TFHE is a fully homomorphic encryption scheme over the torus that supports fast bootstrapping. Its primary evaluation mechanism is based on gate bootstrapping and programmable bootstrapping (PBS), which computes functions while simultaneously refreshing noise. PBS-based evaluation is user-friendly and efficient for small circuits; however, the number of bootstrapping operations increases exponentially with the circuit depth. To address the challenge of efficiently evaluating large-scale circuits, Chillotti et al. introduced a leveled homomorphic evaluation (LHE) mode at Asiacrypt 2017. This mode decouples circuit evaluation from bootstrapping, resulting in a speedup of hundreds of times over PBS-based methods. However, the remaining circuit bootstrapping (CBS) becomes a performance bottleneck, even though its frequency is linear with the circuit depth.

Abstract Online authenticated encryption has been considered of practical relevance in light-weight environments due to low latency and constant memory usage. In this paper, we propose a new tweakable block cipher-based online authenticated encryption scheme, dubbed , and its domain separation variant, dubbed . and follow the Encrypt-Mix-Encrypt paradigm. However, in contrast to existing schemes using the same paradigm such as and , and enjoy n-bit security by using larger internal states with an efficient -like hashing algorithm. In this way, 2n-bit blocks are processed with only a single primitive call for hashing and two primitive calls for encryption and decryption, when they are based on an n-bit tweakable block cipher using n-bit (resp. 2n-bit) tweaks for (resp. ). Furthermore, they support pipelined computation as well as online nonce-misuse resistance. To the best of our knowledge, and are the first pipelineable tweakable block cipher-based online authenticated encryption schemes of rate-2/3 that provide n-bit security with online nonce-misuse resistance.

Abstract Deterministic random bit generators (DRBGs) are essential tools in modern cryptography for generating secure and unpredictable random numbers. The ISO DRBG standards provide guidelines for designing and implementing DRBGs, including four algorithms: $$\textsf{HASH}\text {-}\textsf{DRBG}$$ HASH - DRBG , $$\textsf{HMAC}\text {-}\textsf{DRBG}$$ HMAC - DRBG , $$\textsf{CTR}\text {-}\textsf{DRBG}$$ CTR - DRBG , and $$\textsf{OFB}\text {-}\textsf{DRBG}$$ OFB - DRBG . While security analyses have been conducted for the former three algorithms, there is a lack of specific security analysis for the $$\textsf{OFB}$$ OFB - $$\textsf{DRBG}$$ DRBG algorithm. We prove its security in the robustness security framework that has been used to analyze $$\mathsf {CTR\text {-}DRBG}$$ CTR - DRBG by Hoang and Shen at Crypto 2020. More precisely, we prove that $$\textsf{OFB}$$ OFB - $$\textsf{DRBG}$$ DRBG provides $$O(\min \left\{ \frac{\lambda }{3}, \frac{n}{2} \right\} )$$ O ( min λ 3 , n 2 ) -bit security, including ideal cipher queries, where $$\lambda $$ λ and n denote the lower bound of min-entropy and the size of the underlying block cipher, respectively. The proof strategy is to transform the robustness game of $$\textsf{OFB}$$ OFB - $$\textsf{DRBG}$$ DRBG into an indistinguishability game and then apply the H-coefficient technique to upper bound the distinguishing advantage.

Post-quantum signature schemes based on the MPC-in-the-Head (MPCitH) paradigm are recently attracting significant attention as their security solely depends on the one-wayness of the underlying primitive, providing diversity for the hardness assumption in post-quantum cryptography. Recent MPCitH-friendly ciphers have been designed using simple algebraic S-boxes operating on a large field in order to improve the performance of the resulting signature schemes. Due to their simple algebraic structures, their security against algebraic attacks should be comprehensively studied.

Grover’s search algorithm allows a quantum adversary to find a$k$-bit secret key of a block cipher by making O($2^{k/2}$) block cipher queries. Resistance of a block cipher to such an attack is evaluated by quantum resources required to implement Grover’s oracle for the target cipher. The quantum resources are typically estimated by the$\textit {T}$-depth of its circuit implementation and the number of qubits used by the circuit (width). Since the AES S-box is the only component which requires$\textit {T}$-gates in a quantum implementation of AES, recent research has put its focus on efficient implementation of the AES S-box. However, any efficient implementation with low$\textit {T}$-depth will not be practical in the real world without considering qubit consumption of the implementation. In this work, we propose three methods of trade-off between time and space for the quantum implementation of the AES S-box. In particular, one of our methods turns out to use the smallest number of qubits among the existing methods, significantly reducing its$\textit {T}$-depth.

The significance of understanding blockcipher security in the multi-key setting is highlighted by the extensive literature on attacks, and how effective key size can be significantly reduced. Nevertheless, little attention has been paid in formally understanding the design of multi-key secure blockciphers. In this work, we formalize the multi-key security of tweakable blockciphers in case of general key derivation functions. We show an equivalence between blockcipher multi-key security and tweakable blockcipher security. Our equivalence connects two objects of study, the iterated Even–Mansour (EUROCRYPT 2012) and the iterated Tweakable Even–Mansour (CRYPTO 2015), which establishes that results in both areas are, to a certain extent, transferable. Using our novel equivalence relation, we derive new bounds for both constructions, pave the path towards the solution of two well-studied conjectures, and show that, contrary to common knowledge, key derivation functions need not necessarily be pseudorandom functions in order to provide security: for the iterated Even–Mansour universal hash functions suffice.

A natural way of constructing a pseudorandom function from multiple pseudorandom permutations is to simply add the permutations. In the indistinguishability model, it is known that even two random permutations are sufficient to provide security up to 2nqueries. On the other hand, the indifferentiability has been proved only up to 2(2n/3)queries for any number of summands. In this paper, we improve this bound up to 2(((l-1)n)/l)queries for an even integer l ≥ 4. This is the first result that shows the indifferentiablity of the sum of random permutations is strengthened towards the optimal bound 2nas the number of summands increases.

In this paper, we propose a new double-piped mode of operation for multiproperty-preserving domain extension of message authentication codes (MACs), pseudorandom functions (PRFs), and pseudorandom oracles (PROs). Our mode of operation performs twice as fast as the original double-piped mode of operation of Lucks while providing comparable security. Our construction, which uses a class of polynomial-based compression functions proposed by Stam, makes a single call to a$3n$-bit to$n$-bit primitive$f_{1}$at each iteration and uses a finalization function$f_{2}$at the last iteration, producing an$n$-bit hash function$H[f_{1},f_{2}]$satisfying the following properties.$H[f_{1},f_{2}]$is unforgeable up to$O(2^{n}/n)$query complexity as long as$f_{1}$and$f_{2}$are unforgeable.