Proposal of addition ofnew cipher suites to TLS
to support Camellia,EPOC, and PSEC
Shiho Moriai
shiho@isl.ntt.co.jp

NTT Laboratories
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

128-bit Block Cipher

Camellia

Kazumaro Aoki* Tetsuya Ichikawa†
Masayuki Kanda* Mitsuru Matsui†
Shiho Moriai*
Junko Nakajima†
Toshio Tokita†* NTT† Mitsubishi Electric Corporation
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

What’
What’s Camellia?
128128-bit Block Cipher
 Jointly developed by NTT and Mitsubishi
 Designed by experienced cryptanalysists
and programmers
Supports 128192--, 256128-, 192
256-bit keys
 Same interface as Advanced Encryption
Standard (AES) Offer more security against exhaustive keysearch

2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Design Goals
High level of security
 State-of-the-art cipher analysis technology
Efficiency on multiple platforms
 Software : 8-bit, 32-bit, 64-bit processors
 Hardware : compact and high-performance

2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Software Performance (128(128-bit keys)
On a Pentium III 309 cycles/block (Assembly)= 469Mbps (1.13GHz)
Much faster than DESComparable speed to the AES finalists
RC6Rijndael
TwofishCamellia
Mars
Serpent

229
238
288309312

Encryption speed on
P6 [cycles/block]
759*The programs are written in assembly language by Aoki,Lipmaa, and Osvik. Each figure is the fastest as far as we know.
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Hardware (128(128--bit keys)
ASIC (0.35µ(0.35µm CMOS)
 Small Size Hardware 11KGates• Smallest among existing 128-bit block ciphers High Performance Hardware

MARSRC6
Rijndael
Serpent
TwofishCamellia
DES*

Area

Throughput[Kgates][Mbit/s]

2,936
1,643
613
504
432
273
54226
204
1,950
932
394
1,171
1,161

*DES is a 64-bit
block cipher.

The above data (except Camellia) are presented by Ichikawa et al. at the 3rd AES conference.
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Security Consideration
Camellia provides strong security

against differential and linear
cryptanalysis.

 Moreover, Camellia was designed to offer
security against other advanced
cryptanalytic attacks:• truncated differential attacks,• higher order differential attacks,• interpolation attacks,• related-key attacks, ...
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

For more information
information…
…
Camellia Home Page
http://info.isl.ntt.co.jp/camellia/
 Specification & Sample code Technical papers on design rationale,performance, software implementation
techniques, and security evaluation
 Internet-Draft on description of Camellia
will be available soon!

2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Public Key Algorithms

EPOC and PSEC
Tatsuaki Okamoto
Shigenori Uchiyama
Eiichiro Fujisaki

NTT
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Provable Security of Public KeyAlgorithms
Flaw in RSA with PKCS #1 Ver.1
 Importance of security against adaptively
chosen ciphertext attacks
EPOC & PSEC Developed by Okamoto et al. (NTT) Provably secure under the random oracle
model in the strongest sense (i.e., nonmalleable against adaptively chosenciphertext attacks)
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Public-EPOC (Efficient Probabilistic Public
Key Encryption Scheme)
Novelty
 Essentially different from any otherprevious schemes including RSA-Rabin andDiffie-Hellman
Security
 Provably as secure as factoring in thestrongest senseEfficiency
 Compared with RSA(PKCS#1 Ver.2) withsmall e (216+1), encryption speed is slower,
but decryption speed is faster.
2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

PSEC (Provably Secure EllipticCurve Encryption Scheme)
Security
 Provably as secure as elliptic-curve DiffieHellman problem in the strongest senseEfficiency
 Almost as efficient as most common ECC,elliptic-curve ElGamal (Diffie-Hellman)
scheme2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Toward International Standards
EPOC
 IEEE P1363a (royalty
royalty free if selected)
Camellia
 ISO/IEC JTC 1/SC27
 NESSIE (New European Schemes forSignature, Integrity, and Encryption)

2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Sample Code
Camellia http://info.isl.ntt.co.jp/camellia/
EPOC & PSEC http://www.nttmcl.com/sec/

2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Conclusion
Camellia is a 128128-bit block cipher

with high security and performance suitable for bulk encryption

PSEC and EPOC are publicpublic-key

algorithms with provable security
and efficiency
 suitable for key exchange andauthentication

2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000

Conclusion (Cont.)
Add them to Transport Layer

Security!!

enum { null, rc4, rc2, des, 3des, des0, idea, …,camellia } BulkCipherAlgorithm
enum { rsa, diffie-hellman, epoc, psec }KeyExchangeAlgorithm
enum { anonymous, rsa, dsa, epoc, psec }SignatureAlgorithm

2000.8.1. 48th IETF Meeting TLS

Copyright (C) NTT 2000