Authenticated Encryption for Very Short Inputs

Abstract

We study authenticated encryption (AE) modes dedicated to very short messages, which are crucial for Internet-of-things applications. Since the existing general-purpose AE modes need at least three block cipher calls for non-empty messages, we explore the design space for AE modes that use at most two calls. We proposed a family of AE modes, dubbed $$\textsf {Manx}$$ , that work when the total input length is less than 2n bits, using an n-bit block cipher. Notably, the second construction of $$\textsf {Manx}$$ can encrypt almost n-bit plaintext and saves one or two block cipher calls from the standard modes, such as $$\textsf{GCM} $$ or $$\textsf{OCB} $$ , keeping the comparable provable security. We also present benchmarks on popular 8/32-bit microprocessors using AES. Our result shows the clear advantage of $$\textsf {Manx}$$ over the previous modes for such short messages.