We study the security of triple encryption in the multi-user setting with its application to Triple DES (TDES) in mind. Although depreciation of TDES is a global trend, the migration will take the next decade, considering the billions of TDES hardware the industry has invested so far. The multi-user security captures the reality of practical systems with multiple users, substantially impacts security, and is already considered in practical protocols such as TLS 1.3. The best multi-user lower bound of TDES is 43-(3/2) \cdot łog_2 u bits with u users, which is tractable with a standard PC and is unacceptably low. We devise a new proof to improve the multi-user security and show its tightness by giving a concrete attack. The new bound with the TDES parameters is 79-(1/2) \cdot łog_2 u bits. We also propose TEFX that strengthens triple encryption with the FX construction while preserving the compatibility with legacy hardware. TDES with TEFX achieves the multi-user security of 114-(1/2) \cdot łog_2 q bits with q TEFX calls: it achieves 84.5 bits with 2^40 users and 2^21 TEFX calls for each user, which is comparable to that of AES (128-40=88 bits).

In this study, the authors study the pseudo‐random function (PRF) security of keyed sponges. ‘Capacity’ is a parameter of a keyed sponge that usually defines a dominant term in the PRF‐security bound. The previous works have improved the capacity term in the PRF‐security bound of the ‘prefix’ keyed sponge, where a secret key is prepended to an input message, and then the resultant value is inputted into the sponge function. A tight bound for the capacity term was given by Naito and Yasuda (FSE 2016): for the capacity c , the number of construction queries q and the number of primitive queries Q . Thus, the following question naturally arises: Can they construct a keyed sponge with beyond the ‐bound security? In this study, they consider the ‘sandwich’ keyed sponge, where a secret key is both prepended and appended to an input message, and then the resultant value is inputted into the sponge function. They prove that the capacity term becomes for the rate r , which is usually and . That is, the dependence between the capacity and construction queries can be removed by the sandwich construction.

This paper proposes a new algorithm for evaluating the number of chaining variable conditions(CVCs) in the selecting step of a distrubance vector (DV) for the analysis of SHA-1 collision attack. The algorithm is constructed by combining the following four strategies, Strict Bit Compression, DV expansion, Precise Counting Rules in Every Step and Differential Path Confirmation for Rounds 2 to 4, that can evaluate the number of CVCs morestrictly compared with the previous approach.