No. 208

2018 ISS Square (2019/2/22)

GRL

CI H P A

ENNAuthenticated Encryption (AE) is one of the cipher which can protect the confidentiality, integrity andauthenticity of the data in all communication throughout the Internet. Here we explain on the basic of AE
and the recent developments of AE which includes on the recent AE competition called CAESAR and focus
on the use case 3 – defense in depth. This poster includes the view point on what makes defense in depth
so important for AE. The viewpoints are: Nonce-Misuse Problem, Beyond Birthday Bound (BBB), andQuantum Computation.
Authenticated Encryption
CAESAR Competition
Encryption:
Outsider cannot learn anything about data.
Authentication:
Outsider cannot manipulate data.
With AE, the data are safe from data tampering and eavesdropping.
There are 6 standardized methods for AE (ISO/IEC 19772:2009):
OCB 2.0, Key Wrap, CCM, EAX, Encrypt-then-MAC(EtM), GCM
Authenticated Encryption Scheme:

CAESAR (Competition for Authenticated Encryption: Security,Applicability, and Robustness)
Aim: To find a portfolio which is able to offer the advantages overAES-GCM and suitable for widespread adoption.
Competition

CipherNo. ofCandidates

Remarks

First Round(Submission: 15/3/2014)

ACORN, AEGIS, ASCON, COLM, Deoxys, MORUS, OCB,AES-JAMBU, AES-OTR, AEZ, CLOC, Ketje, Keyak, NORX, SILC, Tiaoxin,
HS1-SIV, ICEPOLE, Joltik, Minalpher, OMD, PAEQ, !-Cipher, POET, PRIMATEs,SCREAM, SHELL, STRIBOB, TriviA-ck,++AE, AES-CMCC, AES-COBRA, AES-CPFB, Artemia, AVALANCHE, Calico, CBA,CBEAM, Enchilada, FASER, HKC, iFeed, Julius, KIASU, LAC, Marble, McMambo,PAES, PANDA, POLAWIS, Prøst, Raviyoyla, Sablier, Silver, Wheesht, YAESACORN, AEGIS, ASCON, COLM, Deoxys, MORUS, OCB,AES-JAMBU, AES-OTR, AEZ, CLOC, Ketje, Keyak, NORX, SILC, Tiaoxin,
HS1-SIV, ICEPOLE, Joltik, Minalpher, OMD, PAEQ, !-Cipher, POET, PRIMATEs,SCREAM, SHELL, STRIBOB, TriviA-ck
ACORN, AEGIS, ASCON, COLM, Deoxys, MORUS, OCB,AES-JAMBU, AES-OTR, AEZ, CLOC, Ketje, Keyak, NORX, SILC, Tiaoxin.

56

9 Candidates
Withdrawn (mark inpurple)

ACORN, AEGIS, ASCON, COLM, Deoxys, MORUS, OCB

7Second Round(Announcement:7/7/2015)
Third Round(Announcement:15/8/2016)

Three Approaches for Authenticated Encryption:

Final Round(Announcement:5/3/2018)

2915**COLM is mergedwith COPA andELmD**CLOC and SILC
is combined.

CAESAR Candidates Hardware Performance:
Algorithm

14.5

AEGIS

70,934

3,460

9.3

ACORN

11,304

508

9.1

ASCON

5,085

1,270

3.2

Deoxys

2,882

3,175

0.91

OCB

3,109

4,254

0.73

COLM

3,109

7,143

0.39

Nonce-Misuse, BBB, Quantum
Computation

Use Case Criteria

FinalistsUse Case 1:
LightweightApplications•

Fits into small hardware are and/or small code for 8-bit CPUs.

ACORN
ASCON

Use Case 2:
High-Performance
Applications•Efficiency on 64-bit CPUs (servers) and/or dedicatedhardware.

AEGIS
MORUS
OCB

Use Case 3:
Defense in Depth•••

Critical: Authenticity despite nonce misuse.
Desirable: Limited privacy damage from nonce misuse.
Desirable: Authenticity despite release of unverified
plaintexts.
Desirable: Limited privacy damage from release of unverified
plaintexts.
Desirable: Robustness in more scenarios; e.g., huge amountsof data.

COLM
Deoxys-II•

Throughput/ Area (Mbps/LUT)

3,397

CAESAR Use Case•

Area (LUTs)

49,556CAESAR Finalists are categorized in three use case:
Use Case

Throughput (Mbps)

MORUS

Nonce-Misuse: Nonce is a value that can only be used
once. If a nonce is repeated, it will cause disastrous result.
The causes of Nonce-Misuse problem:• Birthday Paradox
Lengths of nonce is 32 bits. 2#$ random
nonce is equivalent to 50% same nonce
repeated.
• Bad User Management• Bad Implementations
Beyond Birthday Bound

Quantum ComputationExample of attack against CBC-MAC

Security Proofs of AE

COLM

Deoxys-II• Birthday Bound• % : amount of data adversary obtains• Success probability & (% ( /2 * )*à-bit security(At least 256 bits size of secret key in AE scheme should be used for any
long-term security against quantum adversary.
CipherPost-Quantum
Security Level

Remarks

COLM

64-bitNot suited for long-term
security

Deoxys-II

128-bit

Suitable for long-term
security