of 55 /55
Incrementality and deck functions Simple protocols and efficient constructions in symmetric cryptography Gilles Van Assche 1 1 STMicroelectronics FOSDEM 2020 Brussels, Belgium, February 1, 2020 1 / 30

Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Incrementality and deck functionsSimple protocols and efficient constructions

in symmetric cryptography

Gilles Van Assche1

1STMicroelectronics

FOSDEM 2020Brussels, Belgium, February 1, 2020

1 / 30

Page 2: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Joint work with the Keccak team

Guido BertoniItalyJoan DaemenThe NetherlandsSeth HoffertUSAMichaël PeetersBelgiumGilles Van AsscheBelgiumRonny Van KeerBelgium

https://keccak.team/2 / 30

Page 3: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What we do: permutation-based crypto

HashingKeccak, SHA-3, SHAKE, cSHAKE, ParallelHash, …KangarooTwelve [ultra-fast, most third-party cryptanalysis to date]

Symmetric-key encryption and/or authenticationKeyed duplex: Ketje, Keyak, XoodyakFarfalle: Kravatte, Xoofff [fast from small to big platforms]

Re-thinking symmetric cryptoDeck function interfaceSimpler authenticated encryption schemes

3 / 30

Page 4: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What we do: permutation-based crypto

HashingKeccak, SHA-3, SHAKE, cSHAKE, ParallelHash, …KangarooTwelve [ultra-fast, most third-party cryptanalysis to date]

Symmetric-key encryption and/or authenticationKeyed duplex: Ketje, Keyak, XoodyakFarfalle: Kravatte, Xoofff [fast from small to big platforms]

Re-thinking symmetric cryptoDeck function interfaceSimpler authenticated encryption schemes

3 / 30

Page 5: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What we do: permutation-based crypto

HashingKeccak, SHA-3, SHAKE, cSHAKE, ParallelHash, …KangarooTwelve [ultra-fast, most third-party cryptanalysis to date]

Symmetric-key encryption and/or authenticationKeyed duplex: Ketje, Keyak, XoodyakFarfalle: Kravatte, Xoofff [fast from small to big platforms]

Re-thinking symmetric cryptoDeck function interfaceSimpler authenticated encryption schemes

3 / 30

Page 6: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Outline

1 Why is incrementality useful? (Example: Disco)

2 What are deck functions?

3 How to use a deck function?

4 How to build a fast deck function?

4 / 30

Page 7: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Outline

1 Why is incrementality useful? (Example: Disco)

2 What are deck functions?

3 How to use a deck function?

4 How to build a fast deck function?

5 / 30

Page 8: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Duplex objectDuplex object = sponge function with incrementality

0

0

r

c

outerinner

initialize

pad

f

duplexing

σ0 Z0

pad

f

duplexing

σ1 Z1

pad

f

duplexing

σ2 Z2

[Selected Areas in Cryptography 2011]

6 / 30

Page 9: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Strobe

Layer above a duplex objectcompliant with cSHAKE [NIST SP 800-185]

Safe and easy syntax, to achieve, e.g.,secure channelshashing of protocol transcriptssignatures over a complete session

Very compact implementation

[Mike Hamburg, Real World Crypto 2017]

7 / 30

Page 10: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Strobe functions

figures courtesy of David Wong

8 / 30

Page 11: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K)AD[nonce](seq. number i)AD[auth-data](IP1||IP2)send_ENC(“GET file”)send_MAC(128 bits)recv_ENC(ciphertext buffer)recv_MAC(128 bits)

9 / 30

Page 12: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K) set key K, empty context XAD[nonce](seq. number i)AD[auth-data](IP1||IP2)send_ENC(“GET file”)send_MAC(128 bits)recv_ENC(ciphertext buffer)recv_MAC(128 bits)

9 / 30

Page 13: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K) set key K, empty context XAD[nonce](seq. number i) X← (i) ◦ “nonce” ◦ XAD[auth-data](IP1||IP2)send_ENC(“GET file”)send_MAC(128 bits)recv_ENC(ciphertext buffer)recv_MAC(128 bits)

9 / 30

Page 14: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K) set key K, empty context XAD[nonce](seq. number i) X← (i) ◦ “nonce” ◦ XAD[auth-data](IP1||IP2) X← (IP1||IP2) ◦ “auth-data” ◦ Xsend_ENC(“GET file”)send_MAC(128 bits)recv_ENC(ciphertext buffer)recv_MAC(128 bits)

9 / 30

Page 15: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K) set key K, empty context XAD[nonce](seq. number i) X← (i) ◦ “nonce” ◦ XAD[auth-data](IP1||IP2) X← (IP1||IP2) ◦ “auth-data” ◦ Xsend_ENC(“GET file”) ciphertext = encK,X(“GET file”)

X← “GET file” ◦ Xsend_MAC(128 bits)recv_ENC(ciphertext buffer)recv_MAC(128 bits)

