Citation Context

...(D≪15)); see Appendix B. Here |A| = |B| = |C| = |D| = 32. While very fast, such maps are still slower than xoring a precomputed value. Our findings thus concretize Chakraborty and Sarkar’s suggestion =-=[6]-=- to improve OCB using a fast, 128-bit, word-oriented LFSR—but, in the end, we conclude that the idea doesn’t really help. Of course software-optimized 128-bit LFSRs may have other applications. All co...

Citation Context

...s called PMAC1; currently, the scheme in [35] itself is called PMAC. The construction in [35] is based on an efficient construction of tweakable block cipher (TBC) family [21]. Chakraborty and Sarkar =-=[9]-=- generalised the TBC construction in [35] and hence obtained several variants of PMAC. The bound on the advantage of PMAC forgery was shown to be cσ 2 /2 n , for some constant c, where σ is the total ...

Citation Context

...OCB protocol [9] and a patent on this algorithm is held by Rogaway [9]. Rogaway’s approach to modes of operations via tweakable block ciphers was extended and generalized by Chakraborty and Sarkar in =-=[3]-=-. In particular, it was shown that OCB (as given in [11]) is a special case of a family of single-pass AE protocols all of which have similar efficiencies. From the point of applications, AE is not re...

Citation Context

...⊕ h(t))⊕ h(t) , (2) where h ∈ H. These constructions achieve security up to the birthday bound. Related to LRW2 is the XEX construction by Rogaway [41], and extensions of it by Chakraborty and Sarkar =-=[7]-=- and Minematsu [32], which effectively reduces the keyspace to n bits. Landecker, Shrimpton, and Terashima [27] considered the cascade of two LRW2’s: LRW2[2]([k1, k2, h1, h2], t,m) = LRW2([k2, h2], t,...

Citation Context

...y NIST of USA. CMAC is based on the cipher-block chaining (CBC) mode of operation and is inherently sequential. Fully parallelisable modes of operations of a block cipher for authentication are known =-=[12, 50, 15, 53]-=-. We note that by no means the above-referenced papers are the only works on authentication. Fully referencing all such works is out of the scope of this paper. The previously reported schemes which a...

Citation Context

...ase for formalisation of nonce-based symmetric encryption has been done in [30]. 2Modes of operations of block ciphers to achieve AE have been studied in the literature and several schemes are known =-=[21, 18, 31, 29, 13, 38]-=-. NIST of USA has standardised one such scheme, called GCM [24, 14]. The issue of authenticating an associated data was first formally tackled in [28]. Later works such as [29, 24, 39] incorporated me...

Citation Context

...1, . . . , α`, N),m) = Ek(m⊕∆)⊕∆ . (2) If the generators and the tweak space are defined such that the xα11 · · · xα`` are unique and unequal to 1 for all tweaks, XEX achieves birthday bound security =-=[10,31,37]-=-. Along with XEX, Rogaway also considered XE, its cousin which only masks the inputs to E and achieves PRP instead of SPRP security. Here, ` is usually a small number, and the generators and the tweak...

Citation Context

... function. All subsequent constructions of tweakable blockcipher have been created in this model, where a tweakable blockcipher is created using a regular blockcipher as a primitive [10], [10], [26], =-=[5]-=-. Tweakable blockciphers are important primitives which have many practical applications. Liskov, Rivest and Wagner show that tweakable blockciphers can be used to implement secure symmetric encryptio...

Citation Context

...ased. Observe that we have abused the idea of a tweakable block cipher since we do not comply with the efficiency requirement put forth in [21]. Other tweakable cipher constructions are considered in =-=[23, 24, 25]-=- but none of them consider the issue of side-channel resistance. Moreover, all of the constructions use the same key in both calls to the block cipher. We have already mentioned the treatment of re-ke...