Spook: Sponge-Based Leakage-Resistant Authenticated Encryption with a Masked Tweakable Block Cipher

Abstract

This paper defines Spook: a sponge-based authenticated encryption with associated data algorithm. It is primarily designed to provide security against side-channel attacks at a low energy cost. For this purpose, Spook is mixing a leakageresistant mode of operation with bitslice ciphers enabling efficient and low latency implementations. The leakage-resistant mode of operation leverages a re-keying function to prevent differential side-channel analysis, a duplex sponge construction to efficiently process the data, and a tag verification based on a Tweakable Block Cipher (TBC) providing strong data integrity guarantees in the presence of leakages. The underlying bitslice ciphers are optimized for the masking countermeasures against side-channel attacks. Spook is an efficient single-pass algorithm. It ensures state-of-the-art black box security with several prominent features: (i) nonce misuse-resilience, (ii) beyond-birthday security with respect to the TBC block size, and (iii) multiuser security at minimum cost with a public tweak. Besides the specifications and design rationale, we provide first software and hardware implementation results of (unprotected) Spook which confirm the limited overheads that the use of two primitives sharing internal components imply. We also show that the integrity of Spook with leakage, so far analyzed with unbounded leakages for the duplex sponge and a strongly protected TBC modeled as leak-free, can be proven with a much weaker unpredictability assumption for the TBC. We finally discuss external cryptanalysis results and tweaks to improve both the security margins and efficiency of Spook.

New Results on Gimli: Full-Permutation Distinguishers and Improved Collisions

“…Though our results do not pose a direct threat to the Gimli NIST candidate, low-complexity full-round distinguishers on the permutation or reduced-round attacks for a high proportion of the rounds (specially when not predicted by the designers) have been considered in some cases as an issue worth countering by proposing a tweak, as can be seen for instance in the modification [3] recently proposed by the Spook team [2] to protect against the cryptanalysis results from [15].…”

“…Linear trails of the (double) SP-box We begin by studying the linear trails of the SP-Box. Since the Gimli permutation mainly uses the composition of the SP-Box with itself, we focus on the "double" SP-Box SP 2 .…”

Status report on the second round of the NIST lightweight cryptography standardization process

“…Spook, designed by Bellizia et al [60], is an AEAD based on the duplex mode of operation [80], where the Shadow-512 permutation or the Shadow-384 permutation is used with strengthened initialization and finalization phases using the tweakable block cipher Clyde-128.…”

“…Tweak plan. The designers considered two possible tweaks [23,219] for improving the security margins of Spook against the collision attack [218] of Crypto 2020 against a reduced-round Shadow: (1) changing the diffusion layer with an efficient MDS matrix and (2) updating the round constants.…”

A Flexible Gimli Hardware Implementation in FPGA and Its Application to RFID Authentication Protocols

“…The permutation function in Gimli acts as the fundamental task for both AE and hashing, which is similar to other popular lightweight AE schemes (e.g. Ascon [27], Spook [28], and Skinny [29]). The Gimli permutation function comprises 24 rounds, where the main operations in each round are the logic functions, shift/rotate, or swap.…”