Dumbo, Jumbo, and Delirium: Parallel Authenticated Encryption for the Lightweight Circus

Abstract

With the trend to connect more and more devices to the Internet, authenticated encryption has become a major backbone in securing the communication, not only between these devices and servers, but also the direct communication among these devices. Most authenticated encryption algorithms used in practice are developed to perform well on modern high-end devices, but are not necessarily suited for usage on resource-constrained devices. We present a lightweight authenticated encryption scheme, called Elephant. Elephant retains the advantages of GCM such as parallelism, but is tailored to the needs of resource-constrained devices. The two smallest instances of Elephant, Dumbo and Jumbo, are based on the 160-bit and 176-bit Spongent permutation, respectively, and are particularly suited for hardware; the largest instance of Elephant, Delirium, is based on 200-bit Keccak and is developed towards software use. All three instances are parallelizable, have a small state size while achieving a high level of security, and are constant time by design.

Algebraic Collision Attacks on Keccak

“…For instance, the permutations Keccak-f [200] or Keccak-f [400] are used in a proposal in an unkeyed mode for RFID [KY10]. For different number of rounds n r , the permutations Keccak-p[200, n r ] and Keccak-p[400, n r ] also appear in keyed mode proposals, such as Ketje [BDP + 16] in the CAESAR competition or ISAP [DEM + 20] and Elephant [BCDM20] in the NIST lightweight cryptography competition. Finding a collision on the function using a round-reduced version of Keccak[40,160] reduced to two rounds is a problem that was posed by the Keccak designers in their Crunchy Contest [BDPA08b].…”

“…It has thus been suggested to use the smallest versions of Keccak in constrained environments [KY10]. Moreover, the permutations of the smallest instances, namely Keccak-p[200, n r ] and Keccak-p[400, n r ] are used as building blocks for some Authenticated Encryption algorithms for different numbers of rounds n r , such as Ketje [BDP + 16] and two proposals present in the second round of the NIST lightweight competition that started in 2018; ISAP [DEM + 20] and Elephant [BCDM20]. On the other hand, one can notice that cryptanalysts of Keccak have mainly targeted the standards [oST15].…”

Designing tweakable enciphering schemes using public permutations

“…In fact, in the first round of the ongoing NIST lightweight competition [47], 24 out of 57 submitted constructions are based on cryptographic permutations, and out of 24, 16 permutation based proposals have qualified for round 2. These statistics, beyond any doubt, clearly depict the wide adoption of permutation based schemes [3,4,9,15,26,32] in parallel to the block cipher based designs. Apart from the modes, several cryptographic permutations have also been designed which are claimed to be efficient than standard block ciphers [8,13,4].…”

Thinking Outside the Superbox

“…It gets its diffusion from the combination of a smart choice of the bit shuffle and specific propagation criteria from its wellchosen S-box and doing many rounds. The Present line of design has also been refined in the form of the Gift (64-and 128-bit) block ciphers [1] and the cryptographic permutations of the Spongent lightweight hash function [9] that is used in Elephant [7].…”