Authenticated Encryption Algorithm Research Articles

EPri-MDAS: An efficient privacy-preserving multiple data aggregation scheme without trusted authority for fog-based smart grid

With the increasingly pervasive deployment of fog servers, fog computing extends data processing and analysis to network edges. At the same time, as the next-generation power grid, the smart grid should meet the requirements of security, efficiency, and real-time monitoring of user energy consumption. By utilizing the low-latency and distributed properties of fog computing, it can improve communication efficiency and user service satisfaction in smart grids. For the sake of providing adequate functionality for the power grid, various schemes have been proposed. Whereas, many methods are vulnerable to privacy leakage since the existence of trusted authority may increase the exposure to threats. In this paper, we propose the EPri-MDAS: an Efficient Privacy-preserving Multiple Data Aggregation Scheme without trusted authority based on the ElGamal homomorphic cryptosystem, which achieves both data integrity verification and data source authentication with the most efficient block cipher-based authenticated encryption algorithm. It performs well in energy efficiency with strong security. Especially, the proposed multidimensional aggregation statistics scheme can perform the fine-grained data analyses; it also allows for fault tolerance while protecting personal privacy. The security analysis and simulation experiments show that EPri-MDAS can satisfy the security requirements and work efficiently in the smart grid.

A circuit area optimization of MK-3 S-box

In MILCOM 2015, Kelly et al. proposed the authentication encryption algorithm MK-3, which applied the 16-bit S-box. This paper aims to implement the 16-bit S-box with less circuit area. First, we classified the irreducible polynomials over F2n\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{2^n}$$\\end{document} into three kinds. Then we compared the logic gates required for multiplication over the finite field constructed by the three types of irreducible polynomials. According to the comparison result, we constructed the composite fields, F(24)2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{(2^4)^2}$$\\end{document} and F(28)2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{(2^8)^2}$$\\end{document}. Based on the isomorphism of finite fields, the operations over F216\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{2^{16}}$$\\end{document} can be conducted over F(28)2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{(2^8)^2}$$\\end{document}. Similarly, elements over F28\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{2^8}$$\\end{document} can be mapped to the corresponding elements over F(24)2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{(2^4)^2}$$\\end{document}. Next, the SAT solver was used to optimize the operations over smaller field F24\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{2^4}$$\\end{document}. At last, the architecture of the optimized MK-3 S-box was worked out. Compared with the implementation proposed by the original designer, the circuit area of the MK-3 S-box in this paper is reduced by at least 55.9%.

A secure authenticated image encryption scheme based on elliptic curve cryptography

The picture archiving and communication system is a powerful mechanism to store and securely transmit images and reports. The development of a cost-effective encryption algorithm in terms of time and space complexity is needed. Our main goal is to protect the content and integrity of the image being transmitted. We implement an efficient authenticated encryption algorithm based on the Lehmer Random Number Generator, the Sophie Germain Prime Generator and Elliptic Curve Cryptography to transmit the digitally preserved images (including medical) which serves our purpose. Our method achieves randomness along with authentication with the help of random number generator and Elliptic Curve Cryptography which is unique compared to the existing schemes. The performance metrics of the proposed system stay on top of the state-of-the-art techniques that were recently derived. We obtained negative correlation coefficient values of −0.000242, −0.001349, −0.001313 for vertical, horizontal, and diagonal coefficients respectively. This makes our scheme better as it is difficult to find any relationship between the original and encrypted image. On average, our method uses only 10 seconds for encryption using a 521-bit curve.

Description, Implementation and Performance/Security Analysis of ASCON128

The aim of the report is to introduce detailed description of the functioning of and to provide an efficient implementation (using bit-sliced implementation of S-Box) in C of encryption, decryption and authentication of the lightweight authenticated encryption algorithm ASCON 128 (sponge based SPN network based on Keccak like operations) as per the v 1.2 submitted to NIST. This is achieved using a sponge construction by setting up initialization state and performing 12 rounds of permutations, XORing consecutively the plaintext blocks (encryption) or ciphertext blocks (decryption) with first 64 bits of the state (after 6 rounds of sponge permutations) and after all consecutive operations on ciphertext/plaintext blocks, XORing the last 128 bits of the resultant state with the secret Key (after 12 rounds of final permutation operations) to produce/re-create the tag. Discussions on Key Features, Performance Analysis (comparison of ASCON 128 v/s AES 128 in GCM mode on our own PC), Performance Comparisons with other NIST lightweight cryptography contest finalists on ARM Cortex M3, and discussions on the Security Analysis (side channel attacks: fault injection and power analysis) of ASCON are included in this report.

