ManTiCore: Encryption with Joint Cipher-State Authentication

Anderson, Erik; Beaver, Cheryl; Draelos, Timothy J.; Schroeppel, Richard; Torgerson, Mark Dolan

doi:10.1007/978-3-540-27800-9_38

Cited by 4 publications

(6 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It also allows for a scheme that does not need the inverse of the block cipher in decryption. In order to achieve integrity of COBRA, we utilize the checksum of intermediate state values of the Feistel structure, which is similar to a technique proposed by Anderson et al in their ManTiCore design [1].…”

Section: Introductionmentioning

confidence: 99%

COBRA: A Parallelizable Authenticated Online Cipher Without Block Cipher Inverse

Andreeva

Luykx

Mennink

et al. 2015

Fast Software Encryption

View full text Add to dashboard Cite

Abstract. We present a new, misuse-resistant scheme for online authenticated encryption, following the framework set forth by Fleischmann et al. (FSE 2012). Our scheme, COBRA, is roughly as efficient as the GCM mode of operation for nonce-based authenticated encryption, performing one block cipher call plus one finite field multiplication per message block in a parallelizable way. The major difference from GCM is that COBRA preserves privacy up to prefix under nonce repetition. However, COBRA only provides authenticity against nonce-respecting adversaries. As compared to COPA (ASIACRYPT 2013), our new scheme requires no block cipher inverse and hence enjoys provable security under a weaker assumption about the underlying block cipher. In addition, COBRA can possibly perform better than COPA on platforms where finite field multiplication can be implemented faster than the block cipher in use, since COBRA essentially replaces half of the block cipher calls in COPA with finite field multiplications.

show abstract

Section: Introductionmentioning

confidence: 99%

COBRA: A Parallelizable Authenticated Online Cipher Without Block Cipher Inverse

Andreeva

Luykx

Mennink

et al. 2015

Fast Software Encryption

View full text Add to dashboard Cite

show abstract

“…Related work. An AE design which bears similarities with our forkcipher idea is Manticore [8] (the CS scheme). They use the middle state of a block cipher to evaluate a polynomial hash function for authentication purposes.…”

Section: Contributionmentioning

confidence: 99%

“…Yet, the fundamental difference with our design is that we use a different framework (TWEAKEY [37]) which considers the nonce and key together and injects a transformation of those throughout the forkcipher rounds. Moreover, it seems impossible to describe the latter designs ( [8], [14]) as neither primitives nor modes with clearly defined security goals, whereas our approach aims the opposite.…”

Section: Contributionmentioning

confidence: 99%

“…As can be seen on Figure 19, during the AddRoundTweakey step the first two rows of each tweakey are exclusive-ored together and then to the internal state. To update the tweakey arrays for the next round, each tweakey word is first modified by a cell-permutation P T , given by: [9,15,8,13,10,14,12,11,0,1,2,3,4,5,6,7] and which effect on the cell positioning is as follows: Each cell (except the ones in TK1) is then linearly modified by a LFSR, following the definitions given in Table 3. Table 3: LFSR used to update T K2 and T K3.…”

Section: F1 Detailed Description Of Forkskinnymentioning

confidence: 99%

See 1 more Smart Citation

Forkcipher: A New Primitive for Authenticated Encryption of Very Short Messages

Andreeva

Lallemand

Purnal

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Highly efficient encryption and authentication of short messages is an essential requirement for enabling security in constrained scenarios such as the CAN FD in automotive systems (max. message size 64 bytes), massive IoT, critical communication domains of 5G, and Narrowband IoT, to mention a few. In addition, one of the NIST lightweight cryptography project requirements is that AEAD schemes shall be "optimized to be efficient for short messages (e.g., as short as 8 bytes)". In this work we introduce and formalize a novel primitive in symmetric cryptography called a forkcipher. A forkcipher is a keyed function expanding a fixed-length input to a fixed-length output. We define its security as indistinguishability under chosen ciphertext attack. We give a generic construction validation via the new iterate-fork-iterate design paradigm. We then propose ForkSkinny as a concrete forkcipher instance with a public tweak and based on SKINNY: a tweakable lightweight block cipher constructed using the TWEAKEY framework. We conduct extensive cryptanalysis of ForkSkinny against classical and structurespecific attacks. We demonstrate the applicability of forkciphers by designing three new provably-secure, nonce-based AEAD modes which offer performance and security tradeoffs and are optimized for efficiency of very short messages. Considering a reference block size of 16 bytes, and ignoring possible hardware optimizations, our new AEAD schemes beat the best SKINNY-based AEAD modes. More generally, we show forkciphers are suited for lightweight applications dealing with predominantly short messages, while at the same time allowing handling arbitrary messages sizes. Furthermore, our hardware implementation results show that when we exploit the inherent parallelism of ForkSkinny we achieve the best performance when directly compared with the most efficient mode instantiated with the SKINNY block cipher.

show abstract

“…Finally, given the landscape of cryptographic algorithms, we have chosen to not pursue patents on these new algorithms so as not to contribute to the current patent minefield. This report covers a superset of our work that was published in [1].…”

Section: Contents 1 Introductionmentioning

confidence: 95%

Manticore and CS mode : parallelizable encryption with joint cipher-state authentication.

Torgerson¹,

Draelos²,

Schroeppel³

et al. 2004

Self Cite

View full text Add to dashboard Cite

We describe a new mode of encryption with inexpensive authentication, which uses information from the internal state of the cipher to provide the authentication. Our algorithms have a number of benefits: 1) the encryption has properties similar to CBC mode, yet the encipherment and authentication can be parallelized and/or pipelined, 2) the authentication overhead is minimal, and 3) the authentication process remains resistant against some IV reuse. We offer a Manticore class of authenticated encryption algorithms based on cryptographic hash functions, which support variable block sizes up to twice the hash output length and variable key lengths. A proof of security is presented for the MTC4 and Pepper algorithms. We then generalize the construction to create the Cipher-State (CS) mode of encryption that uses the internal state of any round-based block cipher as an authenticator. We provide hardware and software performance estimates for all of our constructions and give a concrete example of the CS mode of encryption that uses AES as the encryption primitive and adds a small speed overhead (10-15%) compared to AES alone.3

show abstract

ManTiCore: Encryption with Joint Cipher-State Authentication

Cited by 4 publications

References 14 publications

COBRA: A Parallelizable Authenticated Online Cipher Without Block Cipher Inverse

COBRA: A Parallelizable Authenticated Online Cipher Without Block Cipher Inverse

Forkcipher: A New Primitive for Authenticated Encryption of Very Short Messages

Manticore and CS mode : parallelizable encryption with joint cipher-state authentication.

Contact Info

Product

Resources

About