Counter Mode Research Articles

Provably secure counter mode with related-key-based internal re-keying

Block cipher cryptanalysis in related-key adversary model is usually underestimated, since it is believed that the conditions of this model could be hardly achieved in practice. Nevertheless, the use of keys with known relation between them (e.g. for constructing a lightweight key-derivation procedure) in the cryptographic schemes and protocols could allow to increase their efficiency without significant security loss. In this case base cryptographic primitives (e.g. block ciphers) must be secure in a strong enough related-key adversary model. We propose a new internally re-keyed block cipher mode of operation called CTRR (”CounTer with Related-key Re-keying mode”). We prove its security under the assumption that the underlying cipher is secure in the related-key adversary model. As far as the authors know, this mode is the first block cipher encryption mode whose proven cryptographic properties are essentially based on the related-key security of the underlying primitives. We also study the security of the Kuznyechik block cipher against the related-key attack. We have managed to propose the attack only on the essentially reduced (up to 4 rounds and with significantly simplified key schedule) variant of the Kuznyechik cipher. The attack requires approximately $$2^{12}$$ encryptions under $$2^{12}$$ related keys and $$2^{43}$$ offline encryptions to recover the secret key. We also discuss why extending such an approach to the original cipher seems to be impossible. We use these heuristic reasoning to make an assumption that the cipher is secure in the corresponding adversary model and can be used with the proposed mode. At the same time, of course, the related-key cryptanalysis of the Kuznyechik cipher has to be continued. The results were originally presented at the CTCrypt’2018 workshop.

Saturnin: a suite of lightweight symmetric algorithms for post-quantum security

The cryptographic algorithms needed to ensure the security of our communications have a cost. For devices with little computing power, whose number is expected to grow significantly with the spread of the Internet of Things (IoT), this cost can be a problem. A simple answer to this problem is a compromise on the security level: through a weaker round function or a smaller number of rounds, the security level can be decreased in order to cheapen the implementation of the cipher. At the same time, quantum computers are expected to disrupt the state of the art in cryptography in the near future. For public key cryptography, the NIST has organized a dedicated process to standardize new algorithms. The impact of quantum computing is harder to assess in the symmetric case but its study is an active research area. In this document, we specify a new block cipher, Saturnin, and its usage in different modes to provide hashing and authenticated encryption in such a way that we can rigorously argue its security in the post-quantum setting. Its security analysis follows naturally from that of the AES, while our use of components that are easily implemented in a bitsliced fashion ensures a low cost for our primitives. Our aim is to provide a new lightweight suite of algorithms that performs well on small devices, in particular micro-controllers, while providing a high security level even in the presence of quantum computers. Saturnin is a 256-bit block cipher with a 256-bit key and an additional 9-bit parameter for domain separation. Using it, we built two authenticated ciphers and a hash function. • Saturnin-CTR-Cascade is an authenticated cipher using the counter mode and a separate MAC. It requires two passes over the data but its implementation does not require the inverse block cipher. • Saturnin-Short is an authenticated cipher intended for messages with a length strictly smaller than 128 bits which uses only one call to Saturnin to provide confidentiality and integrity. • Saturnin-Hash is a 256-bit hash function. In this document, we specify this suite of algorithms and argue about their security in both the classical and the post-quantum setting.

