Forkcipher: A New Primitive for Authenticated Encryption of Very Short Messages

Abstract

Highly efficient encryption and authentication of short messages is an essential requirement for enabling security in constrained scenarios such as the CAN FD in automotive systems (max. message size 64 bytes), massive IoT, critical communication domains of 5G, and Narrowband IoT, to mention a few. In addition, one of the NIST lightweight cryptography project requirements is that AEAD schemes shall be "optimized to be efficient for short messages (e.g., as short as 8 bytes)". In this work we introduce and formalize a novel primitive in symmetric cryptography called a forkcipher. A forkcipher is a keyed function expanding a fixed-length input to a fixed-length output. We define its security as indistinguishability under chosen ciphertext attack. We give a generic construction validation via the new iterate-fork-iterate design paradigm. We then propose ForkSkinny as a concrete forkcipher instance with a public tweak and based on SKINNY: a tweakable lightweight block cipher constructed using the TWEAKEY framework. We conduct extensive cryptanalysis of ForkSkinny against classical and structurespecific attacks. We demonstrate the applicability of forkciphers by designing three new provably-secure, nonce-based AEAD modes which offer performance and security tradeoffs and are optimized for efficiency of very short messages. Considering a reference block size of 16 bytes, and ignoring possible hardware optimizations, our new AEAD schemes beat the best SKINNY-based AEAD modes. More generally, we show forkciphers are suited for lightweight applications dealing with predominantly short messages, while at the same time allowing handling arbitrary messages sizes. Furthermore, our hardware implementation results show that when we exploit the inherent parallelism of ForkSkinny we achieve the best performance when directly compared with the most efficient mode instantiated with the SKINNY block cipher.

Exploring Lightweight Efficiency of ForkAES

“…A schematic illustration is given in Fig. 1, and more details can be found in [9]. The designers of ForkAES propose two modes of operations using the fork cipher SAEF and PAEF.…”

“…In order to derive a single metric for strict comparison, we take the average of energy consumed by each ForkAES encryption E, decryption D 0 and reconstruction R 0 operations. Our choice of this metric is justified by the fact that the proposed modes of operations SAEF and PAEF by Andreeva et al [9] make the following number of ForkAES calls for a message of m blocks and an associated data of a blocks 3 :…”

“…Accordingly, the recently started NIST lightweight cryptography project specifies that AEAD submissions should be "optimized to be efficient for short messages (e.g., as short as 8 bytes)" [8]. ForkAES was proposed by Andreeva et al in [9] as a solution for the above. ForkAES is a tweakable forkcipher, which is basically a tweakable blockcipher that uses the AES round function to produce two blocks of ciphertext.…”

“…Exact descriptions of the three algorithms E, D 0 , R 0 used in SAEF and PAEF forkable modes of operations from[9]. Here, R denotes the round function, i.e.…”

Cryptanalysis of Forkciphers

“…Andreeva et. al have proposed two dedicated forkciphers using this framework: ForkAES [ARVV18] based on the AES round function [DR13], and ForkSkinny [ALP + 19a, ALP + 19b] based on the Skinny round function [BJK + 16]. ForkSkinny has been submitted to the NIST Lightweight Cryptography standardization process and has been selected to the second round.…”