October 3, 2023
Paul Crowley - Google LLC
On modern processors HCTR is one of the most efficient constructions for building a tweakable super-pseudorandom permutation. However, a bug in the specification and another in Chakraborty and Nandi’s security proof invalidate the claimed security bound. We here present HCTR2, which fixes these issues and improves the security bound, performance and flexibility.
The Third NIST Workshop on Block Cipher Modes of Operation