Resource-Efficient Authenticated Data Sharing Mechanism for Smart Wearable Systems

Recent technological developments in the wearable devices (WDs) and smartphones enabled ubiquitous and always-on monitoring of the users' movements. WDs collect the sensitive and personal information associated with a user's health and send the collected information to the user's terminal or smart device (SD). The SD allows the user to store the collected information on the cloud server (CSE) for subsequent sharing with other users, such as doctors. The data storage and sharing process thus performed is prone to various security challenges, which mandate a reliable and authenticated data storage and a secure data sharing mechanism. This paper presents an access control scheme based on an authenticated encryption algorithm, called elliptic curve cryptography, and hash function. The scheme allows users to get authenticated and establish a session key (SK) with CSE. The establishment of SK enables users to securely store the data in the storage module of CSE. Additionally, before storing, the user encrypts the data using a secret key derived from the users' bio-metric information. Moreover, the scheme allows a user to share his data with other users without requiring the security constraints implemented by the cloud service providers. The security of the SK established under the scheme is validated formally through Scyther and the random oracle models. Moreover, informal analysis is conducted, which illustrates that the proposed scheme is resilient against various security attacks. Finally, the proposed scheme is compared with the existing scheme to ensure its efficiency and superior security features.

Low Trace-Count Template Attacks on 32-bit Implementations of ASCON AEAD

The recently adopted Ascon standard by NIST offers a lightweight authenticated encryption algorithm for use in resource-constrained cryptographic devices. To help assess side-channel attack risks of Ascon implementations, we present the first template attack based on analyzing power traces, recorded from an STM32F303 microcontroller board running Weatherley’s 32-bit implementations of Ascon-128. Our analysis combines a fragment template attack with belief-propagation and key-enumeration techniques. The main results are three-fold: (1) we reached 100% success rate from a single trace if the C compiler optimized the unmasked implementation for space, (2) the success rate was about 95% after three traces if the compiler optimized instead for time, and (3) we also attacked a masked version, where the success rate was over 90% with 20 traces of executions with the same key, all after enumerating up to 224 key candidates. These results show that suitably-designed template attacks can pose a real threat to Ascon implementations, even if protected by first-order masking, but we also learnt how some differences in programming style, and even compiler optimization settings, can significantly affect the result.

Lightweight and flexible hardware implementation of authenticated encryption algorithm SIMON‐Galois/Counter Mode

SummaryThis brief proposes a new lightweight authenticated encryption algorithm SIMON‐GCM for Internet of Things (IoT) security, which realizes the combination of SIMON block cipher and Galois/Counter Mode (GCM). The designed SIMON circuit supports 128/192/256‐bit key size, which improves the flexibility and enlarges the range of applications. Moreover, the scheme of 32‐cycle Galois field (GF) multiplier in GF(2128) is adopted to effectively reduce the hardware cost of the Galois Hash (GHASH) function in GCM. At the same time, a finite state machine (FSM) is used to run the SIMON and GHASH modules in parallel, thus shortening the authenticated encryption time. The whole circuit is designed and implemented in field programmable gate array (FPGA) platforms. It is measured to yield a throughput of 32.4 Gbps when consuming 331 slices in Artix‐7. Compared with the existing authenticated encryption algorithms, the proposed algorithm achieves lower resource consumption and better flexibility.

A Break Of Barrier To Classical Differential Fault Attack On The Nonce-Based Authenticated Encryption Algorithm

Abstract It had always been believed that there was an inherent barrier to Differential Fault Attack (DFA) on the nonce-based authenticated encryption algorithm. At CHES 2016, Saha et al. proposed an Internal Differential Fault Attack on a parallelizable counter-mode algorithm. They induce the attack to classical DFA at the expense of one more fault injection in every encryption process. In this paper, we propose the DFA on HYENA, which is a nonce-based authenticated encryption mode for GIFT-128. Our work is the first pure classical DFA on a nonce-based authenticated encryption algorithm with only one fault injected in every decryption process. Firstly, we give the DFA on GIFT-128 with a fault injected into the 39th-round input. Based on this work, we inject a fault in the underlying GIFT-128 of a HYENA decryption process and make this decryption process still generate the correct tag and output plaintext. This makes the necessary conditions of DFA satisfied. Experiments show that at most 56 key bits of HYENA can be recovered with only a few faulty ciphertexts. In addition, our fault injection is easier to achieve than most other work about fault attack, because the injection location is relatively random and the fault type can be arbitrary. It should be noted that the left 72 key bits cannot be recovered in this way.

