NIST-standardized Deterministic Random Bit Generators (DRBGs) are widely deployed in various operating systems and real-world cryptosystems. Their security has been analyzed under the assumption that the DRBGs use random seeds that are independent of the entropy source. However, DRBG operations might affect the physical state of the hardware, creating a correlation between the seed and the entropy source. So the seedless model better captures the real environment around a DRBG, while security in this model is not immediate from the security in the (stronger) seeded model. For example, the NIST standard CTR-DRBG, which has been proven to be secure under the seeded assumption, turns out to be vulnerable in the seedless model.Motivated by this observation, we prove the security of the NIST-standardized hash-based DRBGs, specifically HASH-DRBG and HMAC-DRBG, in the seedless robustness model. In particular, by modifying and applying the Multi-Extraction framework of Chung et al. to the security proof, we improve the previous security bound of HASH-DRBG from $O\left( {\min \left\{ {{2^{n/2}},{2^{\lambda /2}},{2^{L/3}}} \right\}} \right)$ in the seeded model to an even better bound $O\left( {\min \left\{ {{2^{n/2}},{2^{\lambda /2}},{2^{L/2}}} \right\}} \right)$ in the seedless model, where n is the output size of the underlying hash function, λ is the min-entropy threshold of the entropy source, and L is the size of the state components in HASHDRBG. Our result implies that HASH-DRBG remains secure even with an internal state of a smaller size. Furthermore, in our security proof, a DRBG is allowed to collect randomness of small entropy multiple times before it returns the output. This assumption is, for example, relevant to the security of Linux, where entropy is gradually accumulated over multiple refresh calls. We prove that NIST hash-based DRBGs also remain secure even with such sources of small entropy.

MPC-in-the-Head (MPCitH) has recently gained traction as a foundation for post-quantum signature schemes, offering robust security without trapdoors. Despite its strong security profile, MPCitH-based schemes suffer from high computational overhead and large signature sizes, limiting their practical application. This work addresses these inefficiencies by relaxing vector commitments within MPCitH-based schemes. We introduce the concept of vector semi-commitment, which relaxes the binding property of traditional vector commitment. Vector semi-commitment schemes may allow an adversary to find more than one preimage of a commitment. We instantiate vector semi-commitment schemes in both the random oracle model and the ideal cipher model, leveraging recent optimizations on GGM tree such as correlated GGM tree. We apply the ideal-cipher-based vector semi-commitment scheme to the BN++ signature scheme and prove it almost fully secure in the ideal cipher model. Implementing these improvements in the v2.0 signature scheme, we achieve up to 18

Post-quantum cryptography (PQC) is becoming increasingly critical for securing Internet of Things (IoT) applications against potential threats posed by quantum computers. However, cryptographic schemes based on mathematically hard problems, such as lattice-based constructions, may face reduced security margins due to ongoing cryptanalytic advancements. In IoT use cases requiring long-term deployment without guaranteed secure updates, symmetric-based signature schemes, such as SPHINCS+, whose security relies solely on symmetric primitives, are considered robust alternatives. Among these, AIMer, selected as a finalist in the Korean PQC competition, is emerging as a promising candidate. This article presents optimized software implementations of AIMer for various IoT platforms, ranging from low-end to high-end devices. We propose memory-optimized and time-memory tradeoff implementations for resource-constrained ARM Cortex-M4 devices, and single instruction multiple data (SIMD)-accelerated implementations for AArch64 and AVX2 architectures. Furthermore, we conduct a comprehensive performance evaluation comparing our optimized implementations with other PQC signature schemes. Our results show that AIMer achieves significantly smaller signature sizes and faster key generation and signing compared to SPHINCS+ across all security levels, making it a viable option for long-term IoT deployment.

The authenticated encryption (AE) scheme is one of the most widely used AE schemes in the world, while it suffers from risk of nonce misuse, short message length per encryption and an insufficient level of security. The goal of this paper is to design new AE schemes achieving stronger provable security in the standard model and accepting longer nonces (or providing nonce misuse resistance), with the design rationale behind . As a result, we propose two enhanced variants of and - , dubbed and - , respectively. and - are built on top of a new -type encryption mode, dubbed : using 2n-bit counters, enjoys beyond-birthday-bound security without significant loss of efficiency. is combined with an almost uniform and almost universal hash function, yielding a variable input-length variable output-length pseudorandom function, dubbed . and - are constructed using and as building blocks. and - accept nonces of arbitrary length, and provide almost the full security (namely, n-bit security when they are based on an n-bit block cipher) for a constant maximum input length, under the assumption that the underlying block cipher is a pseudorandom permutation (PRP). Their efficiency is also comparable to in terms of the rate and the overall speed.

