While modern block ciphers, such as AES, have a block size of at least 128 bits, there are many 64-bit block ciphers, such as 3DES and Blowfish, that are still widely supported in Internet security protocols such as TLS, SSH, and IPsec. When used in CBC mode, these ciphers are known to be susceptible to collision attacks when they are used to encrypt around 232 blocks of data (the so-called birthday bound). This threat has traditionally been dismissed as impractical since it requires some prior knowledge of the plaintext and even then, it only leaks a few secret bits per gigabyte. Indeed, practical collision attacks have never been demonstrated against any mainstream security protocol, leading to the continued use of 64-bit ciphers on the Internet. In this work, we demonstrate two concrete attacks that exploit collisions on short block ciphers. First, we present an attack on the use of 3DES in HTTPS that can be used to recover a secret session cookie. Second, we show how a similar attack on Blowfish can be used to recover HTTP BasicAuth credentials sent over OpenVPN connections. In our proof-of-concept demos, the attacker needs to capture about 785GB of data, which takes between 19-38 hours in our setting. This complexity is comparable to the recent RC4 attacks on TLS: the only fully implemented attack takes 75 hours. We evaluate the impact of our attacks by measuring the use of 64-bit block ciphers in real-world protocols. We discuss mitigations, such as disabling all 64-bit block ciphers, and report on the response of various software vendors to our responsible disclosure of these attacks.

/pdf/on-the-practical-in-security-of-64-bit-block-ciphers-4juej4b1du.pdf

On the Practical (In-)Security of 64-bit Block Ciphers: Collision Attacks on HTTP over TLS and OpenVPN.

At CRYPTO 2016, Cogliati and Seurin have proposed a highly secure nonce-based MAC called Encrypted Wegman-Carter with Davies-Meyer ($\textsf {EWCDM}$) construction, as $\textsf {E}_{K_2}\bigl (\textsf {E}_{K_1}(N)\oplus N\oplus \textsf {H}_{K_h}(M)\bigr )$ for a nonce N and a message M. This construction achieves roughly $2^{2n/3}$ bit MAC security with the assumption that $\textsf {E}$ is a PRP secure n-bit block cipher and $\textsf {H}$ is an almost xor universal n-bit hash function. In this paper we propose Decrypted Wegman-Carter with Davies-Meyer ($\textsf {DWCDM}$) construction, which is structurally very similar to its predecessor $\textsf {EWCDM}$ except that the outer encryption call is replaced by decryption. The biggest advantage of $\textsf {DWCDM}$ is that we can make a truly single key MAC: the two block cipher calls can use the same block cipher key $K=K_1=K_2$. Moreover, we can derive the hash key as $K_h=\textsf {E}_K(1)$, as long as $|K_h|=n$. Whether we use encryption or decryption in the outer layer makes a huge difference; using the decryption instead enables us to apply an extended version of the mirror theory by Patarin to the security analysis of the construction. $\textsf {DWCDM}$ is secure beyond the birthday bound, roughly up to $2^{2n/3}$ MAC queries and $2^n$ verification queries against nonce-respecting adversaries. $\textsf {DWCDM}$ remains secure up to $2^{n/2}$ MAC queries and $2^n$ verification queries against nonce-misusing adversaries.

Encrypt or Decrypt? To Make a Single-Key Beyond Birthday Secure Nonce-Based MAC.

In ICISC-05, and in the ePrint 2010/287, Patarin claimed a lower bound on the number of <inline-formula> <tex-math notation="LaTeX">$2 q$ </tex-math></inline-formula> tuples of <inline-formula> <tex-math notation="LaTeX">$n$ </tex-math></inline-formula>-bit strings <inline-formula> <tex-math notation="LaTeX">$(P_{1}, \ldots, P_{2q}) \in ({\{0,1\}}^{n})^{2q}$ </tex-math></inline-formula> satisfying <inline-formula> <tex-math notation="LaTeX">$P_{2i - 1} \oplus P_{2i} = \lambda _{i}$ </tex-math></inline-formula> for <inline-formula> <tex-math notation="LaTeX">$1 \leq i \leq q$ </tex-math></inline-formula> such that <inline-formula> <tex-math notation="LaTeX">$P_{1}, P_{2}, \ldots $ </tex-math></inline-formula>, <inline-formula> <tex-math notation="LaTeX">$P_{2q}$ </tex-math></inline-formula> are distinct and <inline-formula> <tex-math notation="LaTeX">$\lambda _{i} \in {\{0,1\}} ^{n} \setminus \{0^{n}\}$ </tex-math></inline-formula>. This result is known as <italic>Mirror theory</italic> and widely used in cryptography. It stands as a powerful tool to provide a high-security guarantee for many block cipher-(or even ideal permutation-) based designs. In particular, Mirror theory has a direct application in the security of XOR of block ciphers. Unfortunately, the proof of Mirror theory contains some unverifiable gaps and several mistakes. This paper provides a simple and verifiable proof of Mirror theory.