Saturnin: a suite of lightweight symmetric algorithms for post-quantum security

The cryptographic algorithms needed to ensure the security of our communications have a cost. For devices with little computing power, whose number is expected to grow significantly with the spread of the Internet of Things (IoT), this cost can be a problem. A simple answer to this problem is a compromise on the security level: through a weaker round function or a smaller number of rounds, the security level can be decreased in order to cheapen the implementation of the cipher. At the same time, quantum computers are expected to disrupt the state of the art in cryptography in the near future. For public-key cryptography, the NIST has organized a dedicated process to standardize new algorithms. The impact of quantum computing is harder to assess in the symmetric case but its study is an active research area.In this paper, we specify a new block cipher, Saturnin, and its usage in different modes to provide hashing and authenticated encryption in such a way that we can rigorously argue its security in the post-quantum setting. Its security analysis follows naturally from that of the AES, while our use of components that are easily implemented in a bitsliced fashion ensures a low cost for our primitives. Our aim is to provide a new lightweight suite of algorithms that performs well on small devices, in particular micro-controllers, while providing a high security level even in the presence of quantum computers. Saturnin is a 256-bit block cipher with a 256-bit key and an additional 9-bit parameter for domain separation. Using it, we built two authenticated ciphers and a hash function.• Saturnin-CTR-Cascade is an authenticated cipher using the counter mode and a separate MAC. It requires two passes over the data but its implementation does not require the inverse block cipher.• Saturnin-Short is an authenticated cipher intended for messages with a length strictly smaller than 128 bits which uses only one call to Saturnin to providenconfidentiality and integrity.• Saturnin-Hash is a 256-bit hash function. In this paper, we specify this suite of algorithms and argue about their security in both the classical and the post-quantum setting.
 https://project.inria.fr/saturnin/

The Counter mode with encrypted nonces and its extension to authenticated encryption

В модифицированном режиме CTR (счетчика), известном как CTR2, синхропосылки зашифровываются перед тем, как по ним строятся последовательности счетчиков. Гарантии неперекрытия последовательностей становятся вероятностными. Показано, что эти гарантии, а следовательно, и гарантии стойкости CTR2, достаточно высоки в двух стандартных сценариях: случайные синхропосылки и неповторяющиеся синхропосылки. Предложен способ расширения CTR2 до режима аутентифицированного шифрования Counter-Hash-Encrypt (CHE). В CHE дополнительно к CTR2 требуются одно полиномиальное хэширование и одно зашифрование блока.

Highly Efficient Implementation of Block Ciphers on Graphic Processing Units for Massively Large Data

With the advent of IoT and Cloud computing service technology, the size of user data to be managed and file data to be transmitted has been significantly increased. To protect users’ personal information, it is necessary to encrypt it in secure and efficient way. Since servers handling a number of clients or IoT devices have to encrypt a large amount of data without compromising service capabilities in real-time, Graphic Processing Units (GPUs) have been considered as a proper candidate for a crypto accelerator for processing a huge amount of data in this situation. In this paper, we present highly efficient implementations of block ciphers on NVIDIA GPUs (especially, Maxwell, Pascal, and Turing architectures) for environments using massively large data in IoT and Cloud computing applications. As block cipher algorithms, we choose AES, a representative standard block cipher algorithm; LEA, which was recently added in ISO/IEC 29192-2:2019 standard; and CHAM, a recently developed lightweight block cipher algorithm. To maximize the parallelism in the encryption process, we utilize Counter (CTR) mode of operation and customize it by using GPU’s characteristics. We applied several optimization techniques with respect to the characteristics of GPU architecture such as kernel parallelism, memory optimization, and CUDA stream. Furthermore, we optimized each target cipher by considering the algorithmic characteristics of each cipher by implementing the core part of each cipher with handcrafted inline PTX (Parallel Thread eXecution) codes, which are virtual assembly codes in CUDA platforms. With the application of our optimization techniques, in our implementation on RTX 2070 GPU, AES and LEA show up to 310 Gbps and 2.47 Tbps of throughput, respectively, which are 10.7% and 67% improved compared with the 279.86 Gbps and 1.47 Tbps of the previous best result. In the case of CHAM, this is the first optimized implementation on GPUs and it achieves 3.03 Tbps of throughput on RTX 2070 GPU.

A robust meaningful image encryption scheme based on block compressive sensing and SVD embedding

In this paper, an efficient and robust meaningful image encryption (MIE) scheme is developed by combining block compressive sensing (BCS) and singular value decomposition (SVD) embedding. This work devotes to the balanced performance of security, compression, robustness and running efficiency. First, the plain image is divided equally and sparsely represented in discrete cosine transform (DCT) domain, and the coefficient vectors are confused using the coefficient random permutation (CRP) strategy and encrypted into a secret image by compressive sensing. Next, SVD embedding is employed to embed the secret image into a carrier image to create the final meaningful cipher image. In pursuit of superior security, the hyper-chaotic Lorenz system is utilized to generate the updated secret code streams for encryption and embedding with assistance from the counter mode. This scheme is suitable for processing the medium and large images in parallel. Additionally, it exhibits superior robustness and efficiency compared with existing related schemes. Simulation results and comprehensive performance analyses are presented to demonstrate the effectiveness, secrecy and robustness of the proposed scheme.