Oblivious pseudorandom function (OPRF) is a two-party cryptographic protocol that allows the receiver to input x and learn F(x) for some PRF F, only known to the sender. For private set intersection (PSI) applications, OPRF protocols have evolved to enhance efficiency, primarily using symmetric key cryptography. Current state-of-the-art protocols, such as those by Rindal and Schoppmann (Eurocrypt '21), leverage vector oblivious linear evaluation (VOLE) and oblivious key-value store (OKVS) constructions. In this work, we identify a flaw in an existing security proof, and present practical attacks in the malicious model, which results in additional PRF evaluations than the previous works' claim. In particular, the attack for malicious model is related to the concept of OKVS overfitting, whose hardness is conjectured in previous works. Our attack is the first one to discuss the concrete hardness of OKVS overfitting problem. As another flavour of contribution, we generalize OKVS-based OPRF constructions, suggesting new instantiations using a VOLE protocol with only Minicrypt assumptions. Our generalized construction shows improved performance in high-speed network environments, narrowing the efficiency gap between the OPRF constructions over Cryptomania and Minicrypt.

Online authenticated encryption has been considered of practical relevance in light-weight environments due to low latency and constant memory usage. In this paper, we propose a new tweakable block cipher-based online authenticated encryption scheme, dubbed ZLR, and its domain separation variant, dubbed DS-ZLR. ZLR and DS-ZLR follow the Encrypt-Mix-Encrypt paradigm. However, in contrast to existing schemes using the same paradigm such as ELmE and CoLM, ZLR and DS-ZLR enjoy n-bit security by using larger internal states with an efficient ZHash-like hashing algorithm. In this way, 2n-bit blocks are processed with only a single primitive call for hashing and two primitive calls for encryption and decryption, when they are based on an n-bit tweakable block cipher using n-bit (resp. 2n-bit) tweaks for ZLR (resp. DS-ZLR). Furthermore, they support pipelined computation as well as online nonce-misuse resistance. To the best of our knowledge, ZLR and DS-ZLR are the first pipelineable tweakable block cipher-based online authenticated encryption schemes of rate-2/3 that provide n-bit security with online nonce-misuse resistance.

Post-quantum signature schemes based on the MPC-in-the-Head (MPCitH) paradigm are recently attracting significant attention as their security solely depends on the one-wayness of the underlying primitive, providing diversity for the hardness assumption in post-quantum cryptography. Recent MPCitH-friendly ciphers have been designed using simple algebraic S-boxes operating on a large field in order to improve the performance of the resulting signature schemes. Due to their simple algebraic structures, their security against algebraic attacks should be comprehensively studied. In this paper, we refine algebraic cryptanalysis of power mapping based S-boxes over binary extension fields, and cryptographic primitives based on such S-boxes. In particular, for the Gröbner basis attack over ⅇ2, we experimentally show that the exact number of Boolean quadratic equations obtained from the underlying S-boxes is critical to correctly estimate the theoretic complexity based on the degree of regularity. Similarly, it turns out that the XL attack might be faster when all possible quadratic equations are found and used from the S-boxes. This refined cryptanalysis leads to more precise algebraic analysis of cryptographic primitives based on algebraic S-boxes. Considering the refined algebraic cryptanalysis, we propose a new one-way function, dubbed AIM, as an MPCitH-friendly symmetric primitive with high resistance to algebraic attacks. The security of AIM is comprehensively analyzed with respect to algebraic, statistical, quantum, and generic attacks. AIM is combined with the BN++ proof system, yielding a new signature scheme, dubbed AIM. Our implementation shows that AIM outperforms existing signature schemes based on symmetric primitives in terms of signature size and signing time.

We present a new block cipher mode of operation for authenticated encryption (AE), dubbed $$\textsf{XOCB}$$ , that has the following features: (1) beyond-birthday-bound (BBB) security based on the standard pseudorandom assumption of the internal block cipher if the maximum block length is sufficiently smaller than the birthday bound, (2) rate-1 computation, and (3) supporting any block cipher with any key length. Namely, $$\textsf{XOCB}$$ has effectively the same efficiency as the seminal $$\textsf{OCB}$$ while having stronger quantitative security without any change in the security model or the required primitive in $$\textsf{OCB}$$ . Although numerous studies have been conducted in the past, our $$\textsf{XOCB}$$ is the first mode of operation to achieve these multiple goals simultaneously.