Universally Composable Oblivious Transfer with Low Communication

In this paper, a universally composable 1-out-of-N oblivious transfer protocol with low communication is built. This protocol obtained full simulation security based on the modulo learning with rounding (Mod-LWR) assumption. It can achieve universally composable security in the random oracle machine (ROM) model by combining random OT based on the key exchange protocol with the authentication encryption algorithm. It can be proven to resist static adversary attacks by simulating all corruption cases. Based on computer simulation and detailed mathematical derivation, this protocol was practicable and had better efficiency and lower communication.

A new anonymous authentication framework for secure smart grids applications

This paper proffers a secure and anonymous authenticated key exchange (AKE) scheme for SGs, called SAAS-SG, for establishing a secure communication channel between smart meter (SM) and service provider (SPR). SAAS-SG utilizes the hash algorithm, Esch256, and authenticated encryption algorithm AEGIS, to perform the AKE process. Besides, SAAS-SG ensures the integrity and confidentiality of AKE messages while preserving the anonymity of SMs and SPR. Besides, for encrypted transmission in the future, SAAS-SG empowers SMs and SPR to set up an analogous secret session key (SK) after performing the mutual authentication. SK encrypts the sensitive information exchanged between SMs and service providers (SPR) over the public Internet. Moreover, we illustrate that SAAS-SG is capable of resisting different security vulnerabilities by conducting informal and Scyther-based security analyses. In addition, the random oracle model is operated to validate the security of the established secret SK. Furthermore, comparing SAAS-SG with other related AKE schemes explicates that SAAS-SG requires low communication, storage, and computational overheads, respectively, while accomplishing the AKE phase and renders enhanced security features.

Plaintext recovery and tag guessing attacks on authenticated encryption algorithm COLM

There are three main approaches related to cryptanalysis of Authenticated Encryption with Associated Data (AEAD) algorithms: Simulating the encryption oracle (universal forgery attack), simulating the decryption oracle (plaintext recovery attack) and producing the valid tag of a given ciphertext (tag guessing attack). In this work, we analyze the security of COLM in these approaches. COLM is one of the AEAD algorithms chosen in the final portfolio for defense-in-depth use case of the CAESAR competition. The ciphers in this portfolio are supposed to provide robust security with their multiple layered defense mechanisms. The main motivation of this work is to examine if COLM indeed satisfies defense-in-depth security. We make cryptanalysis of COLM, particularly in the chosen ciphertext attack (CCA) scenario, once its secret whitening parameter L=EK(0) is recovered. To the best of our knowledge, we give the first example of querying an EME/EMD (Encrypt-linearMix-Encrypt/Decrypt) AEAD scheme in its decryption direction for arbitrary ciphertexts, not produced previously by the oracle, namely either a forgery or tag guessing attack. We construct SEBC/SDBC (Simulation models of the Encryption/Decryption oracles of the underlying Block Cipher) of COLM, thereby forming the first examples of these models of an authenticated EME scheme simultaneously. The combination of our SEBC/SDBC is a powerful tool to mount a universal forgery attack, a tag guessing attack and a plaintext recovery attack. All of these attacks have polynomial time complexities once L is recovered in the offline phase, indicating that the security of COLM against plaintext recovery and tag guessing attacks is limited by the birthday bound. Apart from exploiting SEBC/SDBC, we mount a pair of plaintext recovery attacks and another universal forgery attack. Finally, we make some suggestions to prevent our attacks.