PAGE—Practical AES-GCM Encryption for Low-End Microcontrollers

An optimized AES (Advanced Encryption Standard) implementation of Galois Counter Mode of operation (GCM) on low-end microcontrollers is presented in this paper. Two optimization methods are applied to proposed implementations. First, the AES counter (CTR) mode of operation is speed-optimized and ensures constant timing. The main idea is replacing expensive AES operations, including AddRound Key, SubBytes, ShiftRows, and MixColumns, into simple look-up table access. Unlike previous works, the look-up table does not require look-up table updates during the entire encryption life-cycle. Second, the core operation of Galois Counter Mode (GCM) is optimized further by using Karatsuba algorithm, compact register utilization, and pre-computed operands. With above optimization techniques, proposed AES-GCM on 8-bit AVR (Alf and Vegard’s RISC processor) architecture from short-term, middle-term to long-term security levels achieved 415, 466, and 477 clock cycles per byte, respectively.

Fast Number Theoretic Transform for Ring-LWE on 8-bit AVR Embedded Processor.

In this paper, we optimized Number Theoretic Transform (NTT) and random sampling operations on low-end 8-bit AVR microcontrollers. We focused on the optimized modular multiplication with secure countermeasure (i.e., constant timing), which ensures high performance and prevents timing attack and simple power analysis. In particular, we presented combined Look-Up Table (LUT)-based fast reduction techniques in a regular fashion. This novel approach only requires two times of LUT access to perform the whole modular reduction routine. The implementation is carefully written in assembly language, which reduces the number of memory access and function call routines. With LUT-based optimization techniques, proposed NTT implementations outperform the previous best results by 9.0% and 14.6% for 128-bit security level and 256-bit security level, respectively. Furthermore, we adopted the most optimized AES software implementation to improve the performance of pseudo random number generation for random sampling operation. The encryption of AES-256 counter (CTR) mode used for random number generator requires only 3184 clock cycles for 128-bit data input, which is 9.5% faster than previous state-of-art results. Finally, proposed methods are applied to the whole process of Ring-LWE key scheduling and encryption operations, which require only 524,211 and 659,603 clock cycles for 128-bit security level, respectively. For the key generation of 256-bit security level, 1,325,171 and 1,775,475 clock cycles are required for H/W and S/W AES-based implementations, respectively. For the encryption of 256-bit security level, 1,430,601 and 2,042,474 clock cycles are required for H/W and S/W AES-based implementations, respectively.

A New Method for Format Preserving Encryption in High-Data Rate Communications

In some encryption systems it is necessary to preserve the format and length of the encrypted data. This kind of encryption is called FPE (Format Preserving Encryption). Currently, only two AES (Advanced Encryption Standard) modes of operation recommended by the NIST (National Institute of Standards and Technology) are able to implement FPE algorithms, FF1 and FF3. These modes work in an electronic codebook fashion and can be configured to encrypt databases with an arbitrary format and length. However, there are no stream cipher proposals able to implement FPE encryption for high data rate information flows. The main novelty of this work is a new block cipher operation mode proposal to implement an FPE algorithm in a stream cipher fashion. It has been called CTR-MOD and it is based on a standard block cipher working in CTR (Counter) mode and a modulo operation. The confidentiality of this mode is analyzed in terms of its IND- CPA (Indistinguishability under Chosen Plaintext Attack) advantage of any adversary attacking it. Moreover, the encryption scheme has been implemented on an FPGA (Field Programmable Gate Array) and has been integrated in a Gigabit Ethernet interface to test an encrypted optical link with a real high data rate traffic flow.

