Authenticated encryption satisfies the basic need for authenticity and confidentiality in our information infrastructure. In this paper, we provide the specification of Ascon-128 and Ascon-128a. Both authenticated encryption algorithms provide efficient authenticated encryption on resource-constrained devices and on high-end CPUs. Furthermore, they have been selected as the “primary choice” for lightweight authenticated encryption in the final portfolio of the CAESAR competition. In addition, we specify the hash function Ascon-Hash, and the extendable output function Ascon-Xof. Moreover, we complement the specification by providing a detailed overview of existing cryptanalysis and implementation results.

/pdf/ascon-v1-2-lightweight-authenticated-encryption-and-hashing-xl7lavnxj0.pdf

Ascon v1.2: Lightweight Authenticated Encryption and Hashing

We present several improvements to the framework of differential-linear attacks with a special focus on ARX ciphers As a demonstration of their impact, we apply them to Chaskey and ChaCha and we are able to significantly improve upon the best attacks published so far

Improved Differential-Linear Attacks with Applications to ARX Ciphers

We describe a compression technique that reduces the public key size of van Dijk, Gentry, Halevi and Vaikuntanathan's (DGHV) fully homomorphic scheme over the integers from O(λ7) to O(λ5). Our variant remains semantically secure, but in the random oracle model. We obtain an implementation of the full scheme with a 10.1 MB public key instead of 802 MB using similar parameters as in [7]. Additionally we show how to extend the quadratic encryption technique of [7] to higher degrees, to obtain a shorter public-key for the basic scheme.

This paper also describes a new modulus switching technique for the DGHV scheme that enables to use the new FHE framework without bootstrapping from Brakerski, Gentry and Vaikuntanathan with the DGHV scheme. Finally we describe an improved attack against the Approximate GCD Problem on which the DGHV scheme is based, with complexity O(2ρ) instead of O(23ρ/2).

Public Key Compression and Modulus Switching for Fully Homomorphic Encryption over the Integers

The Internet of Things (IoT) has become an integral part of future solutions, ranging from industrial to everyday human life applications. Adding a new level of intelligence to objects and automating decisions make this new technology appealing to everyone. However, applications that involve data are more vulnerable to various types of attacks. As a result, researchers are constantly exploring secure connections between IoT edge nodes. On one hand, suitable IoT nodes should be cheap and require low power, which means lower computational performance. On the other hand, a secure connection layer is power hungry and requires powerful hardware resources. Lightweight cryptography (LWC) algorithms are a promising solution to reduce computation complexity while maintaining a desired level of security. In the presented work, we attempt to address the issue of adding security to the IoT network layer by comparing the performance of 32 LWC algorithms with currently well-known algorithms on multiple IoT platforms (Raspberry Pi 3, Raspberry Pi Zero W, and iMX233). These 32 authenticated encryption with associated data algorithms have been selected from the second round of the LWC standardization process conducted by the National Institute of Standards and Technology. Power consumption, random access memory usage, and execution time are measured for these algorithms using the targeted embedded platforms that are used as IoT sensor nodes. The results of this study will assist researchers in choosing a suitable platform and optimal LWC algorithm for IoT applications.

Comparative Performance Analysis of Lightweight Cryptography Algorithms for IoT Sensor Nodes

The differential-linear attack, combining the power of the two most effective techniques for symmetric-key cryptanalysis, was proposed by Langford and Hellman at CRYPTO 1994 From the exact formula for evaluating the bias of a differential-linear distinguisher (JoC 2017), to the differential-linear connectivity table (DLCT) technique for dealing with the dependencies in the switch between the differential and linear parts (EUROCRYPT 2019), and to the improvements in the context of cryptanalysis of ARX primitives (CRYPTO 2020), we have seen significant development of the differential-linear attack during the last four years In this work, we further extend this framework by replacing the differential part of the attack by rotational-xor differentials Along the way, we establish the theoretical link between the rotational-xor differential and linear approximations, revealing that it is nontrivial to directly apply the closed formula for the bias of ordinary differential-linear attack to rotational differential-linear cryptanalysis We then revisit the rotational cryptanalysis from the perspective of differential-linear cryptanalysis and generalize Morawiecki et al’s technique for analyzing Keccak, which leads to a practical method for estimating the bias of a (rotational) differential-linear distinguisher in the special case where the output linear mask is a unit vector Finally, we apply the rotational differential-linear technique to the permutations involved in FRIET, Xoodoo, Alzette, and SipHash This gives significant improvements over existing cryptanalytic results, or offers explanations for previous experimental distinguishers without a theoretical foundation To confirm the validity of our analysis, all distinguishers with practical complexities are verified experimentally

