Gimli : A Cross-Platform Permutation

Bernstein, Daniel J.; Kölbl, Stefan; Lucks, Stefan; Massolino, Pedro Maat C.; Mendel, Florian; Nawaz, Kashif; Schneider, Tobias; Schwabe, Peter; Standaert, François‐Xavier; Todo, Yosuke; Viguier, Benoît

doi:10.1007/978-3-319-66787-4_15

Cited by 65 publications

(54 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…We showcase the practicality of code embedding with a lightweight authenticated encryption (AE) scheme, called Friet. It is permutation-based and uses SpongeWrap [7], a mode on top of the duplex [7] construction, similar to CAE-SAR candidate Ketje [8] NIST lightweight competition submissions Ascon [18], Gimli [4] and Xoodyak [11].…”

Section: The Authenticated Encryption Scheme Frietmentioning

confidence: 99%

“…The permutation in Friet is called Friet-PC and it has a width b of 384 bits, similar to the permutations Gimli [4] and Xoodoo [13].…”

Section: Dimension Parameters and Security Claim For Frietmentioning

confidence: 99%

“…At the primitive level, side channel attack countermeasures have been taken into account by adopting a round function of algebraic degree 2, ideal for masking. This includes the Keccak-f permutation, Ascon [18], Gimli [4] and Xoodoo [13].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Friet: An Authenticated Encryption Scheme with Built-in Fault Detection

Simon

Batina

Daemen

et al. 2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

In this work we present a duplex-based authenticated encryption scheme Friet based on a new permutation called Friet-P. We designed Friet-P with a novel approach for cryptographic permutations and block ciphers that takes fault-attack resistance into account and that we introduce in this paper. In this method, we build a permutation fC to be embedded in a larger one, f. First, we define f as a sequence of steps that all abide a chosen error-correcting code C, i.e., that map C-codewords to C-codewords. Then, we embed fC in f by first encoding its input to an element of C, applying f and then decoding back from C. This last step detects a fault when the output of f is not in C. We motivate the design of the permutation we use in Friet and report on performance in soft-and hardware. We evaluate the fault-detection capabilities of the software and simulated hardware implementations with attacks. Finally, we perform a leakage evaluation.

show abstract

Section: The Authenticated Encryption Scheme Frietmentioning

confidence: 99%

“…The permutation in Friet is called Friet-PC and it has a width b of 384 bits, similar to the permutations Gimli [4] and Xoodoo [13].…”

Section: Dimension Parameters and Security Claim For Frietmentioning

confidence: 99%

See 1 more Smart Citation

Friet: An Authenticated Encryption Scheme with Built-in Fault Detection

Simon

Batina

Daemen

et al. 2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…In SPN cipher, the most popular design of the diffusion layer is based on the mm  matrix over the field () n GF 2 , such sound examples are AES [1], ARIA [2], LED [21] and Gimli [23], employ this kind of diffusion layers, in which the inputs are transformed through several constant multipliers and then to the outputs word-wise. The constant multipliers of () n GF 2 could be treated as special form linear transformations over { , } n 01 .…”

Section: Preliminariesmentioning

confidence: 99%

Provable Security Against Differential Attacks for Generalized SPN Structures

Fan¹

2019

Proceedings of the 2019 International Conference on Computer, Network, Communication and Information Systems (CNCI 2019)

View full text Add to dashboard Cite

In the practice of block cipher design, designers usually choose linear functions over () n GF 2 with large branch numbers to achieve provable security against differential and linear attack. Recently, the Internet-of-Things gives rise to a number of applications that require Lightweight block ciphers, some new extensions of the diffusion layer were proposed, and these diffusion layers are designed by the matrices over commutative rings. Compared with the matrices which were defined over () n GF 2 , these matrices need less cost in hardware implementation and are thus more suitable for lightweight ciphers. In this work, we prove that the SPN structure with an extended diffusion layer provides a provable security against differential attack and linear attack. The probability of each differential of the SPS function is bounded by r p 1 , where p is the maximum differential probability of S-boxes used in the substitution layer, and r denotes the branch number of the diffusion layer. Similarly, the results of maximum linear hull bias could also be obtained. With the application of our method, we give the first security evaluation for some SPS structures with the matrix over () GF 2 against differential attack.

show abstract

“…This is in contrast with the modern trend in cryptography, namely that of permutation based cryptography, where the underlying permutations are particularly developed to be fast in the forward direction, but not necessarily in the inverse direction. Examples of cryptographic permutations include Keccak [12], Gimli [9], and SPONGENT [15].…”

Section: Introductionmentioning

confidence: 99%

How to Build Pseudorandom Functions from Public Random Permutations

Chen

Lambooij

Mennink

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Pseudorandom functions are traditionally built upon block ciphers, but with the trend of permutation based cryptography, it is a natural question to investigate the design of pseudorandom functions from random permutations. We present a generic study of how to build beyond birthday bound secure pseudorandom functions from public random permutations. We first show that a pseudorandom function based on a single permutation call cannot be secure beyond the 2 n/2 birthday bound, where n is the state size of the function. We next consider the Sum of Even-Mansour (SoEM) construction, that instantiates the sum of permutations with the Even-Mansour construction. We prove that SoEM achieves tight 2n/3-bit security if it is constructed from two independent permutations and two randomly drawn keys. We also demonstrate a birthday bound attack if either the permutations or the keys are identical. Finally, we present the Sum of Key Alternating Ciphers (SoKAC) construction, a translation of Encrypted Davies-Meyer Dual to a public permutation based setting, and show that SoKAC achieves tight 2n/3-bit security even when a single key is used.

show abstract

Gimli : A Cross-Platform Permutation

Cited by 65 publications

References 20 publications

Friet: An Authenticated Encryption Scheme with Built-in Fault Detection

Friet: An Authenticated Encryption Scheme with Built-in Fault Detection

Provable Security Against Differential Attacks for Generalized SPN Structures

How to Build Pseudorandom Functions from Public Random Permutations

Contact Info

Product

Resources

About