Abstract In this paper, we study the security of the Key-Alternating Feistel (KAF) ciphers, a class of key alternating ciphers with the Feistel structure, where each round of the cipher is instantiated with n -bit public round permutation $$P_i$$ P i , namely the i -th round of the cipher maps $$\begin{aligned} (X_L, X_R) \mapsto (X_R, P_i(X_R \oplus K_i) \oplus K_i \oplus X_L). \end{aligned}$$ ( X L , X R ) ↦ ( X R , P i ( X R ⊕ K i ) ⊕ K i ⊕ X L ) . We have shown that our 5 round construction with independent round permutations and independent round keys achieves 2 n /3-bit security in the random permutation model, i.e., the setting where the adversary is allowed to make forward and inverse queries to the round permutations in a black box way.

We consider the problem of constructing secure cryptographic hash functions from subverted ideal primitives. Hash functions are used to instantiate Random Oracles in cryptographic protocols. The indifferentiability security notion is a popular tool to certify the structural soundness of a hash design for such instantiations. In CRYPTO 2018, Russell, Tang, Yung, and Zhou introduced the notion of crooked-indifferentiability to extend this paradigm even when the underlying primitive of the hashing mode is subverted. They showed that an$n$-to-$n$-bit function implemented using Enveloped XOR construction (EXor) with$3n+1$many independent$n$-to-$n$-bit functions and$3n^{2}$-bit random seed can be proven secure asymptotically in the crooked-indifferentiability setting. Unfortunately, known techniques to prove crooked-indifferentiability are extremely complicated, and no practical hashing mode has been analyzed in this setting. 1) We introduce new techniques to prove crooked-indifferentiability. We establish that upper bounding the subversion probability of a chaining query is sufficient to argue subversion resistance of a standard indifferentiable mode of operation. Our technique links standard indifferentiability and crooked-indifferentiability and circumvents the complications of proving the consistency of the simulator in the crooked setting. 2) We prove crooked-indifferentiability of the sponge construction when the underlying primitive is modelled as an$n$-to-$n$-bit random function. Our proofs only require$n$-bit randomly chosen but fixed IV and do not mandate any independent function requirement. The result naturally extends to the Merkle-Damgård domain extension with prefix-free padding. Our results minimize required randomness and solve the main open problem raised by Russell, Tang, Yung, and Zhou.

In ICISC-05, and in the ePrint 2010/287, Patarin claimed a lower bound on the number of$2 q$tuples of$n$-bit strings$(P_{1}, \ldots, P_{2q}) \in ({\{0,1\}}^{n})^{2q}$satisfying$P_{2i - 1} \oplus P_{2i} = \lambda _{i}$for$1 \leq i \leq q$such that$P_{1}, P_{2}, \ldots $,$P_{2q}$are distinct and$\lambda _{i} \in {\{0,1\}} ^{n} \setminus \{0^{n}\}$. This result is known asMirror theoryand widely used in cryptography. It stands as a powerful tool to provide a high-security guarantee for many block cipher-(or even ideal permutation-) based designs. In particular, Mirror theory has a direct application in the security of XOR of block ciphers. Unfortunately, the proof of Mirror theory contains some unverifiable gaps and several mistakes. This paper provides a simple and verifiable proof of Mirror theory.

