802 (alk. paper) . .. by teams from all over the world. 1. Computer security - Passwords. 2. Data encryption (Computer sCIence) I. RIJmen, In the end, the elegance, efficiency, security, and principled design of Vincent, 1970- II. Title Rijndael won the day for its two Belgian designers, Joan Daemen and Vincent QA76.9.A25 D32 2001 Rijmen, over the competing finalist designs from RSA, IBl\!I, Counterpane 2001049851 005.8-dc21 Systems, and an English/Israeli/Danish team.
  • Improved Rectangle Attacks on SKINNY and CRAFT

    Improved Rectangle Attacks on SKINNY and CRAFT

    Improved Rectangle Attacks on SKINNY and CRAFT Hosein Hadipour1, Nasour Bagheri2 and Ling Song3( ) 1 Department of Mathematics and Computer Science, University of Tehran, Tehran, Iran, [email protected] 2 Electrical Engineering Department, Shahid Rajaee Teacher Training University, Tehran, Iran, [email protected] 3 Jinan University, Guangzhou, China [email protected] Abstract. The boomerang and rectangle attacks are adaptions of differential crypt- analysis that regard the target cipher E as a composition of two sub-ciphers, i.e., 2 2 E = E1 ◦ E0, to construct a distinguisher for E with probability p q by concatenat- ing two short differential trails for E0 and E1 with probability p and q respectively. According to the previous research, the dependency between these two differential characteristics has a great impact on the probability of boomerang and rectangle distinguishers. Dunkelman et al. proposed the sandwich attack to formalise such dependency that regards E as three parts, i.e., E = E1 ◦ Em ◦ E0, where Em contains the dependency between two differential trails, satisfying some differential propagation with probability r. Accordingly, the entire probability is p2q2r. Recently, Song et al. have proposed a general framework to identify the actual boundaries of Em and systematically evaluate the probability of Em with any number of rounds, and applied their method to accurately evaluate the probabilities of the best SKINNY’s boomerang distinguishers. In this paper, using a more advanced method to search for boomerang distinguishers, we show that the best previous boomerang distinguishers for SKINNY can be significantly improved in terms of probability and number of rounds.
  • Basic Cryptography

    Basic Cryptography

    Basic cryptography • How cryptography works... • Symmetric cryptography... • Public key cryptography... • Online Resources... • Printed Resources... I VP R 1 © Copyright 2002-2007 Haim Levkowitz How cryptography works • Plaintext • Ciphertext • Cryptographic algorithm • Key Decryption Key Algorithm Plaintext Ciphertext Encryption I VP R 2 © Copyright 2002-2007 Haim Levkowitz Simple cryptosystem ... ! ABCDEFGHIJKLMNOPQRSTUVWXYZ ! DEFGHIJKLMNOPQRSTUVWXYZABC • Caesar Cipher • Simple substitution cipher • ROT-13 • rotate by half the alphabet • A => N B => O I VP R 3 © Copyright 2002-2007 Haim Levkowitz Keys cryptosystems … • keys and keyspace ... • secret-key and public-key ... • key management ... • strength of key systems ... I VP R 4 © Copyright 2002-2007 Haim Levkowitz Keys and keyspace … • ROT: key is N • Brute force: 25 values of N • IDEA (international data encryption algorithm) in PGP: 2128 numeric keys • 1 billion keys / sec ==> >10,781,000,000,000,000,000,000 years I VP R 5 © Copyright 2002-2007 Haim Levkowitz Symmetric cryptography • DES • Triple DES, DESX, GDES, RDES • RC2, RC4, RC5 • IDEA Key • Blowfish Plaintext Encryption Ciphertext Decryption Plaintext Sender Recipient I VP R 6 © Copyright 2002-2007 Haim Levkowitz DES • Data Encryption Standard • US NIST (‘70s) • 56-bit key • Good then • Not enough now (cracked June 1997) • Discrete blocks of 64 bits • Often w/ CBC (cipherblock chaining) • Each blocks encr. depends on contents of previous => detect missing block I VP R 7 © Copyright 2002-2007 Haim Levkowitz Triple DES, DESX,
  • Lecture Note 8 ATTACKS on CRYPTOSYSTEMS I Sourav Mukhopadhyay

