Pseudorandom Functions and Permutations Provably Secure against Related-Key Attacks

Abstract

Abstract. This paper fills an important foundational gap with the first proofs, under standard assumptions and in the standard model, of the existence of PRFs and PRPs resisting rich and relevant forms of relatedkey attack (RKA). An RKA allows the adversary to query the function not only under the target key but under other keys derived from it in adversary-specified ways. Based on the Naor-Reingold PRF we obtain an RKA-PRF whose keyspace is a group and that is proven, under DDH, to resist attacks in which the key may be operated on by arbitrary adversary-specified group elements. Our framework yields other RKA-PRFs including a DLIN-based one derived from the LewkoWaters PRF. We show how to turn these PRFs into PRPs (blockciphers) while retaining security against RKAs. Over the last 17 years cryptanalysts and blockcipher designers have routinely and consistenly targeted RKA-security; it is important for abuse-resistant cryptography; and it helps protect against fault-injection sidechannel attacks. Yet ours are the first significant proofs of existence of secure constructs. We warn that our constructs are proofs-of-concept in the foundational style and not practical.

The Related-Key Analysis of Feistel Constructions

“…We now define a sufficient set of restrictions on oracle RKD sets that allow us to prove a ROM analogue of the result by Bellare and Cash [3]. Intuitively the restrictions are strong enough to rule out attacks that follow the above pattern.…”

“…We call this the "Hash-then-PRP" transform. Bellare and Cash [3,Theorem 6.1] prove the soundness of this approach in the standard model for a restricted class of RKD functions, when the hash function is replaced by an RKA-secure pseudorandom generator. At first sight it appears that the ideal hash function (i.e., the random oracle) should be a valid instantiation of this construction.…”

“…The underlying PRG can be instantiated in the standard model via an RKA-secure PRF (e.g., that used in the Luby-Rackoff construction) as suggested in [3] or, stepping outside the standard model, using random oracles.…”

“…3 We are able to prove the RKA security of the three-stage (CPA) and four-stage (CCA) Luby-Rackoff constructions, whilst reducing the amount of key material and potentially improving the efficiency of the resulting implementations.…”

“…It is well known that the F ρ [1,2,3] construction is CCA insecure. For example, the attacker can proceed as follows: 1) Choose arbitrary L, R, L , query RKFn(L, R) to obtain C 1 and query RKFn(L , R) to obtain C 2 ; 2) Query…”