Reconsidering Generic Composition

Size: px

Start display at page:

Download "Reconsidering Generic Composition"

Jeffrey Hutchinson
8 years ago
Views:

1 Reconsidering Generic Composition Chanathip Namprempre Thammasat University, Thailand Phillip Rogaway University of California, Davis, USA Tom Shrimpton Portland State University, USA 1/24

2 What is the correct way to build an authenticated encryption scheme from an encryption scheme and a MAC? 2/24

3 What is the correct way to build an authenticated encryption scheme from an encryption scheme and a MAC? [Bellare-Namprempre ASIACRYPT 2000] Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm Encrypt-and-MAC Encrypt-then-MAC MAC-then-Encrypt always works if encryption IND-CPA secure and MAC unforgeable 3/24

[Bellare-Namprempre ASIACRYPT 2000] Authenticated Encryption: Relations among Notions

4 What is the correct way to build an authenticated encryption scheme from an encryption scheme and a MAC? [Bellare-Namprempre ASIACRYPT 2000] Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm Encrypt-and-MAC Encrypt-then-MAC MAC-then-Encrypt always works if encryption IND-CPA secure and MAC unforgeable This summary of [BN] is incorrect. 4/24

[Bellare-Namprempre ASIACRYPT 2000] Authenticated Encryption: Relations among Notions and

5 Encrypt-then-MAC initialization vector IV M plaintext CtrMode K1 IND-CPA secure encryption scheme IV ciphertext C F K2 T tag secure MAC (e.g. PRF) 5/24

6 Encrypt-then-MAC M CtrMode K1 if F K2 (C) = T then return Dec K1 (IV,C) else return invalid F K2 IV C T 6/24

7 Encrypt-then-MAC M CtrMode K1 if F K2 (C) = T then return Dec K1 (IV,C) else return invalid F K2 IV C T But [BN] says??? 7/24

8 Encrypt-then-MAC vs. Encrypt-then-MAC IV M M Enc K1 IV Enc K1 F K2 F K2 IV C T C T IV-based AE scheme built from an IV-based encryption scheme and a MAC Different starting primitives, different final primitives, different security Probabilistic AE scheme built from a probabilistic encryption scheme and a MAC [BN] is about this setting only. 8/24

from an IV-based encryption scheme and a MAC Different starting primitives, different

9 Incorrect summary of [BN], in practice ISO/IEC 19772, Mechanism 5 (Encrypt-then-MAC) Information Security Security Techniques Authenticated Encryption S D S required to be a nonce (but not random) Enc K1 C F K2 T Enc = CBC, CTR, OFB, CFB blockcipher modes -- not all have {0,1}* domains -- some require S to be random for IND-CPA S C S not covered by tag Appeals to [BN] to justify security of a nonce-based scheme built from IV-based encryption. 9/24

CBC, CTR, OFB, CFB blockcipher modes -- not all have {0,1}* domains -- some require S to be random for IND-CPA S

10 Okay, fine: EtM + secure prob. Enc + secure MAC = secure prob. AE The thing is 1. Typical goal nowadays is nonce-based AE with associated data (NAE), not probabilistic AE (IV =) N A M NAE (deterministic) C N= nonce ( number used once, e.g. sequence number) A = associated data, bound to plaintext/ciphertext, not private M = plaintext, private 2. Standards and common crypto libraries don t provide probabilistic encryption schemes, they provide IV-based encryption int encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *key, unsigned char *iv, unsigned char *ciphertext) openssl encryption API 10/24

g. sequence number) A = associated data, bound to plaintext/ciphertext, not private M = plaintext, private 2.

11 What are the correct ways to compose a secure IV-based encryption scheme and a secure PRF in order to build a nonce-based AE(AD) scheme? 11/24

12 N A M Our basic NAE forms F iv L M F iv inputs: (N or, A or, M or ) F tag inputs: (N or, A or, M or ) E&M IV Enc K F tag L or (N or, A or, C or ) EtM = missing C T C N A M F iv inputs: (N or, A or, M or ) F tag inputs: (N or, A or, M or ) F iv L M T F tag L IV Enc K C 12/24

or, C or ) EtM = missing C T C N A M F iv inputs: (N or, A or, M or

13 160 possible constructions analyzed, resulting in: 8 favored schemes --- generically secure, good security bounds 1 transitional scheme --- generically secure, inferior bound 3 elusive schemes --- despite LOADS of effort, unable to find proofs using only IND$-CPA and PRF security of components, unable to find counterexamples All other schemes --- we find counterexamples (many trivial, some not) What security notion? we target an all-in-one AE notion [RS06], equivalent to IND$-CPA + INT-CTXT 13/24

proofs using only IND$-CPA and PRF security of components, unable to find counterexamples All other schemes --- we find

14 The favored eight E and M E and M E and M SIV mode [RS06] E then M E then M M then E M then E 14/24

15 The favored eight all have the same (good, tight) AE security. Which should I use? 15/24

16 Encryption can compute C,T in parallel Can truncate the tag by truncating AE scheme output 16/24

17 Encryption can compute C,T in parallel Can truncate the tag by truncating AE scheme output IV must be recoverable from C,T 17/24

18 Encryption can compute C,T in parallel Can truncate the tag by truncating AE scheme output IV must be recoverable from C,T Nonce-misuse resistan Cannot truncate 18/24

19 Encryption can compute C,T in parallel Can truncate the tag by truncating AE scheme output IV must be recoverable from C,T Nonce-misuse resistan Cannot truncate Decryption can compute M, check T in parallel Can truncate 19/24

recoverable from C,T Nonce-misuse resistan Cannot

20 Encryption can compute C,T in parallel Can truncate the tag by truncating AE scheme output IV must be recoverable from C,T Nonce-misuse resistan Cannot truncate Decryption can compute M, check T in parallel Can truncate Cannot truncate MtE style schemes have history of problems in practice20/24

Cannot truncate Decryption can compute M, check T in parallel Can

21 What are these vector input PRFs? Real PRFs (e.g. HMAC-SHA) take a string! F L Can be instantiated in many ways. We use the three-xor construction. F L1,L2,L3 (N,A,M) = f L1 (N) f L2 (A) f L3 (M) F L1,L2,L3 (N,,M) = f L1 (N) 0 n f L3 (M) F L1,L2,L3 (,,M) = 0 n 0 n f L3 (M) etc. 21/24

22 EAX2 [Bellare, R, Wagner 04] The favored eight, based on a string-input PRF (using the three-xor construction) 22/24

23 Also in the paper Building NAE from tidy nonce-based encryption and a PRF: Three secure options, one elusive. Proofs of security for elusive schemes under new knowledge of tags assumption An ISO standard that uses [BN] to justify an NAE design = Broken Discussion of tidiness as a syntactic property of deterministic encryption High-level Summary [BN] is fine, but people s understanding of it over-generalizes, leading to problems in practice E&M, EtM, MtE taxonomy / security characterization is specific to building probabilistic AE from probabilistic encryption GC story is much more nuanced when building nonce-based AE 23/24

24 Thank you! E and M E and M E and M SIV mode [RS06] E then M E then M M then E M then E 24/24

25 --- END /24

Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre

Authenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm By Mihir Bellare and Chanathip Namprempre Some slides were also taken from Chanathip Namprempre's defense