. Post-quantum signature schemes based on the MPC-in-the-Head (MPCitH) paradigm are recently attracting significant attention as their security solely depends on the one-wayness of the underlying primitive, providing diversity for the hardness assumption in post-quantum cryptography. Kim et al. proposed AIM as an MPCitH-friendly one-way function characterized by large algebraic S-boxes and parallel design, which lead to short signature size (CCS 2023). Recently, Liu et al. proposed a fast exhaustive search attack on AIM (ePrint 2023), which degrades the security of AIM by up to 13 bits. While communicating with the authors, they pointed out another possible vulnerability on AIM . In this paper, we propose AIM2 which mitigates all the vulnerabilities, and analyze its security against algebraic attacks.

A transciphering framework converts a symmetric ciphertext into a homomorphic ciphertext on the server-side, reducing computational and communication overload on the client-side. In Asiacrypt 2021, Cho et al. proposed the RtF framework that supports approximate computation. In this paper, we propose a family of noisy ciphers, dubbed Rubato, with a novel design strategy of introducing noise to a symmetric cipher of a low algebraic degree. With this strategy, the multiplicative complexity of the cipher is significantly reduced, compared to existing HE-friendly ciphers, without degrading the overall security. More precisely, given a moderate block size (16 to 64), Rubato enjoys a low multiplicative depth (2 to 5) and a small number of multiplications per encrypted word (2.1 to 6.25) at the cost of slightly larger ciphertext expansion (1.26 to 1.31). The security of Rubato is supported by comprehensive analysis including symmetric and LWE cryptanalysis. Compared to HERA within the RtF framework, client-side and server-side throughput is improved by 22.9% and 32.2%, respectively, at the cost of only 1.6% larger ciphertext expansion.

Homomorphic encryption (HE) is a promising cryptographic primitive that enables computation over encrypted data, with a variety of applications including medical, genomic, and financial tasks. In Asiacrypt 2017, Cheon et al. proposed the 𝖢𝖪𝖪𝖲 scheme to efficiently support approximate computation over encrypted data of real numbers. HE schemes including 𝖢𝖪𝖪𝖲 , nevertheless, still suffer from slow encryption speed and large ciphertext expansion compared to symmetric cryptography. In this paper, we propose a novel hybrid framework, dubbed 𝖱𝗍𝖥 (Real-to-Finite-field) framework, that supports 𝖢𝖪𝖪𝖲 . The main idea behind this construction is to combine the 𝖢𝖪𝖪𝖲 and the 𝖥𝖵 homomorphic encryption schemes, and use a stream cipher using modular arithmetic in between. As a result, real numbers can be encrypted without significant ciphertext expansion or computational overload on the client side. As an instantiation of the stream cipher in our framework, we propose a new HE-friendly cipher, dubbed 𝖧𝖤𝖱𝖠 , and extensively analyze its security and efficiency. The main feature of 𝖧𝖤𝖱𝖠 is that it uses a simple randomized key schedule. Compared to recent HE-friendly ciphers such as 𝖥𝖫𝖨𝖯 and 𝖱𝖺𝗌𝗍𝖺 using randomized linear layers, 𝖧𝖤𝖱𝖠 requires a smaller number of random bits. For this reason, 𝖧𝖤𝖱𝖠 significantly outperforms existing HE-friendly ciphers on both the client and the server sides. With the 𝖱𝗍𝖥 transciphering framework combined with 𝖧𝖤𝖱𝖠 at the 128-bit security level, we achieve small ciphertext expansion ratio with a range of 1.23 to 1.54, which is at least 23 times smaller than using (symmetric) 𝖢𝖪𝖪𝖲 -only, assuming the same precision bits and the same level of ciphertexts at the end of the framework. We also achieve 1.6 s and 21.7 MB/s for latency and throughput on the client side, which are 9085 times and 17.8 times faster than the 𝖢𝖪𝖪𝖲 -only environment, respectively.

