Citation Context

...y are a popular way to provide simultaneously both integrity and confidentiality. Many block cipher modes have been proposed and most of these come with asecurity proof against generic a�acks, e.g., =-=[3,21,28,45,38,5,30,43,32,24,46,39,25,27,26,31]-=-. Interestingly, there have also been a�empts at designing dedicated hybrid primitives offering efficient simultaneous stream encryption and MAC computation, e.g., Helix and Phelix [20,48]. However, t...

Citation Context

...te for the entire cipher. (These are long-message figures, but the per-message overhead is reasonably small: for example, a 1536-byte message with full Salsa20 uses 5.75 cycles/byte.) For comparison, =-=[29]-=- reports that a new AES-128-CTR assembly-language implementation, contributed to OpenSSL by Polyakov, runs at 25.4 Cortex A8 cycles per byte (0.25 Gbps at 800MHz). There is no indication that this spe...

Citation Context

...inst nonce-respecting adversaries ag. nonce-reusing adversaries on-line CCFB[33] CHM[22] CIP[23] CWC[29] EAX[7] GCM[34] McOE-X (this paper) IACBC[26] IAPM[26] McOE-G McOE-X McOE-G (this paper) OCB1-3 =-=[40,38,30]-=- RPC[11] TAE[31] XCBC[17] off-line BTM[24] CCM[14] HBS[25] SIV[41] SSH-CTR[36] BTM[24] HBS[25] SIV[41] Table 1. Classification of provably secure block-cipher-based AE Schemes. CCM and SSH-CTR are con...

Citation Context

... RAE is desirable, define its syntax and security, and explore its guarantees. Then we construct an RAE scheme, AEZ, from AES4 and AES10 (four- and ten-round AES). AEZ’s efficiency—nearly that of OCB =-=[34]-=- or AES-CTR—flies in the face of a community’s collective work [5, 12–14, 20, 26– 28, 36, 39–41, 52–54, 61] in which wide-block enciphering schemes—a special case of RAE—were always far more expensive...

Citation Context

... per-message IV or nonce. Subsequent papers have delivered tweakable enciphering schemes (e.g. [14–16, 32, 8] and others), message authentication codes (e.g. [28]), and authenticated encryption (e.g. =-=[27, 28, 20]-=-) modes of operation. The Skein [30] hash function has a TBC at its core. TBC-based constructions have found widespread practical application for full-disk encryption. BUILDING TBCS. There are few ded...

Citation Context

...ble for estimating the timing characteristics of the link and keeping track of the client’s current public IP address. The security of the system is built on AES-128 in the Offset Codebook (OCB) mode =-=[5]-=-, which provides confidentiality and authenticity with a single secret key. To handle reordered and repeated packets, SSP relies on the principle of idempotency. Each datagram sent to the remote site ...

Citation Context

...it key 128-bit block cipher proposal Deoxys-BC based on the AES round function, but faster and more lightweight than other tentatives to build a tweakable block cipher from AES-128. When used in ΘCB3 =-=[37]-=- authenticated encryption, Deoxys-BC runs at about 1.3 c/B on the latest Intel processors. This has to be compared to OCB3, which runs at 0.7-0.88 c/B when instantiated with AES-128, but only ensures ...

Citation Context

...stance against noncemisuse attacks. Keywords: on-line cipher, chosen-ciphertext security, authenticated encryption 1 Introduction Authenticated Encryption (AE) schemes (such as EAX [7], GCM [31], OCB =-=[28]-=-, etc.) perform an authentication check on the entire ciphertext before they output a decrypted message. This practice is inherent in the idea of authenticated encryption and part of its strength. How...

Citation Context

...key agreement or distribution. Encryption and authentication can be done through generic composition of separate methods; however, the study of an alternative approach named authenticated encryption (AE) has gained popularity. Authenticated encryption provides both confidentiality and authenticity within a single scheme. It is often more efficient than using separate methods and usually consumes a smaller amount of resources. It also prevents common critical mistakes when combining encryption and authentication such as not using separate keys for each task. There are many AE schemes; see e.g. [10] for a nonexhaustive list. Some AE schemes are built using a block cipher, in this case, they ? Supported by FAPESP, grant 2010/15340-3. are also called AE modes. In this work, we follow the approach from [10] and compare the Counter with CBC-MAC (CCM) mode [18], the Galois/Counter Mode (GCM) [13] and the Offset Codebook (OCB3) mode [10]. We have also implemented the Sophie Germain Counter Mode [14], the Hummingbird-2 cipher [5] and the MASHA cipher [9]. The CCM mode and GCM have been standardized by the National Institute of Standards and Technology (NIST); CCM is used for Wi-Fi WPA2 security...