Architectural Optimization of Parallel Authenticated Encryption Algorithm for Satellite Application

High-speed data communication is becoming essential for many applications, including satellite communication. The security algorithms associated with the communication of information are also required to have high-speed for coping up with the communication speed. Moreover, the Authenticated Encryption (AE) algorithms provide high-speed communication and security services include data encryption, authentication, and integrity. The AE algorithms are available with serial and parallel architectures; among them, the Galois Counter Mode (GCM) algorithm has a parallel architecture. The Synthetic Initialization Vector (SIV) mode in the AES-GCM-SIV algorithm provides the nonce misuse protection using the GCM algorithm. Besides, reduced data throughput is provided using the AES-GCM-SIV algorithm as compared to the AES-GCM algorithm. This work introduced a parallel algorithm with re-keying and randomization of the initialization vector for high data throughput, nonce misuse protection, and side-channel attack protection. The implementation of the proposed algorithm is performed on Field Programmable Gate Array (FPGA) and it’s compared with the FPGA implementations of AES-GCM, AES-GCM-SIV, and recently introduced algorithms. The optimization of the proposed algorithm and security analysis is presented for space application using different optimizations and a combination of optimizations.

Reliable Architecture-Oblivious Error Detection Schemes for Secure Cryptographic GCM Structures

To augment the confidentiality property provided by block ciphers with authentication, the Galois Counter Mode (GCM) has been standardized by the National Institute of Standards and Technology. The GCM is used as an add-on to 128-bit block ciphers, such as the Advanced Encryption Standard (AES), SMS4, or Camellia, to verify the integrity of data. Prior works on the error detection of the GCM either use linear codes to protect the GCM architectures or are based on AES–GCM architectures, confining the mechanisms to the AES block cipher. Although such structures are efficient, they are not only confined to specific architectures of the GCM but might also not fully take advantage of the parallel architectures of the GCM. Moreover, linear codes have been shown to be potentially ineffective with respect to biased faults. In this paper, we propose algorithm-oblivious constructions through recomputing with swapped ciphertext and additional authenticated blocks, which can be applied to the GCM architectures using different finite field multipliers in $GF(2^{128})$ . Such obliviousness for the proposed constructions used in the GCM gives freedom to the designers. We present the results of error simulations and application-specific integrated circuit implementations to demonstrate the utility of the presented schemes. Based on the overhead/degradation tolerance for implementation/performance metrics, one can fine-tune the proposed method to achieve more reliable architectures for the GCM.

Cryptographic system for data applications, in the context of internet of things

With each passing day, Internet of Things (IoT), has the potential to transform our society to a more digital way. In this paper, a cryptographic system is proposed, which has been designed and implemented, following the IoT optimized technologies. As the benefits of IoT are numerous, the need for a privacy platform is more than necessary to be developed. This work aims to demonstrate this by, firstly, implementing efficient and flexible, the fundamentals primitives of cryptography and privacy. Secondly, this is achieved, by introducing applied cryptography, in a more interactive and flexible approach. The proposed system and the incorporation of this platform is scrutinized. In the context of this work, an application of symmetric cryptography is introduced, based on the Advanced Encryption Standard (AES) in Electronic Code Book (ECB), Cipher Block Chaining (CBC) and Counter (CTR) modes of operation, for both encryption and decryption of texts, images and electronic data applications. In addition two other security schemes are supported by the proposed system: AES Galois/Counter Mode (GCM) and AES Galois Message Authentication Code (GMAC). The GCM proposed integration, in an authentication scheme, designed to provide authenticity and confidentiality, at the same time. On the other hand, GMAC, can be applied as message authentication code. Both operations, are optimized in sense of implementation resources, since the major cost is targeted to AES core. In addition, based on the integrated hardware modules, user registration and validation is proposed and implemented, with no additional cost, and with no performance penalty. Furthermore, two factor authentication has been designed and proposed, based on One Time Passwords (OTP), which can been produced with a random procedure. After these, a reference to the security levels, as regards to the communication between the IoT layers of the architecture, is presented. IoT hardware platforms are facing lack of security level and this brings the opportunity to use advanced security mechanisms. Implementation comparison results emphasize the importance of testing and measuring the performance of the alternative encryption algorithms, supported by hardware platforms.

