Welcome to the resource topic for 2018/819
Title:
ZCZ - Achieving n-bit SPRP Security with a Minimal Number of Tweakable-block-cipher Calls
Authors: Ritam Bhaumik, Eik List, Mridul Nandi
Abstract:Strong Pseudo-random Permutations (SPRPs) are important for various applications. In general, it is desirable to base an SPRP on a single-keyed primitive for minimizing the implementation costs. For constructions built on classical block ciphers, Nandi showed at ASIACRYPT’15 that at least two calls to the primitive per processed message block are required for SPRP security, assuming that all further operations are linear. The ongoing trend of using tweakable block ciphers as primitive has already led to MACs or encryption modes with high security and efficiency properties. Thus, three interesting research questions are hovering in the domain of SPRPs: (1) if and to which extent the bound of two calls per block can be reduced with a tweakable block cipher, (2) how concrete constructions could be realized, and (3) whether full n-bit security is achievable from primitives with n-bit state size. The present work addresses all three questions. Inspired by Iwata et al.'s ZHash proposal at CRYPTO’17, we propose the ZCZ (ZHash-Counter-ZHash) construction, a single-key variable-input-length SPRP based on a single tweakable block cipher whose tweak length is at least its state size. ZCZ possesses close to optimal properties with regards to both performance and security: not only does it require only asymptotically 3\ell/2 calls to the primitive for \ell-block messages, but we also show that this figure is close to the minimum by an PRP distinguishing attack on any construction with tweak size of \tau = n bits and fewer than (3\ell-1)/2 calls to the same primitive. Moreover, it provides optimal n-bit security for a primitive with n-bit state and tweak size.
ePrint: https://eprint.iacr.org/2018/819
Slides: https://asiacrypt.iacr.org/2018/files/SLIDES/MONDAY/421/1515-1605/asiacrypt_slides_ZCZ_v1.2.pdf
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .