On Optimality of the Round Function of Rocca

TAKEUCHI, Nobuyuki; Sakamoto, Kosei; Isobe, Takanori

doi:10.1587/transfun.2021eap1158

Cited by 3 publications

(4 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although we did not perform a dedicated search to reduce the number of registers used in rate-2 candidates, we note that PetitMac's round function (Figure 3) requires 6 registers in total, and can be implemented without any additional temporary register 8 . Therefore, this improves on the result of Nikolic [Nik17b, Appendix C], which does not find a rate-2 candidate with less than 8 registers; the candidates found may moreover require additional temporary registers in the implementation (see [TSI23] for similar concerns on Rocca). 3 1 A message is added every other round.…”

Section: Results Of the Searchsupporting

confidence: 69%

“…This is the direction taken by the Authenticated Encryption (AE) algorithm Rocca [SLN + 21, SLN + 22] and its updated version Rocca-S [NFI24], currently the fastest AE on AES-NI platforms and under submission at IETF. Recently, the round function framework of Rocca has been further analysed in a work that presents optimal round function candidates (in terms of speed) within the framework [TSI23].…”

Section: Introductionmentioning

confidence: 99%

“…We note that most of these primitives have suboptimal throughputs on some recent processors. For instance, the optimal candidate in the Rocca round function framework [TSI23] reaches a throughput of 0.104 cycles per byte on Tiger Lake, while the maximum theoretical throughput is 0.0625 cycles per byte for any candidate with the same number of AES rounds per 128-bit message, as explained in Section 2.2.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Fast AES-Based Universal Hash Functions and MACs

Bariant,

Baudrin,

Leurent

et al. 2024

ToSC

View full text Add to dashboard Cite

Ultra-fast AES round-based software cryptographic authentication/encryption primitives have recently seen important developments, fuelled by the authenticated encryption competition CAESAR and the prospect of future high-profile applications such as post-5G telecommunication technology security standards. In particular, Universal Hash Functions (UHF) are crucial primitives used as core components in many popular modes of operation for various use-cases, such as Message Authentication Codes (MACs), authenticated encryption, wide block ciphers, etc. In this paper, we extend and improve upon existing design approaches and present a general framework for the construction of UHFs, relying only on the AES round function and 128-bit word-wide XORs. This framework, drawing inspiration from tweakable block ciphers design, allows both strong security arguments and extremely high throughput. The security with regards to differential cryptanalysis is guaranteed thanks to an optimized MILP modelling strategy, while performances are pushed to their limits with a deep study of the details of AES-NI software implementations. In particular, our framework not only takes into account the number of AES-round calls per message block, but also the very important role of XOR operations and the overall scheduling of the computations.We instantiate our findings with two concrete UHF candidates, both requiring only 2 AES rounds per 128-bit message block, and each used to construct two MACs. First, LeMac, a large-state primitive that is the fastest MAC as of today on modern Intel processors, reaching performances of 0.068 c/B on Intel Ice Lake (an improvement of 60% in throughput compared to the state-of-the-art). The second MAC construction, PetitMac, provides an interesting memory/throughput tradeoff, allowing good performances on many platforms.

show abstract

Section: Results Of the Searchsupporting

confidence: 69%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Fast AES-Based Universal Hash Functions and MACs

Bariant,

Baudrin,

Leurent

et al. 2024

ToSC

View full text Add to dashboard Cite

show abstract

“…Shiraya et al analyzed distinguishing attacks on the initialization phase and keystream [STSI23]. Takeuchi et al studied the optimality of the round function of Rocca [TSI23a]. See [TSI23b] for the security evaluation…”

Section: Related Workmentioning

confidence: 99%

Key Recovery, Universal Forgery, and Committing Attacks against Revised Rocca: How Finalization Affects Security

Takeuchi,

Todo,

Iwata

2024

ToSC

View full text Add to dashboard Cite

This paper examines the security of Rocca, an authenticated encryption algorithm designed for Beyond 5G/6G contexts. Rocca has been revised multiple times in the initialization and finalization for security reasons. In this paper, we study how the choice of the finalization affects the overall security of Rocca, covering key recovery, universal forgery, and committing attacks. We show a key-recovery attack faster than the exhaustive key search if a linear key mixing is used in the finalization. We also consider the ideally secure keyed finalization, which prevents key-recovery attacks. We show that, in the nonce-misuse setting, this does not prevent universal forgery with a practical data complexity, although the time complexity is high. Our result on committing attacks shows that none of the versions of Rocca considered in this paper is secure. We complete our analysis by presenting a concrete example of colliding inputs against the designers’ latest version of Rocca in the FROB setting, a strong notion of the committing security. Our analysis significantly improves the key committing attack against Rocca shown in ToSC 2024(1)/FSE 2024.

show abstract