9 / 30

Page 16: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K) set key K, empty context XAD[nonce](seq. number i) X← (i) ◦ “nonce” ◦ XAD[auth-data](IP1||IP2) X← (IP1||IP2) ◦ “auth-data” ◦ Xsend_ENC(“GET file”) ciphertext = encK,X(“GET file”)

X← “GET file” ◦ Xsend_MAC(128 bits) MACK(X)recv_ENC(ciphertext buffer)recv_MAC(128 bits)

9 / 30

Page 17: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K) set key K, empty context XAD[nonce](seq. number i) X← (i) ◦ “nonce” ◦ XAD[auth-data](IP1||IP2) X← (IP1||IP2) ◦ “auth-data” ◦ Xsend_ENC(“GET file”) ciphertext = encK,X(“GET file”)

X← “GET file” ◦ Xsend_MAC(128 bits) MACK(X)recv_ENC(ciphertext buffer) plaintext = decK,X(ciphertext)

X← plaintext ◦ Xrecv_MAC(128 bits)

9 / 30

Page 18: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Example: protocol

KEY(shared key K) set key K, empty context XAD[nonce](seq. number i) X← (i) ◦ “nonce” ◦ XAD[auth-data](IP1||IP2) X← (IP1||IP2) ◦ “auth-data” ◦ Xsend_ENC(“GET file”) ciphertext = encK,X(“GET file”)

X← “GET file” ◦ Xsend_MAC(128 bits) MACK(X)recv_ENC(ciphertext buffer) plaintext = decK,X(ciphertext)

X← plaintext ◦ Xrecv_MAC(128 bits) check that MAC = MACK(X)

9 / 30

Page 19: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

The Noise protocol framework

Framework for crypto protocols based on Diffie-Hellmanpublic-key handshake mechanismsecret-key encryption and authenticationused in WhatsApp, WireGuard, …

[Trevor Perrin, Real World Crypto 2018]

10 / 30

Page 20: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Inside Noise

figure courtesy of David Wong

11 / 30

Page 21: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Disco

Disco = Noise + Strobe[David Wong, Black Hat Europe 2017]

12 / 30

Page 22: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Inside Disco

figure courtesy of David Wong

13 / 30

Page 23: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Duplex object inside Disco

figure courtesy of David Wong

14 / 30

Page 24: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Why is incrementality useful? (Example: Disco)

Implementation complexity

figure courtesy of David Wong

15 / 30

Page 25: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What are deck functions?

Outline

1 Why is incrementality useful? (Example: Disco)

2 What are deck functions?

3 How to use a deck function?

4 How to build a fast deck function?

16 / 30

Page 26: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What are deck functions?

Definition of a deck function

A deck function FK

Z = 0n + FK(X(m) ◦ · · · ◦ X(1)

)≪ q

doubly extendable cryptographic keyed function

17 / 30

Page 27: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What are deck functions?

Definition of a deck function

A deck function FK

Z = 0n + FK(X(m) ◦ · · · ◦ X(1)

)≪ q

Input: sequence of strings X(m) ◦ · · · ◦ X(1)

17 / 30

Page 28: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What are deck functions?

Definition of a deck function

A deck function FK

Z = 0n + FK(X(m) ◦ · · · ◦ X(1)

)≪ q

Input: sequence of strings X(m) ◦ · · · ◦ X(1)Output: potentially infinite output

pseudo-random function of the inputtaking n bits starting from offset q

17 / 30

Page 29: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What are deck functions?

Definition of a deck function

A deck function FK

Z = 0n + FK(X(m) ◦ · · · ◦ X(1)

)≪ q

Efficient incrementality

Extendable input1 Compute FK (X)2 Compute FK (Y ◦ X): cost independent of X

17 / 30

Page 30: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

What are deck functions?

Definition of a deck function

A deck function FK

Z = 0n + FK(X(m) ◦ · · · ◦ X(1)

)≪ q

Efficient incrementality

Extendable input1 Compute FK (X)2 Compute FK (Y ◦ X): cost independent of X

Extendable output1 Request n1 bits from offset 02 Request n2 bits from offset n1: cost independent of n1

17 / 30

Page 31: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Outline

1 Why is incrementality useful? (Example: Disco)

2 What are deck functions?

3 How to use a deck function?

4 How to build a fast deck function?

18 / 30

Page 32: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Stream cipher: short input, long output

nonce

plaintext = ciphertext

C← P+ FK (N)

19 / 30

Page 33: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

MAC: long input, short output

plaintext

plaintext

T← 0t + FK (P)

20 / 30

Page 34: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

K, N1

T0

A1 P1

C1 T1

A2 P2

C2 T2

A3 P3

C3 T3

[Xoodoo Cookbook, IACR ePrint 2018/767]

21 / 30

Page 35: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 36: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 37: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 38: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 39: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 40: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 41: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 42: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Deck-SANE: session-supporting and nonce-based

Initialize session with nonce NT0 ← 0t + FK (N)return startup tag T0

Encipher message 1 (metadata A1, plaintext P1)C1 ← P1 + FK (N)≪ tT1 ← 0t + FK (C1 ◦ A1 ◦ N)return (ciphertext C1, tag T1)

Encipher message 2 (metadata A2, plaintext P2)C2 ← P2 + FK (C1 ◦ A1 ◦ N)≪ tT2 ← 0t + FK (C2 ◦ A2 ◦ C1 ◦ A1 ◦ N)return (ciphertext C2, tag T2)

22 / 30

Page 43: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to use a deck function?

