Rocca: An Efficient AES-based Encryption Scheme for Beyond 5G

Abstract

In this paper, we present an AES-based authenticated-encryption with associated-data scheme called Rocca, with the purpose to reach the requirements on the speed and security in 6G systems. To achieve ultra-fast software implementations, the basic design strategy is to take full advantage of the AES-NI and SIMD instructions as that of the AEGIS family and Tiaoxin-346. Although Jean and Nikolić have generalized the way to construct efficient round functions using only one round of AES (aesenc) and 128-bit XOR operation and have found several efficient candidates, there still seems to exist potential to further improve it regarding speed and state size. In order to minimize the critical path of one round, we remove the case of applying both aesenc and XOR in a cascade way for one round. By introducing a cost-free block permutation in the round function, we are able to search for candidates in a larger space without sacrificing the performance. Consequently, we obtain more efficient constructions with a smaller state size than candidates by Jean and Nikolić. Based on the newly-discovered round function, we carefully design the corresponding AEAD scheme with 256-bit security by taking several reported attacks on the AEGIS family and Tiaxion-346 into account. Our AEAD scheme can reach 138Gbps which is 4 times faster than the AEAD scheme of SNOW-V. Rocca is also much faster than other efficient schemes with 256-bit key length, e.g. AEGIS-256 and AES-256-GCM. As far as we know, Rocca is the first dedicated cryptographic algorithm targeting 6 systems, i.e., 256-bit key length and the speed of more than 100 Gbps.

On Optimality of the Round Function of Rocca

“…In Sect.2, we describe AES-NI and the security evaluation against a forgery attack by internal collision which is used as the security criterion in this paper. We describe the design requirements of the round function of Jean and Nicolić [8] and Sakamoto et al [14], and the round function of Rocca is explained in Sect.3. We provide new representation of the round function of Rocca using matrices and present the new requirements in Sect.4.…”

“…1 The pipeline processing of AESENC on Intel Ice Lake. et al [14]. They searched for round functions that, when applied as a component in AEADs, guarantee 128-bit security against a forgery attack.…”

“…Basically, when all S-boxes are independent of each other, we can estimate the differential probability of the entire round function by the product of the differential probability of all active S-boxes. We can apply this method to our round function because, for differential propagation, all S-boxes are independent of each other [8,14]. Let 𝐷𝑃 𝐹 𝑅 and 𝐷𝑃 𝑠 be the differential probabilities of the whole round function and S-box, respectively.…”

“…In this section, we describe two previous works by Jean and Nicolić [8] and Sakamoto et al [14], both of which focus on the construction of the round function based on sponge construction for AEADs. Before beginning to explain their work, let #𝑠𝑡𝑎𝑡𝑒, #𝐴𝐸 𝑆𝐸 𝑁𝐶, and #𝑚𝑒𝑠𝑠𝑎𝑔𝑒 respectively be the number of states, AESENCs, and inserted messages in a single round.…”

“…Subsequently, Sakamoto et al improved it regarding speed and state size. To minimize the critical path of one round, they removed the case of cascading both aesenc and XOR for one round [14]. By introducing a cost-free block permutation in the round function, they could search for candidates in a larger space without sacrificing performance.…”