A vast body of work studies how to build a pseudorandom function (PRF) from a pseudorandom permutation (PRP) with beyond-the-birthday-bound (BBB) security. Often, such constructions are also expected to offer some security in keyless settings, for example in the context of committing security or to substitute a parallelizable short-input random oracle (RO) if used in counter mode. This has spurred several works on keyless variants of PRP-to-PRF constructions. However, recent works (Gunsing et al., CRYPTO 2022, 2023) reveal flaws in almost all existing proofs, painting a grim picture. This paper clarifies the situation with an in-depth analysis of RP-based short-input RF constructions. First, we categorize all two-call short-input/output RP-to-RF constructions and evaluate their indifferentiability level. We introduce the “chaining attack”, a powerful, widely applicable differentiability attack. When applied to the sum of a permutation and its inverse, it invalidates an earlier result (Dodis et al., EUROCRYPT 2008). On the positive side, we show that only the Sum Of Permutations and Encrypted Davies-Meyer Dual, when instantiated with independent permutations, achieve BBB security and could potentially yield a parallelizable short-input RO. Second, we study the indifferentiability of expanding RP-to-RF constructions and show that _w , the core PRF underlying CENC, achieves BBB security. As side effects, we obtain a simplified proof of indifferentiability for Sum of Permutations, and the committing security of CENC.

The sponge construction underpins many modern symmetric primitives,enabling efficient hashing and authenticated encryption. While full-state absorptionis known to be secure in keyed sponges, the security of full-state squeezing hasremained unclear. Recently, Lefevre and Marhuenda-Beltr & aacute;n introducedMacaKey,which applies ideas from the summation-truncation hybrid technique of constructingPRFs to the full-state sponge. The authors claimed thatMacaKeyis provably secureup to the birthday bound in capacity, even when the adversary is allowed to requestvariable-length outputs. In this work, we revisit this claim and show thatMacaKeyis insecure as a PRF. We demonstrate a simple four-query distinguishing attackthat violates its claimed bound, exploiting the exposure of the full internal stateand the resulting loss of secrecy in the capacity portion during squeezing. We thenpropose a simple modification that restores security with negligible overhead. Themodified construction,KeyMacaKey, re-randomizes the internal state after absorptionby incorporating a keyed finalization step without requiring an extra permutation call.Further, we show thatKeyMacaKeyachieves the stronger security of birthday-boundin the full state size than what was claimed forMacaKey.

Since Kuwakado and Morii’s work (ISIT 2010 ISITA 2012), it is known that the classically secure 3-round Luby-Rackoff PRP and Even-Mansour cipher become insecure against an adversary equipped with quantum query access. However, while this query model (the so-called Q2 model) has led to many more attacks, it seems that restricting the adversary to classical query access prevents such breaks (the so-called Q1 model). Indeed, at EUROCRYPT 2022, Alagic et al. proved the Q1-security of the Even-Mansour cipher. Notably, such a proof needs to take into account the dichotomy between construction queries, which are classical, and primitive queries, which are quantum (since the random oracle/permutation models a public function that the adversary can compute). In this paper, we focus on Feistel ciphers. More precisely, we consider Key-Alternating Feistels built from random functions or permutations. We borrow the tools used by Alagic et al. and adapt them to this setting, showing that in the Q1 setting: ∙ the 3-round Key-Alternating Feistel, even when the round functions are the same random oracle, is a pseudo-random permutation; ∙ similarly the 4-round KAF is a strong pseudo-random permutation.

At EUROCRYPT’20, Bao et al. have shown that three-round cascading of LRW1 construction, which they dubbed as TNT, is a strong tweakable pseudorandom permutation that provably achieves 2n/3-bit security bound. Jha et al. showed a birthday bound distinguishing attack on TNT and invalidated the proven security bound and proved a tight birthday bound security on the TNT construction in EUROCRYPT’24. In a recent work, Datta et al. have shown that four round cascading of the LRW1 construction, which they dubbed as ^4 is a strong tweakable pseudorandom permutation that provably achieves 3n/4-bit security. In this paper, we propose a variant of the TNT construction, called b-TNT1, and proved its security up to 2^3n/4 queries. However, unlike ^4 , b-TNT1 requires three block cipher calls along with a field multiplication. Besides, we also propose another variant of the TNT construction, called b-TNT2 and showed a similar security bound. Compared to b-TNT1, b-TNT2 requires four block cipher calls. Nevertheless, its execution of block cipher calls can be pipelined which makes it efficient over ^4 . We have also experimentally verified that both b-TNT1 and b-TNT2 outperform ^4 .

This paper studies the security of key derivation functions (KDFs), a central class of cryptographic algorithms used to derive multiple independent-looking keys (each associated with a particular context) from a single secret. The main security requirement is that these keys are pseudorandom (i.e., the KDF is a pseudorandom function). This paper initiates the study of an additional security property, called key control (KC) security, first informally put forward in a recent update to NIST Special Publication (SP) 800-108 standard for KDFs. Informally speaking, KC security demands that, given a known key, it is hard for an adversary to find a context that forces the KDF-derived key for that context to have a property that is specified a-priori and is hard to satisfy (e.g., that the derived key consists mostly of 0s, or that it is a weak key for a cryptographic algorithm using it). We provide a rigorous security definition for KC security, and then move on to the analysis of the KDF constructions specified in NIST SP 800-108. We show, via security proofs in the random oracle model, that the proposed constructions based on XOFs or hash functions can accommodate for reasonable security margins (i.e., 128-bit security) when instantiated from KMAC and HMAC. We also show, via attacks, that all proposed block-cipher based modes of operation (while implementing mitigation techniques to prevent KC security attacks affecting earlier version of the standard) only achieve at best 72-bit KC security for 128-bit blocks, as with AES.

In this work, we examine online authenticated encryption with variable expansion. We follow a notion where both encryption and decryption are online, and security is ensured in the RUP (Release of Unverified Plaintext) setting. Then we propose a generic way of obtaining an online authenticated encryption mode from a tweakable online encryption mode based on the encode-then-encipher paradigm (Bellare and Rogaway, Asiacrypt 2000). To instantiate our generic scheme, we start with proposing a provably-secure tweakable online encryption mode called - , a tweakable version of (Bhaumik and Nandi, ToSC 2016(2)), and then plug it into our generic scheme to obtain , a provably-secure online authenticated encryption mode. As an application, we propose a primitive we call a bidirectional online channel suited for communication between lightweight devices.

This paper studies the security of key derivation functions (KDFs), a central class of cryptographic algorithms used to derive multiple independent-looking keys (each associated with a particular context) from a single secret. The main security requirement is that these keys are pseudorandom (i.e., the KDF is a pseudorandom function). This paper initiates the study of an additional security property, called key control (KC) security, first informally put forward in a recent update to NIST Special Publication (SP) 800-108 standard for KDFs. Informally speaking, KC security demands that, given a known key, it is hard for an adversary to find a context that forces the KDF-derived key for that context to have a property that is specified a-priori and is hard to satisfy (e.g., that the derived key consists mostly of 0s, or that it is a weak key for a cryptographic algorithm using it). We provide a rigorous security definition for KC security, and then move on to the analysis of the KDF constructions specified in NIST SP 800-108. We show, via security proofs in the random oracle model, that the proposed constructions based on XOFs or hash functions can accommodate for reasonable security margins (i.e., 128-bit security) when instantiated from KMAC and HMAC. We also show, via attacks, that all proposed block-cipher based modes of operation (while implementing mitigation techniques to prevent KC security attacks affecting earlier version of the standard) only achieve at best 72-bit KC security for 128-bit blocks, as with AES.

In this work, we revisit the Hosoyamada-Iwata (HI) proof for the quantum CPA security of the 4-round Luby-Rackoff construction and identify a gap that appears to undermine the security proof. We emphasize that this is not an attack, and the construction may still achieve the claimed security level. However, this gap raises concerns about the feasibility of establishing a formal security proof for the 4-round Luby-Rackoff construction. In fact, the issue persists even if the number of rounds is increased arbitrarily. On a positive note, we restore the security of the 4-round Luby-Rackoff construction in the non-adaptive setting, achieving security up to 2(n/6) superposition queries. Furthermore, we establish the quantum CPA security of the 4-round MistyR and 5-round MistyL constructions, up to 2(n/5) and 2(n/7) superposition queries, respectively, where n denotes the size of the underlying permutation.

In this work, we revisit the Hosoyamada-Iwata (HI) proof for the quantum CPA security of the 4-round Luby-Rackoff construction and identify a gap that appears to undermine the security proof. We emphasize that this is not an attack, and the construction may still achieve the claimed security level. However, this gap raises concerns about the feasibility of establishing a formal security proof for the 4-round Luby-Rackoff construction. In fact, the issue persists even if the number of rounds is increased arbitrarily. On a positive note, we restore the security of the 4-round Luby-Rackoff construction in the non-adaptive setting, achieving security up to 2^n/6 superposition queries. Furthermore, we establish the quantum CPA security of the 4-round and 5-round constructions, up to 2^n/5 and 2^n/7 superposition queries, respectively, where n denotes the size of the underlying permutation.

Substitution-Permutation Networks (SPNs) are a popular and powerful technique for designing block ciphers. Confusion-Diffusion Networks (CDNs), as formalised by Dodis et al. at Eurocrypt'16, treat unkeyed SPNs as a means of extending the domain of public permutations. Dodis et al. showed that 5-round CDNs are indifferentiable from an ideal permutation, and subsequent works by Da et al. at Indocrypt'21 and Nandi et al. at C2SI'23 have established that 2-round CDNs cannot achieve the weaker notion of sequential indifferentiability even with non-linear diffusion layers. In this paper we show for the first time that 3-round CDNs with linear diffusion layers can achieve indifferentiability from an ideal permutation.

Message Authentication Codes (MACs) are ubiquitous primitives deployed in multiple flavors through standards such as HMAC, CMAC, GMAC, LightMAC, and many others Its versatility makes it an essential building block in applications necessitating message authentication and integrity checks, in authentication protocols, authenticated encryption schemes, or as a pseudorandom or key derivation function. Its usage in this variety of settings makes it susceptible to a broad range of attack scenarios. The latest attack trends leverage a lack of commitment or context-discovery security in AEAD schemes and these attacks are mainly due to the weakness in the underlying MAC part. However, these new attack models have been scarcely analyzed for MACs themselves. This paper provides a thorough treatment of MACs committing and context-discovery security. We reveal that commitment and context-discovery security of MACs have their own interest by highlighting real-world vulnerable scenarios. We formalize the required security notions for MACs, and analyze the security of standardized MACs for these notions. Additionally, as a constructive application, we analyze generic AEAD composition and provide simple and efficient ways to build committing and context-discovery secure AEADs.

Both multi-user PRFs and sponge-based constructions have generated a lot of research interest lately. Dedicated analyses for multi-user security have improved the bounds a long distance from the early generic bounds obtained through hybrid arguments, yet the bounds generally don’t allow the number of users to be more than birthday-bound in key-size. Similarly, known sponge constructions suffer from being only birthday-bound secure in terms of their capacity. We present in this paper , a multi-user PRF built from a random permutation using a full-state sponge with feed-forward, which uses a combination of the user keys and unique user IDs to solve both the problems mentioned by improving the security bounds for multi-user constructions and sponge constructions. For D construction query blocks and T permutation queries, with key-size κ = n/2 and tag-size τ = n/2 (where n is the state-size or the size of the underlying permutation), both D and T must touch birthday bound in n in order to distinguish from a random function.

In this paper, we study the security of the Key-Alternating Feistel (KAF) ciphers, a class of key alternating ciphers with the Feistel structure, where each round of the cipher is instantiated with n -bit public round permutation P_i , namely the i -th round of the cipher maps (X_L, X_R) ↦ (X_R, P_i(X_R ⊕ K_i) ⊕ K_i ⊕ X_L). We have shown that our 5 round construction with independent round permutations and independent round keys achieves 2 n /3-bit security in the random permutation model, i.e., the setting where the adversary is allowed to make forward and inverse queries to the round permutations in a black box way.

In this paper we characterize all 2n-bit-to-n-bit Pseudorandom Functions (PRFs) constructed with the minimum number of calls to n-bit-to-n-bit PRFs and arbitrary number of linear functions. First, we show that all two-round constructions are either classically insecure, or vulnerable to quantum period-finding attacks. Second, we categorize three-round constructions depending on their vulnerability to these types of attacks. This allows us to identify classes of constructions that could be proven secure. We then proceed to show the security of the following three candidates against any quantum distinguisher that makes at most 2^n/4 (possibly superposition) queries: (x_1,x_2) := f_3(x_2 ⊕ f_2(x_2 ⊕ f_1(x_1))); (x_1,x_2) := f_2(x_2) ⊕ f_3(x_2 ⊕ f_1(x_1)); (x_1,x_2) := f_3( f_1(x_1) ⊕ f_2(x_2)). Note that the first construction is a classically secure tweakable block-cipher due to Bao et al., and the third construction was shown to be a quantum-secure tweakable block-cipher by Hosoyamada and Iwata with similar query limits. Of note is our proof framework, an adaptation of Chung et al.’s rigorous formulation of Zhandry’s compressed oracle technique in the indistinguishability setup, which could be of independent interest. This framework gives very compact and mostly classical-looking proofs as compared to Hosoyamada-Iwata interpretation of Zhandry’s compressed oracle.

A nonce-respecting tweakable blockcipher is the building-block for the OCB authenticated encryption mode. An XEX-based TBC is used to process each block in OCB. However, XEX can provide at most birthday bound privacy security, whereas in Asiacrypt 2017, beyond-birthday-bound (BBB) forging security of OCB3 was shown in [14]. In this paper we study how at a small cost we can construct a nonce-respecting BBB-secure tweakable blockcipher. We propose the construction, which maintains a cache that can be easily updated when used in an OCB-like mode. We show how this can be used in a BBB-secure variant of OCB with some additional keys and a few extra blockcipher calls but roughly the same amortised rate.

Four observations can be made regarding recent trends that have emerged in the evolution of authenticated encryption schemes: (1) regarding simplicity, the adoption of public permutations as primitives has allowed for sparing a key schedule and the need for storing round keys; (2) using the sums of permutation outputs, inputs, or outputs and inputs has been a well-studied means to achieve higher security beyond the birthday bound; (3) concerning robustness, schemes can provide graceful security degradation if a limited amount of nonces repeats during the lifetime of a key; and (4) Andreeva et al.’s ForkCipher approach can increase the efficiency of a scheme since they can use fewer rounds per output branch compared to full-round primitives. In this work, we improve the state of the art by combining those aspects for efficient authenticated encryption. We propose PAE, an efficient nonce-based AE scheme that employs a public permutation and one call to an XOR-universal hash function. PAE provides O (2 n /3)-bit security and high throughput by combining forked public-permutation-based variants of and Encrypted Davies-Meyer. Thus, it can use a single, in part round-reduced, public permutation for most operations, spare a key schedule, and guarantee security beyond the birthday bound even under limited nonce reuse.