    Lecture Note 8 ATTACKS on CRYPTOSYSTEMS I Sourav Mukhopadhyay

    Lecture Note 8 ATTACKS ON CRYPTOSYSTEMS I Sourav Mukhopadhyay Cryptography and Network Security - MA61027 Attacks on Cryptosystems • Up to this point, we have mainly seen how ciphers are implemented. • We have seen how symmetric ciphers such as DES and AES use the idea of substitution and permutation to provide security and also how asymmetric systems such as RSA and Diffie Hellman use other methods. • What we haven’t really looked at are attacks on cryptographic systems. Cryptography and Network Security - MA61027 (Sourav Mukhopadhyay, IIT-KGP, 2010) 1 • An understanding of certain attacks will help you to understand the reasons behind the structure of certain algorithms (such as Rijndael) as they are designed to thwart known attacks. • Although we are not going to exhaust all possible avenues of attack, we will get an idea of how cryptanalysts go about attacking ciphers. Cryptography and Network Security - MA61027 (Sourav Mukhopadhyay, IIT-KGP, 2010) 2 • This section is really split up into two classes of attack: Cryptanalytic attacks and Implementation attacks. • The former tries to attack mathematical weaknesses in the algorithms whereas the latter tries to attack the specific implementation of the cipher (such as a smartcard system). • The following attacks can refer to either of the two classes (all forms of attack assume the attacker knows the encryption algorithm): Cryptography and Network Security - MA61027 (Sourav Mukhopadhyay, IIT-KGP, 2010) 3 – Ciphertext-only attack: In this attack the attacker knows only the ciphertext to be decoded. The attacker will try to find the key or decrypt one or more pieces of ciphertext (only relatively weak algorithms fail to withstand a ciphertext-only attack).
  • Analysis of Selected Block Cipher Modes for Authenticated Encryption

    Analysis of Selected Block Cipher Modes for Authenticated Encryption

    Analysis of Selected Block Cipher Modes for Authenticated Encryption by Hassan Musallam Ahmed Qahur Al Mahri Bachelor of Engineering (Computer Systems and Networks) (Sultan Qaboos University) – 2007 Thesis submitted in fulfilment of the requirement for the degree of Doctor of Philosophy School of Electrical Engineering and Computer Science Science and Engineering Faculty Queensland University of Technology 2018 Keywords Authenticated encryption, AE, AEAD, ++AE, AEZ, block cipher, CAESAR, confidentiality, COPA, differential fault analysis, differential power analysis, ElmD, fault attack, forgery attack, integrity assurance, leakage resilience, modes of op- eration, OCB, OTR, SHELL, side channel attack, statistical fault analysis, sym- metric encryption, tweakable block cipher, XE, XEX. i ii Abstract Cryptography assures information security through different functionalities, es- pecially confidentiality and integrity assurance. According to Menezes et al. [1], confidentiality means the process of assuring that no one could interpret infor- mation, except authorised parties, while data integrity is an assurance that any unauthorised alterations to a message content will be detected. One possible ap- proach to ensure confidentiality and data integrity is to use two different schemes where one scheme provides confidentiality and the other provides integrity as- surance. A more compact approach is to use schemes, called Authenticated En- cryption (AE) schemes, that simultaneously provide confidentiality and integrity assurance for a message. AE can be constructed using different mechanisms, and the most common construction is to use block cipher modes, which is our focus in this thesis. AE schemes have been used in a wide range of applications, and defined by standardisation organizations. The National Institute of Standards and Technol- ogy (NIST) recommended two AE block cipher modes CCM [2] and GCM [3].
  • On the Decorrelated Fast Cipher (DFC) and Its Theory

