Towards closing the security gap of Tweak-aNd-Tweak (TNT)
Tweakable block ciphers (TBCs) have been established as a valuable replacement for many applications of classical block ciphers. While several dedicated TBCs have been proposed in the previous years, generic constructions that build a TBC from a classical block cipher are still highly useful, for ex...
| Main Authors: | , , , |
|---|---|
| Other Authors: | |
| Format: | Conference Paper |
| Language: | English |
| Published: |
2021
|
| Subjects: | |
| Online Access: | https://hdl.handle.net/10356/146455 |
| _version_ | 1811694625581170688 |
|---|---|
| author | Guo, Chun Guo, Jian List, Eik Song, Ling |
| author2 | School of Physical and Mathematical Sciences |
| author_facet | School of Physical and Mathematical Sciences Guo, Chun Guo, Jian List, Eik Song, Ling |
| author_sort | Guo, Chun |
| collection | NTU |
| description | Tweakable block ciphers (TBCs) have been established as a valuable replacement for many applications of classical block ciphers. While several dedicated TBCs have been proposed in the previous years, generic constructions that build a TBC from a classical block cipher are still highly useful, for example, to reuse an existing implementation. However, most generic constructions need an additional call to either the block cipher or a universal hash function to process the tweak, which limited their efficiency. To address this deficit, Bao et al. proposed Tweak-aNd-Tweak (TNT) at EUROCRYPT’20. Their construction chains three calls to independent keyed permutations and adds the unmodified tweak to the state in between the calls. They further suggested an efficient instantiation TNT-AES that was based on round-reduced AES for each of the permutations. Their work could prove 2n/3-bit security for their construction, where n is the block size in bits. Though, in the absence of an upper bound, their analysis had to consider all possible attack vectors with up to 2n time, data, and memory. Still, closing the gap between both bounds remained a highly interesting research question. In this work, we show that a variant of Mennink’s distinguisher on CLRW2 with O(n23n/4) data and O(23n/2) time from TCC’18 also applies to TNT. We reduce its time complexity to O(n23n/4), show the existence of a second similar distinguisher, and demonstrate how to transform the distinguisher to a key-recovery attack on from an impossible differential. From a constructive point of view, we adapt the rigorous STPRP analysis of CLRW2 by Jha and Nandi to show O(23n/4) TPRP security for TNT. Thus, we move towards closing the gap between the previous proof and attacks for TNT as well as its proposed instance. |
| first_indexed | 2024-10-01T07:10:33Z |
| format | Conference Paper |
| id | ntu-10356/146455 |
| institution | Nanyang Technological University |
| language | English |
| last_indexed | 2024-10-01T07:10:33Z |
| publishDate | 2021 |
| record_format | dspace |
| spelling | ntu-10356/1464552023-02-28T19:17:52Z Towards closing the security gap of Tweak-aNd-Tweak (TNT) Guo, Chun Guo, Jian List, Eik Song, Ling School of Physical and Mathematical Sciences International Conference on the Theory and Application of Cryptology and Information Security Science Cryptanalysis Block Cipher Tweakable block ciphers (TBCs) have been established as a valuable replacement for many applications of classical block ciphers. While several dedicated TBCs have been proposed in the previous years, generic constructions that build a TBC from a classical block cipher are still highly useful, for example, to reuse an existing implementation. However, most generic constructions need an additional call to either the block cipher or a universal hash function to process the tweak, which limited their efficiency. To address this deficit, Bao et al. proposed Tweak-aNd-Tweak (TNT) at EUROCRYPT’20. Their construction chains three calls to independent keyed permutations and adds the unmodified tweak to the state in between the calls. They further suggested an efficient instantiation TNT-AES that was based on round-reduced AES for each of the permutations. Their work could prove 2n/3-bit security for their construction, where n is the block size in bits. Though, in the absence of an upper bound, their analysis had to consider all possible attack vectors with up to 2n time, data, and memory. Still, closing the gap between both bounds remained a highly interesting research question. In this work, we show that a variant of Mennink’s distinguisher on CLRW2 with O(n23n/4) data and O(23n/2) time from TCC’18 also applies to TNT. We reduce its time complexity to O(n23n/4), show the existence of a second similar distinguisher, and demonstrate how to transform the distinguisher to a key-recovery attack on from an impossible differential. From a constructive point of view, we adapt the rigorous STPRP analysis of CLRW2 by Jha and Nandi to show O(23n/4) TPRP security for TNT. Thus, we move towards closing the gap between the previous proof and attacks for TNT as well as its proposed instance. Ministry of Education (MOE) Accepted version This research has been partially supported by Nanyang Technological University in Singapore under Grant 04INS000397C230, Singapore’s Ministry of Education under Grants RG18/19 and MOE2019-T2-1-060. 2021-02-17T08:34:38Z 2021-02-17T08:34:38Z 2020 Conference Paper Guo, C., Guo, J., List, E., & Song, L. (2020). Towards closing the security gap of Tweak-aNd-Tweak (TNT). ASIACRYPT 2020, 12491 LNCS, 567-597. doi:10.1007/978-3-030-64837-4_19 9783030648367 https://hdl.handle.net/10356/146455 10.1007/978-3-030-64837-4_19 2-s2.0-85097822128 12491 LNCS 567 597 en © 2020 International Association for Cryptologic Research (IACR) (published by Springer). All rights reserved. This paper was published in ASIACRYPT 2020 and is made available with permission of International Association for Cryptologic Research (IACR) (published by Springer). application/pdf |
| spellingShingle | Science Cryptanalysis Block Cipher Guo, Chun Guo, Jian List, Eik Song, Ling Towards closing the security gap of Tweak-aNd-Tweak (TNT) |
| title | Towards closing the security gap of Tweak-aNd-Tweak (TNT) |
| title_full | Towards closing the security gap of Tweak-aNd-Tweak (TNT) |
| title_fullStr | Towards closing the security gap of Tweak-aNd-Tweak (TNT) |
| title_full_unstemmed | Towards closing the security gap of Tweak-aNd-Tweak (TNT) |
| title_short | Towards closing the security gap of Tweak-aNd-Tweak (TNT) |
| title_sort | towards closing the security gap of tweak and tweak tnt |
| topic | Science Cryptanalysis Block Cipher |
| url | https://hdl.handle.net/10356/146455 |
| work_keys_str_mv | AT guochun towardsclosingthesecuritygapoftweakandtweaktnt AT guojian towardsclosingthesecuritygapoftweakandtweaktnt AT listeik towardsclosingthesecuritygapoftweakandtweaktnt AT songling towardsclosingthesecuritygapoftweakandtweaktnt |