Optimal PRFs from Blockcipher Designs

Authors

  • Bart Mennink Digital Security Group, Radboud University, Nijmegen, The Netherlands; Centrum Wiskunde & Informatica (CWI), Amsterdam, The Netherlands
  • Samuel Neves Centre for Informatics and Systems of the University of Coimbra (CISUC), Department of Informatics Engineering, University of Coimbra, Coimbra, Portugal

DOI:

https://doi.org/10.13154/tosc.v2017.i3.228-252

Keywords:

PRP, PRF, EDMD, AES-PRF, GCM, GCM-SIV, PMAC1

Abstract

Cryptographic modes built on top of a blockcipher usually rely on the assumption that this primitive behaves like a pseudorandom permutation (PRP). For many of these modes, including counter mode and GCM, stronger security guarantees could be derived if they were based on a PRF design. We propose a heuristic method of transforming a dedicated blockcipher design into a dedicated PRF design. Intuitively, the method consists of evaluating the blockcipher once, with one or more intermediate state values fed-forward. It shows strong resemblance with the optimally secure EDMD construction by Mennink and Neves (CRYPTO 2017), but the use of internal state values make their security analysis formally inapplicable. In support of its security, we give the rationale of relying on the EDMD function (as opposed to alternatives), and present analysis of simplified versions of our conversion method applied to the AES. We conjecture that our main proposal AES-PRF, AES with a feed-forward of the middle state, achieves close to optimal security. We apply the design to GCM and GCM-SIV, and demonstrate how it entails significant security improvements. We furthermore demonstrate how the technique extends to tweakable blockciphers and allows for security improvements in, for instance, PMAC1.

Published

2017-09-19

Issue

Section

Articles

How to Cite

Optimal PRFs from Blockcipher Designs. (2017). IACR Transactions on Symmetric Cryptology, 2017(3), 228-252. https://doi.org/10.13154/tosc.v2017.i3.228-252