International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

ZOCB and ZOTR: Tweakable Blockcipher Modes for Authenticated Encryption with Full Absorption

Authors:
Zhenzhen Bao , Division of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University; Strategic Centre for Research in Privacy-Preserving Technologies and Systems, Nanyang Technological University
Jian Guo , Division of Mathematical Sciences, School of Physical and Mathematical Sciences, Nanyang Technological University
Tetsu Iwata , Nagoya University
Kazuhiko Minematsu , NEC Corporation
Download:
DOI: 10.13154/tosc.v2019.i2.1-54
URL: https://tosc.iacr.org/index.php/ToSC/article/view/8313
Search ePrint
Search Google
Abstract: We define ZOCB and ZOTR for nonce-based authenticated encryption with associated data, and analyze their provable security. These schemes use a tweakable blockcipher (TBC) as the underlying primitive, and fully utilize its input to process a plaintext and associated data (AD). This property is commonly referred to as full absorption, and this has been explored for schemes based on a permutation or a pseudorandom function (PRF). Our schemes improve the efficiency of TBC-based counterparts of OCB and OTR called OCB3 (Krovetz and Rogaway, FSE 2011) and OTR (Minematsu, EUROCRYPT 2014). Specifically, ΘCB3 and OTR have an independent part to process AD, and our schemes integrate this process into the encryption part of a plaintext by using the tweak input of the TBC. Up to a certain length of AD, ZOCB and ZOTR completely eliminate the independent process for it. Even for longer AD, our schemes process it efficiently by fully using the tweak input of the TBC. For this purpose, based on previous tweak extension schemes for TBCs, we introduce a scheme called XTX*. To our knowledge, ZOCB and ZOTR are the first efficiency improvement of ΘCB3 and OTR in terms of the number of TBC calls. Compared to Sponge-based and PRF-based schemes, ZOCB and ZOTR allow fully parallel computation of the underlying primitive, and have a unique design feature that an authentication tag is independent of a part of AD. We present experimental results illustrating the practical efficiency gain and clarifying the efficiency cost for it with a concrete instantiation. The results show that for long input data, our schemes have gains, while we have efficiency loss for short input data.
Video from TOSC 2019
BibTeX
@article{tosc-2019-29504,
  title={ZOCB and ZOTR: Tweakable Blockcipher Modes for Authenticated Encryption with Full Absorption},
  journal={IACR Transactions on Symmetric Cryptology},
  publisher={Ruhr-Universität Bochum},
  volume={2019, Issue 2},
  pages={1-54},
  url={https://tosc.iacr.org/index.php/ToSC/article/view/8313},
  doi={10.13154/tosc.v2019.i2.1-54},
  author={Zhenzhen Bao and Jian Guo and Tetsu Iwata and Kazuhiko Minematsu},
  year=2019
}