    On the Decorrelated Fast Cipher (DFC) and Its Theory

    On the Decorrelated Fast Cipher (DFC) and Its Theory Lars R. Knudsen and Vincent Rijmen ? Department of Informatics, University of Bergen, N-5020 Bergen Abstract. In the first part of this paper the decorrelation theory of Vaudenay is analysed. It is shown that the theory behind the propo- sed constructions does not guarantee security against state-of-the-art differential attacks. In the second part of this paper the proposed De- correlated Fast Cipher (DFC), a candidate for the Advanced Encryption Standard, is analysed. It is argued that the cipher does not obtain prova- ble security against a differential attack. Also, an attack on DFC reduced to 6 rounds is given. 1 Introduction In [6,7] a new theory for the construction of secret-key block ciphers is given. The notion of decorrelation to the order d is defined. Let C be a block cipher with block size m and C∗ be a randomly chosen permutation in the same message space. If C has a d-wise decorrelation equal to that of C∗, then an attacker who knows at most d − 1 pairs of plaintexts and ciphertexts cannot distinguish between C and C∗. So, the cipher C is “secure if we use it only d−1 times” [7]. It is further noted that a d-wise decorrelated cipher for d = 2 is secure against both a basic linear and a basic differential attack. For the latter, this basic attack is as follows. A priori, two values a and b are fixed. Pick two plaintexts of difference a and get the corresponding ciphertexts.
  • Serpent: a Proposal for the Advanced Encryption Standard

    Serpent: a Proposal for the Advanced Encryption Standard

    Serpent: A Proposal for the Advanced Encryption Standard Ross Anderson1 Eli Biham2 Lars Knudsen3 1 Cambridge University, England; email [email protected] 2 Technion, Haifa, Israel; email [email protected] 3 University of Bergen, Norway; email [email protected] Abstract. We propose a new block cipher as a candidate for the Ad- vanced Encryption Standard. Its design is highly conservative, yet still allows a very efficient implementation. It uses S-boxes similar to those of DES in a new structure that simultaneously allows a more rapid avalanche, a more efficient bitslice implementation, and an easy anal- ysis that enables us to demonstrate its security against all known types of attack. With a 128-bit block size and a 256-bit key, it is as fast as DES on the market leading Intel Pentium/MMX platforms (and at least as fast on many others); yet we believe it to be more secure than three-key triple-DES. 1 Introduction For many applications, the Data Encryption Standard algorithm is nearing the end of its useful life. Its 56-bit key is too small, as shown by a recent distributed key search exercise [28]. Although triple-DES can solve the key length problem, the DES algorithm was also designed primarily for hardware encryption, yet the great majority of applications that use it today implement it in software, where it is relatively inefficient. For these reasons, the US National Institute of Standards and Technology has issued a call for a successor algorithm, to be called the Advanced Encryption Standard or AES.
  • Report on the AES Candidates

    Report on the AES Candidates

    Rep ort on the AES Candidates 1 2 1 3 Olivier Baudron , Henri Gilb ert , Louis Granb oulan , Helena Handschuh , 4 1 5 1 Antoine Joux , Phong Nguyen ,Fabrice Noilhan ,David Pointcheval , 1 1 1 1 Thomas Pornin , Guillaume Poupard , Jacques Stern , and Serge Vaudenay 1 Ecole Normale Sup erieure { CNRS 2 France Telecom 3 Gemplus { ENST 4 SCSSI 5 Universit e d'Orsay { LRI Contact e-mail: [email protected] Abstract This do cument rep orts the activities of the AES working group organized at the Ecole Normale Sup erieure. Several candidates are evaluated. In particular we outline some weaknesses in the designs of some candidates. We mainly discuss selection criteria b etween the can- didates, and make case-by-case comments. We nally recommend the selection of Mars, RC6, Serp ent, ... and DFC. As the rep ort is b eing nalized, we also added some new preliminary cryptanalysis on RC6 and Crypton in the App endix which are not considered in the main b o dy of the rep ort. Designing the encryption standard of the rst twentyyears of the twenty rst century is a challenging task: we need to predict p ossible future technologies, and wehavetotake unknown future attacks in account. Following the AES pro cess initiated by NIST, we organized an op en working group at the Ecole Normale Sup erieure. This group met two hours a week to review the AES candidates. The present do cument rep orts its results. Another task of this group was to up date the DFC candidate submitted by CNRS [16, 17] and to answer questions which had b een omitted in previous 1 rep orts on DFC.
  • The EAX Mode of Operation

