Badger – A Fast and Provably Secure MAC

Abstract. Correct authenticated decryption requires the receiver to buffer the decrypted message until the authenticity check has been performed. In high-speed networks, which must handle large message frames at low latency, this behavior becomes practically infeasible. This paper proposes CCA-secure on-line ciphers as a practical alternative to AE schemes since the former provide some defense against malicious message modifications. Unfortunately, all published on-line ciphers so far are either inherently sequential, or lack a CCA-security proof. This paper introduces POE, a family of on-line ciphers that combines provable security against chosen-ciphertext attacks with pipelineability to support efficient implementations. POE combines a block cipher and an ǫ-AXU family of hash functions. Different instantiations of POE are given, based on different universal hash functions and suitable for different platforms. Moreover, this paper introduces POET, a provably secure on-line AE scheme, which inherits pipelineability and chosen-ciphertextsecurity from POE and provides additional resistance against noncemisuse attacks.

show abstract

“…Boesgaard et al [10] showed that an ǫ-AXU family of hash functions can be reduced to a family of ǫ-AU hash functions by the following theorem:…”

Section: Notions For Universal Hash Functionsmentioning

confidence: 99%

Pipelineable On-line Encryption

Abed

Fluhrer

Forler

et al. 2015

Fast Software Encryption

View full text Add to dashboard Cite

show abstract

“…The pseudo dot-product [46] based hash PDP (e.g. NMH hash [14], NMH * [14], NH [4] and others [8,21]) defined as (for even )…”

Section: Our Contribution and Outline Of The Papermentioning

confidence: 99%

“…NMH * and NH are variants of these construction. Later on NH has been modified to propose some more constructions [19,21,8,31]. A general form of pseudo dot-product PDP is (…”

Section: Pseudo Dot-productmentioning

confidence: 99%

On the Minimum Number of Multiplications Necessary for Universal Hash Functions

Nandi

2015

Fast Software Encryption

View full text Add to dashboard Cite

Abstract. Let d ≥ 1 be an integer and R1 be a finite ring whose elements are called block. A d-block universal hash over R1 is a vector of d multivariate polynomials in message and key block such that the maximum differential probability of the hash function is "low". Two such single block hashes are pseudo dot-product (PDP) hash and BernsteinRabin-Winograd (BRW) hash which require n 2 multiplications for n message blocks. The Toeplitz construction and d independent invocations of PDP are d-block hash outputs which require d × n 2 multiplications. However, here we show that at least (d − 1) + n 2 multiplications are necessary to compute a universal hash over n message blocks. We construct a dblock universal hash, called EHC, which requires the matching (d − 1) + n 2 multiplications for d ≤ 4. Hence it is optimum and our lower bound is tight when d ≤ 4. It has similar parllelizibility, key size like Toeplitz and so it can be used as a light-weight universal hash.

show abstract

“…This is the case with high-speed message authentication and the move from 32-bit to 64-bit architectures. The fastest reported software-optimized message authentication algorithms (or MACs) are all designed to run well on 32-bit architectures [5,6,9]. While these MACs generally work equally well on both 32-and 64-bit architectures -because the newer architectures support older instructions at full speed -they are not designed to take advantage of new capabilities found in 64-bit processors.…”

Section: Introductionmentioning

confidence: 99%

“…Message authentication is used when parties wish to communicate with assurance that received messages come from the claimed sender without alteration. All of the fastest MACs follow principles developed by Wegman and Carter [3,5,6,7,9,14]. The basic Wegman-Carter message authentication paradigm is for the sender first to hash the message with a hash function known only to himself and the receiver.…”

Section: Introductionmentioning

confidence: 99%

Message Authentication on 64-Bit Architectures

Krovetz

Selected Areas in Cryptography

View full text Add to dashboard Cite

Abstract. This paper introduces VMAC, a message authentication algorithm (MAC) optimized for high performance in software on 64-bit architectures. On the Athlon 64 processor, VMAC authenticates 2KB cache-resident messages at a cost of about 0.5 CPU cycles per message byte (cpb) -significantly faster than other recent MAC schemes such as UMAC (1.0 cpb) and Poly1305 (3.1 cpb). VMAC is a MAC in the Wegman-Carter style, employing a "universal" hash function VHASH, which is fully developed in this paper. VHASH employs a three-stage hashing strategy, and each stage is developed with the goal of optimal performance in 64-bit environments.

show abstract

Badger – A Fast and Provably Secure MAC

Cited by 23 publications

References 18 publications

Pipelineable On-line Encryption

Pipelineable On-line Encryption

On the Minimum Number of Multiplications Necessary for Universal Hash Functions

Message Authentication on 64-Bit Architectures

Contact Info

Product

Resources

About