In this paper, we propose a new block cipher-based authenticated encryption scheme, dubbed the Synthetic Counter with Masking (SCM) mode. SCM follows the NSIV paradigm proposed by Peyrin and Seurin (CRYPTO 2016), where a keyed hash function accepts a nonce N with associated data and a message, yielding an authentication tag T , and then the message is encrypted by a counter-like mode using both T and N . Here we move one step further by encrypting nonces; in the encryption part, the inputs to the block cipher are determined by T , counters, and an encrypted nonce, and all its outputs are also masked by an (additional) encrypted nonce, yielding keystream blocks. As a result, we obtain, for the first time, a block cipher-based authenticated encryption scheme of rate 1/2 that provides n-bit security with respect to the query complexity (ignoring the influence of message length) in the nonce-respecting setting, and at the same time guarantees graceful security degradation in the faulty nonce model, when the underlying nbit block cipher is modeled as a secure pseudorandom permutation. Seen as a slight variant of GCM-SIV, SCM is also parallelizable and inversefree, and its performance is still comparable to GCM-SIV.

In this work, we propose a construction of 2-round tweakable substitutionpermutation networks using a single secret S-box. This construction is based on non-linear permutation layers using independent round keys, and achieves security beyond the birthday bound in the random permutation model. When instantiated with an n-bit block cipher with ωn-bit keys, the resulting tweakable block cipher, dubbed CTET+, can be viewed as a tweakable enciphering scheme that encrypts ωκ-bit messages for any integer ω ≥ 2 using 5n + κ-bit keys and n-bit tweaks, providing 2n/3-bit security.Compared to the 2-round non-linear SPN analyzed in [CDK+18], we both minimize it by requiring a single permutation, and weaken the requirements on the middle linear layer, allowing better performance. As a result, CTET+ becomes the first tweakable enciphering scheme that provides beyond-birthday-bound security using a single permutation, while its efficiency is still comparable to existing schemes including AES-XTS, EME, XCB and TET. Furthermore, we propose a new tweakable enciphering scheme, dubbed AES6-CTET+, which is an actual instantiation of CTET+ using a reduced round AES block cipher as the underlying secret S-box. Extensivecryptanalysis of this algorithm allows us to claim 127 bits of security.Such tweakable enciphering schemes with huge block sizes become desirable in the context of disk encryption, since processing a whole sector as a single block significantly worsens the granularity for attackers when compared to, for example, AES-XTS, which treats every 16-byte block on the disk independently. Besides, as a huge amount of data is being stored and encrypted at rest under many different keys in clouds, beyond-birthday-bound security will most likely become necessary in the short term.

In this work, we propose a new table-based block cipher structure, dubbed 𝖥𝖯𝖫 , that can be used to build white-box secure block ciphers. Our construction is a balanced Feistel cipher, where the input to each round function determines multiple indices for the underlying table via a probe function, and the sum of the values from the table becomes the output of the round function. We identify the properties of the probe function that make the resulting block cipher white-box secure in terms of weak and strong space hardness against known-space and non-adaptive chosen-space attacks. Our construction, enjoying rigorous provable security without relying on any ideal primitive, provides flexibility to the block size and the table size, and permits parallel table look-ups. We also propose a concrete instantiation of 𝖥𝖯𝖫 , dubbed 𝖥𝖯𝖫_𝖠𝖤𝖲 , using (round-reduced) 𝖠𝖤𝖲 for the underlying table and probe functions. Our implementation shows that 𝖥𝖯𝖫_𝖠𝖤𝖲 provides stronger security without significant loss of efficiency, compared to existing schemes including 𝖲𝖯𝖠𝖢𝖤 , 𝖶𝗁𝗂𝗍𝖾𝖡𝗅𝗈𝖼𝗄 and 𝖶𝖤𝖬 .