Image encryption using block cipher and chaotic sequences

Encryption of data with high correlation, such as images, is a challenge for block ciphers, since patterns of the original image may remain after encryption. This is due to the deterministic mapping performed by the cipher. To overcome this limitation, a block cipher is used in an adequate mode of operation, such as cipher block chaining, counter mode. It is presented in this work randomized block ciphers inspired by the Rijndael architecture employing chaotic maps as an entropy source. It is shown that the proposal achieves good security and robustness indicators with fewer rounds compared to that obtained with the Rijndael algorithm.

Architecture Optimization and Performance Comparison of Nonce-Misuse-Resistant Authenticated Encryption Algorithms

This paper presents a performance comparison of new authenticated encryption (AE) algorithms which are aimed at providing better security and resource efficiency compared to existing standards. Specifically, these algorithms improve the security of existing AE standards by providing a critical property termed nonce-misuse resistance. This paper addresses algorithm to architectural mappings of several candidates from the ongoing Competition for AE: Security, Applicability, and Robustness as well as a submission from the Crypto Forum Research Group. Implementations of the architectures on both field-programmable gate arrays and application-specific integrated circuits platforms are provided and compared with the architecture of a popular standard: Advanced Encryption Standard in Galois Counter mode (AES-GCM). Optimizations that are applicable to AE, in general, and nonce-misuse-resistant architectures, in particular, are presented. A hardware–software codesign approach to optimization is also discussed. The implementations via proposed optimizations demonstrate that new AE algorithms can provide comparable performance as standard AES-GCM while enhancing security and resource utilization for specific use-case scenarios.

Physical Layer Encryption for Industrial Ethernet in Gigabit Optical Links

Industrial Ethernet is a technology widely spread in factory floors and critical infrastructures where a high amount of data need to be collected and transported. Fiber optic networks at gigabit rates fit well with that type of environment, where speed, system performance, and reliability are critical. In this paper, a new encryption method for high-speed optical communications suitable for such kinds of networks is proposed. This new encryption method consists of a symmetric streaming encryption of the 8b/10b data flow at physical coding sublayer level. It is carried out thanks to a format preserving encryption block cipher working in CTR (counter) mode. The overall system has been simulated and implemented in a field programmable gate array. Thanks to experimental results, it can be concluded that it is possible to cipher traffic at this physical level in a secure way. In addition, no overhead is introduced during encryption, getting minimum latency and maximum throughput.

Performance Analysis of Cryptographic Pseudorandom Number Generators

Pseudorandom number generators (PRNGs) are important in cryptography and have been used in several security applications, such as authentication protocols, session keys, key distribution, and keystream for a one-time pad. Producing PRNGs is a critical issue because they should be uniform in distribution, unpredictable, and independent. Several PRNGs are available, but the problem lies in determining the one with the best performance. The performance of PRNGs is determined by passing a set of statistical tests' set by the National Institute of Standards and Technology (NIST). The NIST also recommends random number generation using advanced encryption standard and triple data encryption standard algorithms with the counter mode of operation. Furthermore, several block cipher algorithms (BCAs) and alternates that are present may produce strong PRNG than NIST recommendations. Therefore, in this paper, different BCAs are explored and implemented, and their results are analyzed and addressed. This paper may help in producing a strong key generation, which is deemed necessary for cryptographic authentication and other security applications.

Efficient and secure cipher scheme for multimedia contents

The impact of confidentiality and privacy breaches are more pronounced when dealing with multimedia contents. One of the obvious techniques to counter these threats is the use of encryption. A number of algorithms for robust image encryption, targeted for real-time applications with tight resource constraints, has been proposed in the literature. In this paper, first, we analyze two recent cipher schemes for image contents, which are based on two rounds. We show that the schemes are designed to ensure maximum avalanche effect in the whole image by employing the chaining block code mode (CBC) in forward and backward directions. However, they do not lend themselves to parallel implementation and they have a problem with error propagation, which is not desirable for wireless multimedia transmission. As such, we propose to redesign the underlying algorithm to make it practical when used with applications that either suffer from a high error percentage or from real-time constraints. The modified cipher employs the counter mode to eliminate the chaining process (forward and backward), which allows for parallel computations and minimizes the effect of error propagation. According to the security and performance results, the proposed scheme can respond better to the applications and/or system requirements and limitations by ensuring a better performance and an equally high level of security compared to both ciphers in addition to minimum error propagation. To the best of our knowledge, the proposed scheme is the first dynamic key-dependent stream cipher scheme with a pseudo-random key-stream generation for re-ordering of sub-matrices.

