Security Evaluation of Initialization Phases and Round Functions of Rocca and AEGIS

Abstract

Authenticated-Encryption with Associated-Data (AEAD) plays an important role in guaranteeing confidentiality, integrity, and authenticity in network communications. To meet the requirements of high-performance applications, several AEADs make use of AES New Instructions (AES-NI), which can conduct operations of AES encryption and decryption dramatically fast by hardware accelerations. At SAC 2013, Wu and Preneel proposed an AES-based AEAD scheme called AEGIS-128/128L/256, to achieve high-speed software implementation. At FSE 2016, Jean and Nikolić generalized the construction of AEGIS and proposed more efficient round functions. At ToSC 2021, Sakamoto et al. further improved the constructions of Jean and Nikolić, and proposed an AEAD scheme called Rocca for beyond 5G.In this study, we first evaluate the security of the initialization phases of Rocca and AEGIS family against differential and integral attacks using MILP (Mixed Integer Linear Programming) tools. Specifically, according to the evaluation based on the lower bounds for the number of active S-boxes, the initialization phases of AEGIS-128/128L/256 are secure against differential attacks after 4/3/6 rounds, respectively. Regarding integral attacks, we present the integral distinguisher on 6 rounds and 6/5/7 rounds in the initialization phases of Rocca and AEGIS-128/128L/256, respectively. Besides, we evaluate the round function of Rocca and those of Jean and Nikolić as cryptographic permutations against differential, impossible differential, and integral attacks. Our results indicate that, for differential attacks, the growth rate of increasing the number of active S-boxes in Rocca is faster than those of Jean and Nikolić. For impossible differential and integral attacks, we show that the round function of Rocca achieves the sufficient level of the security against these attacks in smaller number of rounds than those of Jean and Nikolić.

MILP‐based security evaluation for AEGIS/Tiaoxin‐346/Rocca

“…According to Section 3.2, Tiaoxin‐346 has a nonce input to T 6 [1], and T 6 [11] and T 6 [1] are only called at least 4 AES round functions in 15 rounds. Because the longest integral distinguisher of AES has been discovered up to 4 rounds [10], we consider that the distinguisher was discovered in 15 rounds that are full rounds.…”

“…Regarding integral attacks, we present integral distinguishers on 6/6/7, 15, and 7 rounds of AEGIS-128/ 128L/256, Tiaoxin-346, and Rocca, respectively. Exploiting the full degree of freedom of nonce, these can improve 1 round of integral distinguishers on AEGIS-128L and Rocca from the results of Takeuchi et al [11], and the first result on integral properties of Tiaoxin-346 (Table 2). The encryption phase.…”

“…Exploiting the full degree of freedom of nonce, these can improve 1 round of integral distinguishers on AEGIS‐128L and Rocca from the results of Takeuchi et al. [11], and the first result on integral properties of Tiaoxin‐346 (Table 2). The encryption phase.…”

“…Recently, Takeuchi et al. evaluated the security against differential attacks [9] and integral attacks [10] for the initialisation phase of AEGIS and Rocca [11]. In designer's evaluations of Tiaoxin‐346, they evaluate differential attacks by active‐sbox evaluation; however, they did not give the detailed lower bounds for the number of active S‐boxes.…”

Key Recovery, Universal Forgery, and Committing Attacks against Revised Rocca: How Finalization Affects Security

“…Takeuchi et al studied the optimality of the round function of Rocca [TSI23a]. See [TSI23b] for the security evaluation…”