Rotational Cryptanalysis from a Differential-Linear Perspective

We introduce the Sparkle family of permutations operating on 256, 384 and 512 bits. These are combined with the Beetle mode to construct a family of authenticated ciphers, Schwaemm, with security levels ranging from 120 to 250 bits. We also use them to build new sponge-based hash functions, Esch256 and Esch384. Our permutations are among those with the lowest footprint in software, without sacrificing throughput. These properties are allowed by our use of an ARX component (the Alzette S-box) as well as a carefully chosen number of rounds. The corresponding analysis is enabled by the long trail strategy which gives us the tools we need to efficiently bound the probability of all the differential and linear trails for an arbitrary number of rounds. We also present a new application of this approach where the only trails considered are those mapping the rate to the outer part of the internal state, such trails being the only relevant trails for instance in a differential collision attack. To further decrease the number of rounds without compromising security, we modify the message injection in the classical sponge construction to break the alignment between the rate and our S-box layer.

/pdf/lightweight-aead-and-hashing-using-the-sparkle-permutation-33vyeyka3t.pdf

Lightweight AEAD and Hashing using the Sparkle Permutation Family

S-boxes are the only source of non-linearity in many symmetric primitives. While they are often defined as being functions operating on a small space, some recent designs propose the use of much larger ones (e.g., 32 bits). In this context, an S-box is then defined as a subfunction whose cryptographic properties can be estimated precisely.

/pdf/alzette-a-64-bit-arx-box-feat-crax-and-trax-4peaskqbvo.pdf

Alzette: A 64-Bit ARX-box - (Feat. CRAX and TRAX).

Cryptographic algorithms that can simultaneously provide both encryption and authentication play an increasingly important role in modern security architectures and protocols (e.g. TLS v1.3). Dozens of authenticated encryption systems have been designed in the past five years, which has initiated a large body of research in cryptanalysis. The interest in authenticated encryption has further risen after the National Institute of Standards and Technology (NIST) announced an initiative to standardize “lightweight” authenticated ciphers and hash functions that are suitable for resource-constrained devices. However, while there already exist some cryptanalytic results on these recent designs, little is known about their performance, especially when they are executed on small 8, 16, and 32-bit microcontrollers. In this paper, we introduce an open-source benchmarking tool suite for a fair and consistent evaluation of Authenticated Encryption with Associated Data (AEAD) algorithms written in C or assembly language for 8-bit AVR, 16-bit MSP430, and 32-bit ARM Cortex-M3 platforms. The tool suite is an extension of the FELICS benchmarking framework and provides a new AEAD-specific low-level API that allows users to collect very fine-grained and detailed results for execution time, RAM consumption, and binary code size in a highly automated fashion. FELICS-AEAD comes with two pre-defined evaluation scenarios, which were developed to resemble security-critical operations commonly carried out by real IoT applications to ensure the benchmarks are meaningful in practice. We tested the AEAD tool suite using five authenticated encryption algorithms, namely AES-GCM and the CAESAR candidates ACORN, ASCON, Ketje-Jr, and NORX, and present some preliminary results.

FELICS-AEAD: Benchmarking of Lightweight Authenticated Encryption Algorithms

/pdf/alzette-a-64-bit-arx-box-2q7xdm9i5l.pdf

Alzette: A 64-bit ARX-box.

We propose a new cryptanalytic tool for differential cryptanalysis, called meet-in-the-filter (MiF). It is suitable for ciphers with a slow or incomplete diffusion layer such as the ones based on Addition-Rotation-XOR (ARX). The MiF technique uses a meet-in-the-middle matching to construct differential trails connecting the differential’s output and the ciphertext difference. The proposed trails are used in the key recovery procedure, reducing time complexity and allowing flexible time-data trade-offs. In addition, we show how to combine MiF with a dynamic counting technique for key recovery. We illustrate MiF in practice by reporting improved attacks on the ARX -based family of block ciphers Speck. We improve the time complexities of the best known attacks up to 15 rounds of Speck 32 and 20 rounds of Speck 64/128. Notably, our new attack on 11 rounds of Speck 32 has practical analysis and data complexities of $$2^{24.66}$$ and $$2^{26.70}$$ respectively, and was experimentally verified, recovering the master key in a matter of seconds. 

Luan Cardoso dos Santos

Papers

Lightweight AEAD and Hashing using the Sparkle Permutation Family

Alzette: A 64-Bit ARX-box - (Feat. CRAX and TRAX).

FELICS-AEAD: Benchmarking of Lightweight Authenticated Encryption Algorithms

Alzette: A 64-bit ARX-box.

Meet-in-the-Filter and Dynamic Counting with Applications to Speck