A visually secure image encryption scheme based on parallel compressive sensing

Abstract It is generally recognized that encrypting an original image into meaningless cipher image is an ideal method to protect image information. However, during transmission, the meaningless cipher image would draw attention and thus attract attacks. Recently, compressive sensing (CS) and carrier images have been utilized by Chai et al. to construct a novel image encryption scheme with visual security. However, in this scheme, some extra transmission is required for possible decryption besides the encrypted image. Moreover, the imperceptibility of the cipher image can be further improved and the recovered image quality would be severely degraded if unsuitable carrier images are selected. In this paper, we design a visually secure encryption scheme by using the parallel compressive sensing (PCS) counter mode and embedding technique. In order to achieve higher security level, Logistic-Tent system and 3-D Cat map are introduced to construct the measurement matrices and to disturb the order of the embedded information, respectively. Furthermore, experimental results demonstrate that the cipher image exhibits superior imperceptibility and the recovered image possesses more satisfactory quality, which is independent of the carrier image.

FACE: Fast AES CTR mode Encryption Techniques based on the Reuse of Repetitive Data

The Advanced Encryption Standard (AES) algorithm and Counter (CTR) mode are used for numerous services as an encryption technique that provides confidentiality. Even though the AES with counter (AES CTR) mode has an advantage in that it can process multiple data blocks in parallel, its implementation should also be observed to reduce the computational burden of current services.In this paper, we propose an implementation method called FACE that can improve the performance of the AES CTR mode. The proposed method is based on five caches of frequently occurring intermediate values, so that it reduces the number of unnecessary computations. Our method can be employed in any AES CTR implementation, regardless of the platform, environment, or implementation method. There are two known AES implementation techniques, namely, counter-mode caching and bitslicing. FACE extends counter-mode caching in order to optimize the previous result and to maximize the scope of caching. We show that FACE can be applied efficiently to various implementations (table-based, bitsliced, and AES-NI-based). In particular, this is the first attempt to combine our extended counter-mode caching with bitsliced implementations of AES, and is also the first to apply counter-mode caching up to the round transformations of AES-NI implementation. To prove the efficiency of our proposed method, we conduct a performance evaluation in various environments, which we then compare with the previous fastest results. Our bitsliced FACE needs 6.41 cycles/byte on an Intel Core 2, and AES-NI-based FACE records 0.44 cycles/byte on an Intel Core i7.

LEO: Low Overhead Encryption ORAM for Non-Volatile Memories

Data confidentiality attacks utilizing memory access patterns threaten exposure of data in modern main memories. Oblivious RAM (ORAM) is an effective cryptographic primitive developed to thwart access-pattern-based attacks in DRAM-based systems. However, in emerging non-volatile memory (NVM) systems, the increased writes due to encryption of multiple data blocks on every Path ORAM (state-of-the-art efficient ORAM) access impose significant energy, lifetime, and performance overheads. LEO ( L ow overhead E ncryption O RAM ) is an efficient Path ORAM encryption architecture that addresses the high write overheads of ORAM integration in NVMs, while providing security equivalent to the baseline Path ORAM. LEO reduces NVM cell writes by securely decreasing the number of block encryptions during the write phase of a Path ORAM access. LEO uses a secure, two-level counter mode encryption framework that opportunistically eliminates re-encryption of unmodified blocks, reducing NVM writes. Our evaluations show that on average, LEO decreases NVM energy by 60 percent, improves lifetime by 1.51 $\times$ , and increases performance by 9 percent over the baseline Path ORAM.