A Single-Pass and One-Round Message Authentication Encryption for Limited IoT Devices

In this work, we propose three efficient variants of a message authentication encryption (MAE) algorithm, which is based on the dynamic key-dependent concept and dynamic operation mode to reach a high level of security. These variants consist of a single pass and a single round, in addition to the use of common operations for the encryption and authentication processes to reduce the required execution time and resources. Accordingly, the proposed scheme outperforms the existing solutions that are based on the static approach with multiple rounds. Furthermore, to reduce the overhead associated with the regeneration of the dynamic key and the corresponding cryptographic primitives, we propose a simple, yet effective update process. In such a scheme, even when the same plaintext is processed, it will be encrypted and authenticated using different cryptographic primitives (substitution and permutation tables in addition to round keys), which guards against the existing cryptanalysis techniques. The experimental results show that the proposed MAE variants are more efficient than the counter with cipher block chaining message authentication code (CCM), Galois message authentication code (GMAC), offset codebook mode (OCB), and the Chacha20-poly1305. The best performance is achieved with the third MAE variant that presents a high throughput with an enhancement of at least 373% compared to CCM, 90% compared to GCM, 23% compared to OCB, and 22% compared to Chacha20-poly1305.

Ascon v1.2: Lightweight Authenticated Encryption and Hashing

Authenticated encryption satisfies the basic need for authenticity and confidentiality in our information infrastructure. In this paper, we provide the specification of Ascon-128 and Ascon-128a. Both authenticated encryption algorithms provide efficient authenticated encryption on resource-constrained devices and on high-end CPUs. Furthermore, they have been selected as the “primary choice” for lightweight authenticated encryption in the final portfolio of the CAESAR competition. In addition, we specify the hash function Ascon-Hash, and the extendable output function Ascon-Xof. Moreover, we complement the specification by providing a detailed overview of existing cryptanalysis and implementation results.

Improved Meet-in-the-Middle Attacks on Reduced-Round Tweakable Block Cipher Deoxys-BC

Abstract Deoxys-BC is an internal tweakable block cipher of the authenticated encryption algorithm Deoxys, which is a third-round finalist in the CAESAR competition. In this paper, we study the property of Deoxys-BC, such as the subtweakey difference cancelation and the freedom of the tweak. Combining the differential enumeration technique with these properties, the authors achieve the key-recovery attacks on Deoxys-BC under the meet-in-the-middle attack. As a result, we get an attack on 9-round Deoxys-BC-128-128 by constructing a 6-round meet-in-the-middle distinguisher with $2^{113}$ plaintext–tweak combinations, $2^{97}$ Deoxys-BC blocks and $2^{121.6}$ 9-round Deoxys-BC-128-128 encryptions. We also present an attack on 11-round Deoxys-BC-256-128 for the first time by constructing a 7-round meet-in-the-middle distinguisher with $2^{113}$ plaintext-tweak combinations, $2^{226}$ Deoxys-BC blocks and $2^{251}$ 11-round Deoxys-BC-256-128 encryptions.

Quantum forgery attacks on COPA, AES-COPA and marble authenticated encryption algorithms

The classic forgery attacks on COPA, AES-COPA and Marble authenticated encryption algorithms need to query about $${2^{n/2}}$$ times, and their success probability is not high. To solve this problem, the corresponding quantum forgery attacks on COPA, AES-COPA and Marble authenticated encryption algorithms are presented. In the quantum forgery attacks on COPA and AES-COPA, we use Simon’s algorithm to find the period of the tag generation function in COPA and AES-COPA by querying in superposition, and then generate a forged tag for a new message. In the quantum forgery attack on Marble, Simon’s algorithm is used to recover the secret parameter L, and the forged tag can be computed with L. Compared with classic forgery attacks on COPA, AES-COPA and Marble, our attack can reduce the number of queries from $$O({2^{n/2}})$$ to O(n) and improve success probability close to 100%.

Improved meet‐in‐the‐middle attacks on reduced‐round Joltik‐BC

Joltik-BC is an internal tweakable block cipher of the authenticated encryption algorithm Joltik, which was a second-round finalist in the CAESAR competition. The authors study the key-recovery attacks on Joltik-BC under meet-in-the-middle attack. Utilising the subtweakey difference cancellation, the freedom of the tweak and the differential enumeration, they attack on nine-round Joltik-BC-64-64 by constructing a precise six-round meet-in-the-middle distinguisher with 253 plaintext–tweak combinations, 252.91 Joltik-BC blocks and 254.1 nine-round Joltik-BC-64-64 encryptions. Moreover, they attempt to attack on 11-round Joltik-BC-128-64 for the first time by constructing a seven-round meet-in-the-middle distinguisher with 253 plaintext–tweak combinations, 2114 Joltik-BC blocks and 2123 11-round Joltik-BC-128-64 encryptions.

