June 21, 2024
Yusuke Naito - Mitsubishi Electric Corporation
We propose a new wide encryption (WE) mode of operation that satisfies robust authenticated encryption (RAE) and committing security with minimum ciphertext expansion. WE is attracting much attention in the last few years, and its advantage includes RAE security that provides robustness against wide range of misuses, combined with the encode-then-encipher (EtE) construction. Unfortunately, WEbased EtE does not provide good committing security, and there is a recent constant-time CMT-4 attack (Chen et al., ToSC 2023(4)). Improving CMT-4 security requires considerable ciphertext expansion, and the state-of-the-art scheme expands the ciphertext by \(s\)rae + 2\(s\)cmt bits from an original message to achieve \(s\)rae-bit RAE and \(s\)cmt-bit CMT-4 security. Our new WE mode FFF addresses the issue by achieving \(s\)rae-bit RAE and \(s\)cmt-bit CMT-4 security only with max{\(s\)cmt, \(s\)rae} bits of ciphertext expansion. Our design is based on the committing concealer proposed by Bellare et al., and its extension to WE (cf. tag-based AE) while satisfying RAE security is the main technical innovation.
Workshop on the Requirements for an Accordion Cipher Mode 2024