Offset codebook or${\mathsf {OCB}}$mode is a popular block cipher mode of operation for authenticated encryption. The latest version of this cipher, called${\mathsf {OCB3}}$, is one of the finalists in CAESAR. In this paper, we explore the scope of random read access and out-of-sequence decryption in${\mathsf {OCB}}$. We observe that the current versions of${\mathsf {OCB}}$are inefficient in this respect owing to the ineptness of the underlying mask generating function (MGF). We propose new candidates for MGF based on${\mathsf {AES}}$round function, which are efficient in direct computation and provide comparable performance in the usual setting. Our schemes are not the obvious choices for MGF in conventional sense as they do not have optimal almost XOR universal (AXU) bound. In existing${\mathsf {OCB}}$designs, the MGFs are required to have$ 2^{-n} $, i.e. optimal, AXU bound in order to upper bound the distinguishing advantage to$ O(\sigma ^{2}/2^{n}) $, where$ n $is the block size of the underlying block cipher and$ \sigma $is the total number of blocks among all queries. We find this specific requirement too restrictive. We abstract the${\mathsf {OCB}}$design, termed as${\mathsf {GOCB}}$, to look into the universal notion required from the underlying MGF. We propose a relaxed notion of AXU, called locally imperfect XOR universal (LIXU) hash, which can be of independent interest. Using LIXU as the underlying MGF, we recover reasonable security bounds for our schemes.

In cryptography, counters (classically encoded as bit strings of fixed size for all inputs) are employed to prevent collisions on the inputs of the underlying primitive which helps us to prove the security. In this paper we present a unified notion for counters, called counter function family, and identify some necessary and sufficient conditions on counters which give (possibly) simple proof of security for various counter-based cryptographic schemes. We observe that these conditions are trivially true for the classical counters. We also identify and study two variants of the classical counter which satisfy the security conditions. The first variant has message length dependent counter size, whereas the second variant uses universal coding to generate message length independent counter size. Furthermore, these variants provide better performance for shorter messages. For instance, when the message size is 219 bits, AES-LightMAC with 64-bit (classical) counter takes 1:51 cycles per byte (cpb), whereas it takes 0:81 cpb and 0:89 cpb for the first and second variant, respectively. We benchmark the software performance of these variants against the classical counter by implementing them in MACs and HAIFA hash function.

Authenticated encryption schemes which resist misuse of nonce at some desired level of privacy are two-pass or Mac-then-Encrypt constructions (inherently inefficient but provide full privacy) and online constructions like McOE, sponge-type authenticated encryptions (such as duplex) and COPA. Only the last one is almost parallelizable except that for associated data processing, the final block-cipher call is sequential (it needs to wait for the encryption of all the previous ones). In this paper, we design a new online secure authenticated encryption, called ELmD or Encrypt-Linear mix-Decrypt, which is completely (two-stage) parallel (even in associated data) and fully pipeline implementable. It also provides full privacy when associated data is not repeated. Like COPA, our construction is based on EME, an Encrypt-Mix-Encrypt type SPRP construction (secure against chosen plaintext and ciphertext). But unlike EME, we have used an online computable efficient linear mixing instead of a non-linear mixing. We have also provided the hardware implementation of the construction and compare the performance with similar constructions like COPA and EME2.

We show several concrete attacks on an authenticated encryption (AE) scheme PAE, which appeared in the IEEE TRANSACTIONS ON INFORMATION THEORY, vol. 56, no. 8, pp. 4025-4037. In addition, we show some flaws and oversights in the analysis (presented in the same paper) used to prove PAE to be a secure AE scheme.

Cryptographic hash functions take an unfixed size of input and produce a fixed size of an output. A hash function usually has two main components: a compression function and mode of operation. Sponge construction is one of the main operations of modes of used in modern cryptographic hash function. In this paper, we present multicollisions attack in sponge construction. In 2004, Joux [3] presented multicollision attack in iterated hash function. Our attack is similar to Joux attack but specifically for sponge construction. We show that finding multicollisions in sponge construction of messages that hash to the same value, is not harder finding ordinary collisions. Then, we use this attack as a tool to prove that concatenating more than one hash function in order to increase the security level does not yield to more secure construction.

A multicollision for a function is a set of inputs whose outputs are all identical. A. Joux showed multicollision attacks on the classical iterated hash function. He also showed how these multicollision attacks can be used to get a collision attack on a concatenated hash function. In this paper, we study multicollision attacks in a more general class of hash functions which we term "generalized sequential hash functions." We show that multicollision attacks exist for this class of hash functions provided that every message block is used at most twice in the computation of the message digest