In this work, we study the security of deterministic MAC constructions with a double-block internal state, captured by the double-block hash-then-sum ( 𝖣𝖻𝖧𝗍𝖲 ) paradigm. Most 𝖣𝖻𝖧𝗍𝖲 constructions, including 𝖯𝗈𝗅𝗒𝖬𝖠𝖢 , 𝖲𝖴𝖬-𝖤𝖢𝖡𝖢 , 𝖯𝖬𝖠𝖢-𝖯𝗅𝗎𝗌 , 3𝗄𝖿9 and 𝖫𝗂𝗀𝗁𝗍𝖬𝖠𝖢-𝖯𝗅𝗎𝗌 , have been proved to be pseudorandom up to 2^2n/3 queries when they are instantiated with an n-bit block cipher, while the best known generic attacks require 2^3n/4 queries. We close this gap by proving the PRF-security of 𝖣𝖻𝖧𝗍𝖲 constructions up to 2^3n/4 queries (ignoring the maximum message length). The core of the security proof is to refine Mirror theory that systematically estimates the number of solutions to a system of equations and non-equations, and apply it to prove the security of the finalization function. Then we identify security requirements of the internal hash functions to ensure 3n/4-bit security of the resulting constructions when combined with the finalization function. Within this framework, we prove the security of 𝖣𝖻𝖧𝗍𝖲 whose internal hash function is given as the concatenation of a universal hash function using two independent keys. This class of constructions include 𝖯𝗈𝗅𝗒𝖬𝖠𝖢 and 𝖲𝖴𝖬-𝖤𝖢𝖡𝖢 . Moreover, we prove the security of 𝖯𝖬𝖠𝖢-𝖯𝗅𝗎𝗌 , 3𝗄𝖿9 and 𝖫𝗂𝗀𝗁𝗍𝖬𝖠𝖢-𝖯𝗅𝗎𝗌 up to 2^3n/4 queries.

In this paper, we prove that the nonce-based enhanced hash-then-mask MAC ( 𝗇𝖤𝖧𝗍𝖬 ) is secure up to 2^3n/4 MAC queries and 2^n verification queries (ignoring logarithmic factors) as long as the number of faulty queries μ is below 2^3n/8 , significantly improving the previous bound by Dutta et al. Even when μ goes beyond 2^3n/8 , 𝗇𝖤𝖧𝗍𝖬 enjoys graceful degradation of security. The second result is to prove the security of PRF-based 𝗇𝖤𝖧𝗍𝖬 ; when 𝗇𝖤𝖧𝗍𝖬 is based on an n-to-s bit random function for a fixed size s such that 1≤ s≤ n , it is proved to be secure up to any number of MAC queries and 2^s verification queries, if (1) s=n and μ <2^n/2 or (2) n/2

Tweakable block ciphers (TBCs) have proven highly useful to boost the security guarantees of authentication schemes. In 2017, Cogliati et al. proposed two MACs combining TBC and universal hash functions: a nonce-based MAC called NaT and a deterministic MAC called HaT. While both constructions provide high security, their properties are complementary: NaT is almost fully secure when nonces are respected (i.e., n-bit security, where n is the block size of the TBC, and no security degradation in terms of the number of MAC queries when nonces are unique), while its security degrades gracefully to the birthday bound (n/2 bits) when nonces are misused. HaT has n-bit security and can be used naturally as a nonce-based MAC when a message contains a nonce. However, it does not have full security even if nonces are unique.This work proposes two highly secure and efficient MACs to fill the gap: NaT2 and eHaT. Both provide (almost) full security if nonces are unique and more than n/2-bit security when nonces can repeat. Based on NaT and HaT, we aim at achieving these properties in a modular approach. Our first proposal, Nonce-as-Tweak2 (NaT2), is the sum of two NaT instances. Our second proposal, enhanced Hash-as-Tweak (eHaT), extends HaT by adding the output of an additional nonce-depending call to the TBC and prepending nonce to the message. Despite the conceptual simplicity, the security proofs are involved. For NaT2 in particular, we rely on the recent proof framework for Double-block Hash-then-Sum by Kim et al. from Eurocrypt 2020.

One of natural ways of constructing a pseudorandom function from a pseudorandom permutation is to simply truncate the output of the permutation. When n is the permutation size and m is the number of truncated bits, the resulting construction is known to be indistinguishable from a random function up to \(2^{{n+m}\over 2}\) queries, which is tight.

We propose a new construction of tweakable block ciphers from standard block ciphers. Our construction, dubbed 𝖷𝖧𝖷2 , is the cascade of two independent 𝖷𝖧𝖷 block ciphers, so it makes two calls to the underlying block cipher using tweak-dependent keys. We prove the security of 𝖷𝖧𝖷2 up to min{2^2(n+m)/3,2^n+m/2} queries (ignoring logarithmic factors) in the ideal cipher model, when the block cipher operates on n-bit blocks using m-bit keys. The 𝖷𝖧𝖷2 tweakable block cipher is the first construction that achieves beyond-birthday-bound security with respect to the input size of the underlying block cipher in the ideal cipher model.