New Bounds for Keyed Sponges with Extendable Output: Independence between Capacity and Message Length

Transcription

1 New Bounds for Keyed Sponges with Extendable Output: Independence between Capacity and Message Length Yusuke Naito Mitsubishi Electric Corporation Kan Yasuda NTT Secure latform Laboratories 1

2 Sponge Based on a permutation :{0,1} b {0,1} b b bit r bit: rate c bit: capacity Iterate permutation m pad m 2 m 3 m 4 Inner 0 c Absorbing Squeeing 2

3 Sponge with Extendable Output m pad m 2 m 3 m 4 (variable length) Inner 0 c Absorbing Squeeing Sponge with extendable output used as the constructions of SHAKE128, SHAKE256 in FIS 202 Designed to construct key derivation functions 3

4 Keyed Sponges with Extendable Output Keyed Sponge (OKS) K m pad K m 2 m 3 m 4 Inner 0 c Inner Keyed Sponge (IKS) Absorbing Squeeing m pad Inner m 2 m 3 K m 4 Absorbing Squeeing 4

5 RF Security of Keyed Sponges Real world Ideal world random permutation Keyed Sponge Random Function random permutation offline online D distinguisher online offline 0 or 1 arameters l is the maximum input length to a keyed sponge in blocks q is the number of online queries Q is the number of offline queries 5

6 revious RF Security Bounds There are two terms: capacity term e.g., (lq+q) 2 /2 c, (lq) 2 /2 c r bit: rate, etc b bit b term e.g., (lq) 2 /2 b, lqq/2 b, etc c bit: capacity Since c < b (e.g., b=1600, c=256, 512), the capacity term becomes a dominant term in the RF security bounds The capacity term has been improved Capacity term Target Bertoni et al. (Indiff.) (lq+q) 2 /2 c (EUROCRYT 08) Andreeva et al. (FSE 15) ((lq) 2 + Q)/2 c is multiplicity: 2lq/2 r 2lq OKS OKS and IKS Gai et al. (lq+q 2 +qq)/2 c attack with prob. (q OKS with 2 +qq)/2 c (CRYTO 15) If l q or l Q then single block output [*] the bound is tight IKS Mennink et al. (lq 2 + Q)/2 c IKS [*] (ASIACRYT 15) is multiplicity: 2lq/2 r 2lq [*] Support the constructions with full message state absorption 6

7 Comparison and Our Result Open problem for keyed sponges with extendable output: Improve the capacity terms so that they become tight terms IKS OKS Extendable output Tightness of c term Bertoni et al. Andreeva et al. Gai et al. Mennink et al. This paper Today s talk 7

8 Real world online query m pad RF Security roof of IKS offline query K Ideal world online query (almost) b bit random values offline query m Random Function For any query to a random function, the response is randomly drawn If all outputs of IKS can be seen as random values then the real world and the ideal world are indistinguishable If all inputs to that produces outputs of IKS are new inputs then all outputs of IKS become (almost) random values The distinguishing prob. The prob. that some input to that produces the output of IKS is not new 8

9 Real world online query RF Security roof of IKS K m 1 m 2 m 3 m 4 offline query K The distinguishing prob. The prob. that some input to that produces the output is not a new input The prob. that a collision in inputs to occurs We categorie inputs to in IKS into two sorts of inputs Controllable input Uncontrollable input 9

10 Controllable Input and Uncontrollable Input Controllable input The outer part can be controlled The inner part cannot be controlled Uncontrollable input The outer and inner parts cannot be controlled 1 st online query Inner K Known value Controllable Controllable input 10

11 Controllable Input and Uncontrollable Input Controllable input The outer part can be controlled The inner part cannot be controlled Uncontrollable input The outer and inner parts cannot be controlled 1 st online query Inner K Controllable input New output defined after m 2 was defined Uncontrollable inputs 11

12 Controllable Input and Uncontrollable Input Controllable input The outer part can be controlled The inner part cannot be controlled Uncontrollable input The outer and inner parts cannot be controlled 1 st online query Inner K Obtained from the output 2 nd online query Inner K Controllable input m 5 Controllable m 6 Known value Controllable input 12

13 Inner K Controllable Input and Uncontrollable Input Controllable input The outer part can be controlled The inner part cannot be controlled Uncontrollable input The outer and inner parts cannot be controlled 1 st online query 2 st online query Inner K Controllable input m 5 m 6 Controllable input Uncontrollable inputs New output defined after m 6 was defined 13

14 Controllable Input and Uncontrollable Input 1 st online query Inner K 2 st online query Inner K Controllable input Uncontrollable inputs m 5 m 6 Controllable input Uncontrollable inputs Controllable inputs For each online query, the number of controllable inputs is at most 1 The total number of controllable inputs is at most q Uncontrollable inputs The total number of inputs to the random permutation in IKS is at most lq The total number of uncontrollable inputs is at most lq 14

15 Controllable Input and Uncontrollable Input The features of controllable inputs and uncontrollable inputs Inputs to part (r bit) Inner part (c bi) Number Controllable input Not random Random q Uncontrollable input Random Random lq 15

16 Bound of Distinguishing robability The distinguishing prob. The prob. that a collision in inputs to occurs Inputs to part (r bits) Inner part (c bits) Number Controllable input Not random Random q Uncontrollable input Random Random lq Input by offline query Not random Not random Q The prob. that a collision in inputs to occurs is bounded by the sum of probabilities of collision in controllable inputs q 2 /2 c collision in uncontrollable inputs (lq) 2 /2 b collision between controllable inputs and uncontrollable inputs collision between controllable inputs and inputs by offline queries collision between uncontrollable inputs and inputs by offline queries lqq/2 b The distinguishing prob. (q 2 +qq)/2 c + (lq 2 + (lq) 2 + lqq)/2 b lq 2 /2 b qq/2 c attack with prob. (q 2 +qq)/2 c 16

17 Conclusion Capacity term Target Indifferentiability (lq+q) 2 /2 c (EUROCRYT 08) OKS Andreeva et al. ((lq) 2 + Q)/2 c (FSE 15) is multiplicity: 2lq/2 r 2lq OKS and IKS Gai et al. (lq+q 2 +qq)/2 c (CRYTO 15) OKS with single block output Mennink et al. (ASIACRYT 15) (lq 2 + Q)/2 c is multiplicity: 2lq/2 r 2lq IKS This paper (q 2 +qq)/2 c (Tight) IKS and OKS 17

18 Thank You! 18