    The EAX Mode of Operation

    A preliminary version of this papers appears in Fast Software Encryption ’04, Lecture Notes in Computer Science, vol. ?? , R. Bimal and W. Meier ed., Springer-Verlag, 2004. This is the full version. The EAX Mode of Operation (A Two-Pass Authenticated-Encryption Scheme Optimized for Simplicity and Efficiency) ∗ † ‡ M. BELLARE P. ROGAWAY D. WAGNER January 18, 2004 Abstract We propose a block-cipher mode of operation, EAX, for solving the problem of authenticated-encryption with associated-data (AEAD). Given a nonce N, a message M, and a header H, our mode protects the privacy of M and the authenticity of both M and H. Strings N, M, and H are arbitrary bit strings, and the mode uses 2|M|/n + |H|/n + |N|/n block-cipher calls when these strings are nonempty and n is the block length of the underlying block cipher. Among EAX’s characteristics are that it is on-line (the length of a message isn’t needed to begin processing it) and a fixed header can be pre-processed, effectively removing the per-message cost of binding it to the ciphertext. EAX is obtained by first creating a generic-composition method, EAX2, and then collapsing its two keys into one. EAX is provably secure under a standard complexity-theoretic assumption. The proof of this fact is novel and involved. EAX is an alternative to CCM [26], which was created to answer the wish within standards bodies for a fully-specified and patent-free AEAD mode. As such, CCM and EAX are two-pass schemes, with one pass for achieving privacy and one for authenticity.
  • The Mathemathics of Secrets.Pdf

    The Mathemathics of Secrets.Pdf

    THE MATHEMATICS OF SECRETS THE MATHEMATICS OF SECRETS CRYPTOGRAPHY FROM CAESAR CIPHERS TO DIGITAL ENCRYPTION JOSHUA HOLDEN PRINCETON UNIVERSITY PRESS PRINCETON AND OXFORD Copyright c 2017 by Princeton University Press Published by Princeton University Press, 41 William Street, Princeton, New Jersey 08540 In the United Kingdom: Princeton University Press, 6 Oxford Street, Woodstock, Oxfordshire OX20 1TR press.princeton.edu Jacket image courtesy of Shutterstock; design by Lorraine Betz Doneker All Rights Reserved Library of Congress Cataloging-in-Publication Data Names: Holden, Joshua, 1970– author. Title: The mathematics of secrets : cryptography from Caesar ciphers to digital encryption / Joshua Holden. Description: Princeton : Princeton University Press, [2017] | Includes bibliographical references and index. Identifiers: LCCN 2016014840 | ISBN 9780691141756 (hardcover : alk. paper) Subjects: LCSH: Cryptography—Mathematics. | Ciphers. | Computer security. Classification: LCC Z103 .H664 2017 | DDC 005.8/2—dc23 LC record available at https://lccn.loc.gov/2016014840 British Library Cataloging-in-Publication Data is available This book has been composed in Linux Libertine Printed on acid-free paper. ∞ Printed in the United States of America 13579108642 To Lana and Richard for their love and support CONTENTS Preface xi Acknowledgments xiii Introduction to Ciphers and Substitution 1 1.1 Alice and Bob and Carl and Julius: Terminology and Caesar Cipher 1 1.2 The Key to the Matter: Generalizing the Caesar Cipher 4 1.3 Multiplicative Ciphers 6
  • Mcoe: a Family of Almost Foolproof On-Line Authenticated Encryption Schemes

