Abstract Nonce‐misuse resilience (NMRL) security of Romulus‐N and GIFT‐COFB is analysed, the two finalists of NIST Lightweight Cryptography project for standardising lightweight authenticated encryption. NMRL, introduced by Ashur et al. at CRYPTO 2017, is a relaxed security notion from a stronger, nonce‐misuse resistance notion. The authors have proved that Romulus‐N and GIFT‐ COFB have nonce‐misuse resilience. For Romulus‐N, the perfect privacy (NMRL‐PRIV) and n /2‐bit authenticity (NMRL‐AUTH) with graceful degradation with respect to nonce repetition are showed. For GIFT‐COFB, n /4‐bit security for both NMRL‐PRIV and NMRL‐AUTH notions is showed.

Abstract The security bound is an important evaluation criterion in an authenticated encryption (AE) scheme. Many AE schemes that are widely used have birthday‐bound security, which means that the scheme has b /2‐bit security, where b is the block size of the underlying primitive. However, due to the increased interest in lightweight cryptography, smaller block‐size primitives have been developed, which has led to more active research on AE schemes with beyond birthday‐bound security. Although all such AE schemes are secure up to a full‐bit (i.e. b ‐bit) bound at most, Naito et al. proposed the first beyond full‐bit‐bound secure AE schemes, and , at Eurocrypt 2020. and achieve 2 b ‐bit security and ωb ‐bit security, respectively, where ω is a parameter s . t . . In this work, the author points out a downside of that was not clearly specified in its proposal paper and resolves it with the proposed scheme, . The downside of is that there is a limitation on each input size; it can process only up to 2 b − 2 blocks for each input in spite of its high security bound. The author's scheme, , is the first AE to achieve ωb ‐bit security and has no limitation on each input size for ω ≥ 3.

Memory encryption (ME) with authentication is becoming a key security feature of modern processors, as evident by the adoption of ME by Intel’s SGX. Recently ME is actively studied from the viewpoint of system architecture. This paper studies ME from the viewpoint of symmetric-key cryptographic designs, with a primal focus on latency. A significant progress in such a direction can be observed in the SGX Integrity Tree (SIT). Using a variant of AES-GCM, SIT achieves an excellent latency. However, it has a scalability issue. By carefully examining SIT, we develop a new ME scheme dubbed ELM. We present an AES-based instantiation of ELM, and show that ELM significantly reduces latency from SIT for large memories, and achieves the provable security and equivalent hardware-protected (on-chip) area. We also present preliminary hardware implementations to substantiate our advantages.

This paper presents a new incremental parallelizable message authentication code (MAC) scheme adaptable to lightweight block ciphers for memory integrity verification. The highlight of the proposed scheme is to achieve both incremental update capability and sufficient security bound with lightweight block ciphers, which is a novel feature. We extend the conventional parallelizable MAC to realize the incremental update capability while keeping the original security bound. We prove that a comparable security bound can be obtained even if this change is incorporated. We also present a hardware architecture for the proposed MAC scheme with lightweight block ciphers and demonstrate the effectiveness through FPGA implementation. The evaluation results indicate that the proposed MAC hardware achieves 3.4 times improvement in the latency-area product for the tag update compared with the conventional MAC.