Proof of Mirror Theory for ξmax = 2

Authenticated encryption (AE) is a cryptographic construction that simultaneously protects confidentiality and integrity. A considerable amount of research has been devoted to the area since its formal inception in 2000. Different lines of research have been proposed to enhance the available schemes in terms of security, efficiency, and design and to implement new ideas. However, a comprehensive systematic literature review (SLR) of the topic has not been provided to the best of the authors’ knowledge. This study fills this gap in the literature by proposing a framework for classifying AE schemes and highlighting past contributions to help researchers familiarize themselves with the current state and directions for future research in the area. This SLR covered AE schemes proposed from 2000 to 2020. A total of 217 articles, selected from eight sources, were categorized into independent schemes, CAESAR competition schemes, and NIST lightweight competition schemes. These schemes were then classified according to their design approaches, security-related properties, and functional features. Our analysis reveals that a significant outstanding challenge in AE is to balance security, efficiency, and the provision of desirable features.

/pdf/authenticated-encryption-schemes-a-systematic-review-1wientpm.pdf

Authenticated Encryption Schemes: A Systematic Review

In an early version of CRYPTO’17, Mennink and Neves proposed EWCDMD, a dual of EWCDM, and showed n-bit security, where n is the block size of the underlying block cipher. In CRYPTO’19, Chen et al. proposed permutation based design SoKAC21 and showed 2n/3-bit security, where n is the input size of the underlying permutation. In this paper we show birthday bound attacks on EWCDMD and SoKAC21, invalidating their security claims. Both attacks exploit an inherent composition nature present in the constructions. Motivated by the above two attacks exploiting the composition nature, we consider some generic relevant composition based constructions of ideal primitives (possibly in the ideal permutation and random oracle model) and present birthday bound distinguishers for them. In particular, we demonstrate a birthday bound distinguisher against (1) a secret random permutation followed by a public random function and (2) composition of two secret random functions. Our distinguishers for SoKAC21 and EWCDMD are direct consequences of (1) and (2) respectively.

Mind the Composition: Birthday Bound Attacks on EWCDMD and SoKAC21.

Public permutations have been established as valuable primitives since the absence of a key schedule compared to block ciphers alleviates cryptanalysis. While many permutation-based authentication and encryption schemes have been proposed in the past decade, the birthday bound in terms of the primitive’s block length n has been mostly accepted as the standard security goal. Thus, remarkably little research has been conducted yet on permutation-based modes with higher security guarantees. Only recently at CRYPTO’19, Chen et al. showed two constructions with higher security based on the sum of two public permutations. Their work has sparked increased interest in this direction by the community. However, since their proposals were domain-preserving, the question of encryption schemes with beyondbirthday-bound security was left open. This work tries to address this gap by proposing CENCPP, a nonce-based encryption scheme from public permutations. Our proposal is a variant of Iwata’s block-cipherbased mode CENC that we adapt for public permutations, thereby generalizing Chen et al.’s Sum-of-Even-Mansour construction to a mode with variable output lengths. Like CENC, our proposal enjoys a comfortable rate-security trade-off that needs w+1 calls to the primitive for w primitive outputs. We show a tight security level for up to O(2/w) primitive calls. While w ≥ 1 can be arbitrary, two independent keys suffice; moreover, although we propose CENCPP first in a generic setting with w + 1 independent permutations, we show that only log2(w + 1) bits of the input for domain separation suffice to obtain a single-permutation variant that still maintains a security level of up to O(2/w) queries.

/pdf/cencpp-beyond-birthday-secure-encryption-from-public-12yg8gup7z.pdf

CENCPP - Beyond-birthday-secure Encryption from Public Permutations.

CENCPP - Beyond-birthday-secure Encryption from Public Permutations

/pdf/the-oribatida-v1-3-family-of-lightweight-authenticated-2pi6lhfgju.pdf

The Oribatida v1.3 Family of Lightweight Authenticated Encryption Schemes

With the advent of Malicious (Peyrin and Wang, Crypto’20), the question of a cipher with an intentional weakness which is only known to its designer has gained its momentum. In their work, the authors discuss how an otherwise secure cipher can be broken by its designer with the help of a secret backdoor (which is not known to the user/attacker). The contribution of Malicious is to propose a cipher-level construction with a backdoor, where it is computationally infeasible to retrieve the backdoor entry despite knowing how the mechanism works. In this work, we revisit the work done by Peyrin and Wang in a greater depth. We discuss the relevant aspects with more clarity, thereby addressing some of the important issues connected to a backdoor construction. The main contribution, however, comes as a new proof-of-concept block cipher with an innate backdoor, named ZUGZWANG. Unlike Malicious, which needs new/experimental concepts like partially non-linear layer; our cipher entirely relies on concepts which are well-established for decades (such as, using a one-way function as a Feistel cipher’s state-update), and also offers several advantages over Malicious (easy to visualise, succeeds with probability 1, and so on). Having known the secret backdoor entry, one can recover the secret key with only 1 plaintext query to our cipher; but it is secure otherwise. 

Arghya Bhattacharjee

Papers

CENCPP - Beyond-birthday-secure Encryption from Public Permutations.

CENCPP - Beyond-birthday-secure Encryption from Public Permutations

The Oribatida v1.3 Family of Lightweight Authenticated Encryption Schemes

Big Brother Is Watching You: A Closer Look At Backdoor Construction

Offset-Based BBB-Secure Tweakable Block-ciphers with Updatable Caches