Exploring Integrity of AEADs with Faults: Definitions and Constructions
Implementation-based attacks are major concerns for modern cryptography. For symmetric-key cryptography, a significant amount of exploration has taken place in this regard for primitives such as block ciphers. Concerning symmetric-key operating modes, such as Authenticated Encryption with Associate...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2022-12-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/9980 |
| _version_ | 1811178459873935360 |
|---|---|
| author | Sayandeep Saha Mustafa Khairallah Thomas Peyrin |
| author_facet | Sayandeep Saha Mustafa Khairallah Thomas Peyrin |
| author_sort | Sayandeep Saha |
| collection | DOAJ |
| description |
Implementation-based attacks are major concerns for modern cryptography. For symmetric-key cryptography, a significant amount of exploration has taken place in this regard for primitives such as block ciphers. Concerning symmetric-key operating modes, such as Authenticated Encryption with Associated Data (AEAD), the stateof-the-art mainly addresses the passive Side-Channel Attacks (SCA) in the form of leakage resilient cryptography. So far, only a handful of work address Fault Attacks (FA) in the context of AEADs concerning the fundamental properties – integrity and confidentiality. In this paper, we address this gap by exploring mode-level issues arising due to FAs. We emphasize that FAs can be fatal even in cases where the adversary does not aim to extract the long-term secret, but rather tries to violate the basic security requirements (integrity and confidentiality). Notably, we show novel integrity attack examples on state-of-the-art AEAD constructions and even on a prior fault-resilient AEAD construction called SIV$. On the constructive side, we first present new security notions of fault-resilience, for PRF (frPRF), MAC (frMAC) and AEAD (frAE), the latter can be seen as an improved version of the notion introduced by Fischlin and Gunther at CT-RSA’20. Then, we propose new constructions to turn a frPRF into a fault-resilient MAC frMAC (hash-then-frPRF) and into a fault-resilient AEAD frAE (MAC-then-Encrypt-then-MAC or MEM).
|
| first_indexed | 2024-04-11T06:18:40Z |
| format | Article |
| id | doaj.art-8b95226507fe4eb98f3fdfb8437758d7 |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-04-11T06:18:40Z |
| publishDate | 2022-12-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-8b95226507fe4eb98f3fdfb8437758d72022-12-22T04:40:58ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2022-12-012022410.46586/tosc.v2022.i4.291-324Exploring Integrity of AEADs with Faults: Definitions and ConstructionsSayandeep Saha0Mustafa Khairallah1Thomas Peyrin2School of Physical and Mathematical Sciences, Nanyang Technological University (NTU), Singapore, SingaporeSchool of Physical and Mathematical Sciences, Nanyang Technological University (NTU), Singapore, Singapore; Seagate Research, Singapore, SingaporeSchool of Physical and Mathematical Sciences, Nanyang Technological University (NTU), Singapore, Singapore Implementation-based attacks are major concerns for modern cryptography. For symmetric-key cryptography, a significant amount of exploration has taken place in this regard for primitives such as block ciphers. Concerning symmetric-key operating modes, such as Authenticated Encryption with Associated Data (AEAD), the stateof-the-art mainly addresses the passive Side-Channel Attacks (SCA) in the form of leakage resilient cryptography. So far, only a handful of work address Fault Attacks (FA) in the context of AEADs concerning the fundamental properties – integrity and confidentiality. In this paper, we address this gap by exploring mode-level issues arising due to FAs. We emphasize that FAs can be fatal even in cases where the adversary does not aim to extract the long-term secret, but rather tries to violate the basic security requirements (integrity and confidentiality). Notably, we show novel integrity attack examples on state-of-the-art AEAD constructions and even on a prior fault-resilient AEAD construction called SIV$. On the constructive side, we first present new security notions of fault-resilience, for PRF (frPRF), MAC (frMAC) and AEAD (frAE), the latter can be seen as an improved version of the notion introduced by Fischlin and Gunther at CT-RSA’20. Then, we propose new constructions to turn a frPRF into a fault-resilient MAC frMAC (hash-then-frPRF) and into a fault-resilient AEAD frAE (MAC-then-Encrypt-then-MAC or MEM). https://tosc.iacr.org/index.php/ToSC/article/view/9980Fault AttackSide-Channel AttackAuthenticated Encryption with Associated Data |
| spellingShingle | Sayandeep Saha Mustafa Khairallah Thomas Peyrin Exploring Integrity of AEADs with Faults: Definitions and Constructions IACR Transactions on Symmetric Cryptology Fault Attack Side-Channel Attack Authenticated Encryption with Associated Data |
| title | Exploring Integrity of AEADs with Faults: Definitions and Constructions |
| title_full | Exploring Integrity of AEADs with Faults: Definitions and Constructions |
| title_fullStr | Exploring Integrity of AEADs with Faults: Definitions and Constructions |
| title_full_unstemmed | Exploring Integrity of AEADs with Faults: Definitions and Constructions |
| title_short | Exploring Integrity of AEADs with Faults: Definitions and Constructions |
| title_sort | exploring integrity of aeads with faults definitions and constructions |
| topic | Fault Attack Side-Channel Attack Authenticated Encryption with Associated Data |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/9980 |
| work_keys_str_mv | AT sayandeepsaha exploringintegrityofaeadswithfaultsdefinitionsandconstructions AT mustafakhairallah exploringintegrityofaeadswithfaultsdefinitionsandconstructions AT thomaspeyrin exploringintegrityofaeadswithfaultsdefinitionsandconstructions |