Other deck-based modes

Deck-SANSE: synthetic nonceDeck-WBC: wide block cipher

23 / 30

Page 44: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Outline

1 Why is incrementality useful? (Example: Disco)

2 What are deck functions?

3 How to use a deck function?

4 How to build a fast deck function?

24 / 30

Page 45: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Farfalle

fm0

k

fm1

k

f

i

mi

k

f z0

k′

f z1

k′

fj zj

k′

K∥10∗ f

i+2

f

[Fast Software Encryption 2018]

25 / 30

Page 46: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Kravatte and Xoofff

Kravatte [FSE 2018]f = Keccak-p[1600,nr = 6]Input mask rolling with LFSR, state rolling with NLFSRTarget security: ≥ 128 bits (including post-quantum)

Xoofff [FSE 2019]f = Xoodoo[6]384-bit permutation 4× 3× 32 bitsTarget security: ≥ 128 bits (≥ 96 bits post-quantum)

26 / 30

Page 47: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Kravatte and Xoofff

Kravatte [FSE 2018]f = Keccak-p[1600,nr = 6]Input mask rolling with LFSR, state rolling with NLFSRTarget security: ≥ 128 bits (including post-quantum)

Xoofff [FSE 2019]f = Xoodoo[6]384-bit permutation 4× 3× 32 bitsTarget security: ≥ 128 bits (≥ 96 bits post-quantum)

26 / 30

Page 48: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Kravatte performance

Kravattegranularity 200 bytes

MAC computation use case:long inputs 0.64 cycles/byte

Stream encryption use case:long outputs 0.63 cycles/byte

AES-128 counter mode 0.65 cycles/byte

Intel® Core™ i5-6500 (Skylake), single core, Turbo Boost disabled(256-bit SIMD)

https://github.com/XKCP/XKCP

27 / 30

Page 49: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Xoofff performance

Xoofffgranularity 48 bytes

MAC computation use case:long inputs 26.0 cycles/byte

Stream encryption use case:long outputs 25.1 cycles/byte

AES-128 counter mode 121.4 cycles/byte

ARM® Cortex-M0

https://github.com/XKCP/XKCP

28 / 30

Page 50: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Xoofff performance

Xoofffgranularity 48 bytes

MAC computation use case:long inputs 8.8 cycles/byte

Stream encryption use case:long outputs 8.1 cycles/byte

AES-128 counter mode 33.2 cycles/byte

ARM® Cortex-M3

https://github.com/XKCP/XKCP

28 / 30

Page 51: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Xoofff performance

Xoofffgranularity 48 bytes

MAC computation use case:long inputs 0.90 cycles/byte

Stream encryption use case:long outputs 0.94 cycles/byte

AES-128 counter mode 0.65 cycles/byte

Intel® Core™ i5-6500 (Skylake), single core, Turbo Boost disabled(256-bit SIMD)

https://github.com/XKCP/XKCP

28 / 30

Page 52: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

How to build a fast deck function?

Xoofff performance

Xoofffgranularity 48 bytes

MAC computation use case:long inputs 0.40 cycles/byte

Stream encryption use case:long outputs 0.51 cycles/byte

AES-128 counter mode 0.65 cycles/byte

Intel® Core™ i7-7800X (SkylakeX), single core, Turbo Boost disabled(512-bit SIMD)

https://github.com/XKCP/XKCP

28 / 30

Page 53: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Conclusions

Conclusions

Incrementality in symmetric cryptocan simplify protocols (e.g., Disco)can make modes more natural (e.g., session-based AE)

The deck function interfaceis a way to define incrementality in keyed operationscan be efficiently implemented with the Farfalle construction(e.g., Kravatte and Xoofff)

29 / 30

Page 54: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Conclusions

Conclusions

Incrementality in symmetric cryptocan simplify protocols (e.g., Disco)can make modes more natural (e.g., session-based AE)

The deck function interfaceis a way to define incrementality in keyed operationscan be efficiently implemented with the Farfalle construction(e.g., Kravatte and Xoofff)

29 / 30

Page 55: Incrementality and deck functions - Simple protocols and efficient … · 2020-01-31 · Incrementality and deck functions - Simple protocols and efficient constructions in symmetric

Conclusions

Any questions?

Thanks for your attention!

For more permutation-based crypto, see you atPBC 2020, co-located with Eurocrypt

https://permutationbasedcrypto.org/2020/

30 / 30