    Mcoe: a Family of Almost Foolproof On-Line Authenticated Encryption Schemes

    McOE: A Family of Almost Foolproof On-Line Authenticated Encryption Schemes Ewan Fleischmann Christian Forler Stefan Lucks Bauhaus-Universit¨atWeimar FSE 2012 Fleischmann, Forler, Lucks. FSE 2012. McOE: A Family . {1{ Overview Fleischmann, Forler, Lucks. FSE 2012. McOE: A Family . {2{ 1. Motivation I Goldwasser and Micali (1984): requirement: given 2 ciphertexts, adversary cannot even detect when the same plaintext has been encrypted twice consequence: encryption stateful or probabilitistic (or both) I Rogaway (FSE 2004): formalizes state/randomness by nonces Plaintext Header Key Nonce 01 02 03 ... Ciphertext Authentication Tag Fleischmann, Forler, Lucks. FSE 2012. McOE: A Family . {3{ Authenticated Encryption I first studied by Katz and Young (FSE 2000) and Bellare and Namprempre (Asiacrypt 2000) I since then many proposed schemes, I nonce based, Plaintext Header Key Nonce I and proven secure assuming a \nonce-respecting01 02 03 ... adversary" I any implementation allowing a nonce reuse is not our problem . but maybe it shouldCiphertext Authentication Tag Fleischmann, Forler, Lucks. FSE 2012. McOE: A Family . {4{ Nonce Reuse in Practice I IEEE 802.11 [Borisov, Goldberg, Wagner 2001] I PS3 [Hotz 2010] I WinZip Encryption [Kohno 2004] I RC4 in MS Word and Excel [Wu 2005] I ... application programmer other issues: mistakes: I restoring a file from a backup I cloning the virtual machine the application runs on I ... Fleischmann, Forler, Lucks. FSE 2012. McOE: A Family . {5{ Nonce Reuse { what to Expect? our reasonable (?) expectations I some plaintext information leaks: I identical plaintexts I common prefixes I ect. I but not too much damage: 1. authentication not affected 2.
  • Optimization of Core Components of Block Ciphers Baptiste Lambin

    Optimization of Core Components of Block Ciphers Baptiste Lambin

    Optimization of core components of block ciphers Baptiste Lambin To cite this version: Baptiste Lambin. Optimization of core components of block ciphers. Cryptography and Security [cs.CR]. Université Rennes 1, 2019. English. NNT : 2019REN1S036. tel-02380098 HAL Id: tel-02380098 https://tel.archives-ouvertes.fr/tel-02380098 Submitted on 26 Nov 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. THÈSE DE DOCTORAT DE L’UNIVERSITE DE RENNES 1 COMUE UNIVERSITE BRETAGNE LOIRE Ecole Doctorale N°601 Mathématique et Sciences et Technologies de l’Information et de la Communication Spécialité : Informatique Par Baptiste LAMBIN Optimization of Core Components of Block Ciphers Thèse présentée et soutenue à RENNES, le 22/10/2019 Unité de recherche : IRISA Rapporteurs avant soutenance : Marine Minier, Professeur, LORIA, Université de Lorraine Jacques Patarin, Professeur, PRiSM, Université de Versailles Composition du jury : Examinateurs : Marine Minier, Professeur, LORIA, Université de Lorraine Jacques Patarin, Professeur, PRiSM, Université de Versailles Jean-Louis Lanet, INRIA Rennes Virginie Lallemand, Chargée de Recherche, LORIA, CNRS Jérémy Jean, ANSSI Dir. de thèse : Pierre-Alain Fouque, IRISA, Université de Rennes 1 Co-dir. de thèse : Patrick Derbez, IRISA, Université de Rennes 1 Remerciements Je tiens à remercier en premier lieu mes directeurs de thèse, Pierre-Alain et Patrick.