Pipelined Hardware Implementation of COPA, ELmD, and COLM

Authenticated encryption algorithms offer privacy, authentication, and data integrity, as well. In recent years, they have received special attention after the call for submissions of Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR) was published. The CAESAR goal is to generate a portfolio with recommendations of authenticated encryption algorithms for three different scenarios: Lightweight, high speed, and defense in deep. ELmD and COPA are two on-line authenticated encryption algorithms submitted to CAESAR; because of their similarities, they were merged as COLM during the third-round of CAESAR. COLM is a finalist in the use case 3 defense in depth . ELmD, COPA, and COLM are based on the ECB-mix-ECB structure, which is highly parallelizable and pipelineable. In this paper, we present optimized single-chip implementations of ELmD, COPA, and COLM using pipelining. For ELmD, we present implementations for eight combinations of its parameters set: For intermediate tags, fixed, variable tag length, and 10 and 6 AES rounds. COLM implementation is for variable tag length without intermediate tags. In the case of COPA, it does not have parameters set. The implementation results with a Xilinx Virtex 6 FPGA show that ELmD is the best option concerning area and speed for single-chip implementation. The area of COPA and COLM are 1.65 and 1.69 times ELmD's respectively. Regarding throughput, the range of our implementations goes from 33.34 Gbits/s for COLM to more than 35 Gbits/s for several versions of ELmD.

Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

SAEAES is the authenticated encryption algorithm instantiated by combining the SAEB mode of operation with AES, and a candidate of the NIST’s lightweight cryptography competition. Using AES gives the advantage of backward compatibility with the existing accelerators and coprocessors that the industry has invested in so far. Still, the newer lightweight block cipher (e.g., GIFT) outperforms AES in compact implementation, especially with the side-channel attack countermeasure such as threshold implementation. This paper aims to implement the first threshold implementation of SAEAES and evaluate the cost we are trading with the backward compatibility. We design a new circuit architecture using the column-oriented serialization based on the recent 3-share and uniform threshold implementation (TI) of the AES S-box based on the generalized changing of the guards. Our design uses 18,288 GE with AES’s occupation reaching 97% of the total area. Meanwhile, the circuit area is roughly three times the conventional SAEB-GIFT implementation (6229 GE) because of a large memory size needed for the AES’s non-linear key schedule and the extended states for satisfying uniformity in TI.

Dumbo, Jumbo, and Delirium: Parallel Authenticated Encryption for the Lightweight Circus

With the trend to connect more and more devices to the Internet, authenticated encryption has become a major backbone in securing the communication, not only between these devices and servers, but also the direct communication among these devices. Most authenticated encryption algorithms used in practice are developed to perform well on modern high-end devices, but are not necessarily suited for usage on resource-constrained devices. We present a lightweight authenticated encryption scheme, called Elephant. Elephant retains the advantages of GCM such as parallelism, but is tailored to the needs of resource-constrained devices. The two smallest instances of Elephant, Dumbo and Jumbo, are based on the 160-bit and 176-bit Spongent permutation, respectively, and are particularly suited for hardware; the largest instance of Elephant, Delirium, is based on 200-bit Keccak and is developed towards software use. All three instances are parallelizable, have a small state size while achieving a high level of security, and are constant time by design.

Isap v2.0

We specify Isap v2.0, a lightweight permutation-based authenticated encryption algorithm that is designed to ease protection against side-channel and fault attacks. This design is an improved version of the previously published Isap v1.0, and offers increased protection against implementation attacks as well as more efficient implementations. Isap v2.0 is a candidate in NIST’s LightWeight Cryptography (LWC) project, which aims to identify and standardize authenticated ciphers that are well-suited for applications in constrained environments. We provide a self-contained specification of the new Isap v2.0 mode and discuss its design rationale. We formally prove the security of the Isap v2.0 mode in the leakage-resilient setting. Finally, in an extensive implementation overview, we show that Isap v2.0 can be implemented securely with very low area requirements.
 https://isap.iaik.tugraz.at