# Permutation-Based Lightweight Authenticated Cipher with Beyond Conventional Security

Authors: Ping Zhang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Lightweight authenticated ciphers are specially designed as authenticated encryption (AE) schemes for resource-constrained devices. Permutation-based lightweight authenticated ciphers have gained more attention in recent years. However, almost all of permutation-based lightweight AE schemes only ensure conventional security, i.e., aboutc/2-bit security, where c is the capacity of the permutation. This may be vulnerable for an insufficiently large capacity. This paper focuses on the stronger security guarantee and the better efficiency optimization of permutation-based lightweight AE schemes. On the basis of APE series (APE, APERI, APEOW, and APECA), we propose a new improved permutation-based lightweight online AE mode APE+ which supports beyond conventional security and concurrent absorption. Then, we derive a simple security proof and prove that APE+ enjoys at most about minr,c-bit security, where r is the rate of the permutation. Finally, we discuss the properties of APE+ on the hardware implementation.


---

## Body

## 1. Introduction

With the widespread rise of the big data, Internet of Things (IoT), and fifth generation (5G) and beyond 5G (B5G) networks, leaks of sensitive data from wireless sensor devices and network platforms have become more serious and more common. The collection of sensitive data has become one of the important targets of cyberattacks by hackers. How can we protect the security of our sensitive data? Cryptography is an important method to protect the security of sensitive data.Lightweight cryptography focuses on the symmetric-key cryptography, whose goal is to settle the data security of resource-constrained devices in the embedded systems, sensor networks, RFID, and low-cost environments. The feature of the lightweight cryptography is that the implementation costs of hardware devices (such as areas, footprints, latency, and throughput) are as low as possible and the implementation efficiency (rate) is as high as possible, without sacrificing security guarantee.The research of the lightweight cryptography began in 2004 and has been going on for more than a decade. The lightweight cryptography mainly includes the lightweight cipher and its modes of operation. Lightweight ciphers are designed to protect the privacy (confidentiality) of sensitive data on lightweight devices. Up to now, a large number of lightweight ciphers have been proposed, analyzed, and implemented [1–9]. Lightweight authenticated encryption (AE) modes of operation, also called lightweight authenticated ciphers, achieve both the privacy protection of sensitive data and the integrity verification of all data on lightweight devices. Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR) held in 2013 greatly contributed to the vigorous development of lightweight AE modes and produced many excellent schemes, such as Ascon [10] and ACORN [10]. From the perspective of the design method, lightweight AE modes include block-cipher-based lightweight AE modes [11–14], stream-cipher-based lightweight AE modes [15, 16], permutation-based lightweight AE modes [17–20], and hash-based lightweight AE modes [19, 20]. Moreover, permutation-based lightweight AE modes have more advantages and attractions than others due to its simple structure, convenient lookup table, and fast running speed.Authenticated permutation-based encryption (APE) is the first permutation-based lightweight AE mode with nonce-misuse resistance designed by Andreeva et al. [17]. The idea is inspired from Sponge. The encryption algorithm of APE is online (i.e., the i-th block of ciphertext only depends on the first i blocks of plaintext), while the decryption algorithm is inverse-online (i.e., the online decryption of the ciphertext blocks is in reverse order). APE is proven up to the conventional security under the random permutation model (RPM), i.e., APE guarantees at most about c/2-bit security, where c is the capacity of the permutation.However, there exist several drawbacks for APE, such as relatively big bandwidth, large hardware footprint, and high computational complexity. To overcome these drawbacks of APE, Sasaki and Yasuda focused on the implementation costs and the proper using of a nonce on resource-constrained devices [18]. On the basis of APE, they described three new online permutation-based lightweight AE modes, called APERI, APEOW, and APECA, to meet the requirements of less bandwidths, smaller hardware footprints, and lower computational complexity. They proved that these three lightweight AE schemes also enjoy the conventional security.Almost all of the previous permutation-based lightweight AE schemes, including APE,APERI, APEOW, and APECA, only ensure at most about c/2-bit security. To ensure enough security, one tends to choose a permutation with a big capacity c. Table 1 shows security levels of some permutation-based AE modes using recommended parameters.Table 1
Security levels of permutation-based AE modes using recommended parametersb,r,c, where b is the permutation size, r is the rate of the permutation, c is the capacity of the permutation, and b=r+c.
SchemebrcSecurityAscon [10]3201281929632064256128APE [17]2569616080APERI [18]2569616080APEOW [18]2569616080APECA [18]2569616080Bettle [20]144648064256128128121APE+2569616096256256128128128Ascon includes two versions with four configurations (three with 128-bit security and one with 96-bit security). In this table, we just list two of them.However, in some special environments, such as an insufficiently large capacity of the permutation or the partial information leakage of permutation by side channel attacks, this security bound is not enough. Moreover, the associated data and the message were handled separately in APE,APERI, APEOW, and APECA, which is not highly efficient. Whether can we construct an efficient lightweight AE mode with beyond c/2-bit security?This paper is devoted to solving the above problem and gives a positive response. On the basis of the current APE,APERI, APEOW, and APECA, we propose a novel improved permutation-based lightweight online AE mode APE+. APE+ supports strong security guarantee and high efficiency implementation. The concrete contributions include the following:(1)
In order to achieve higher efficiency, we consider to put some good factors intoAPE+, such as inverse-free, stream-cipher encryption, concurrent absorption, and pure permutation. APE+ is inverse-free, i.e., the decryption algorithm of APE+ does not invoke the inverse of permutation. Besides, it is a stream-cipher encryption mode. For the associated data and the message, APE+ utilizes the method of concurrent absorption to process them, which makes the number of invoking the underlying permutation as few as possible. In particular, in view of the performance of APE+ on the hardware implementation, APE+ is built by the cascade method and has no backward feedback. Therefore, it can be fully pipeline implemented on the hardware. Moreover, APE+ just requires the forward permutation circuit for the encryption and decryption circuits. Therefore, the area of the hardware device and the number of the hardware footprints are minimized. APE+ utilizes the concurrent absorption method, which greatly reduces the computational complexity on the hardware devices.(2)
In order to achieve stronger security, the encryption and authentication parts are considered separately. For the encryption part, we utilize the iterated Even–Mansour cipher with a short key [21] to generate the ciphertext while avoiding the defeat that the current plaintext is XOR-ed with the previous ciphertext. For the authentication part, the authentication tag is generated by the XOR of the rate and the capacity of the last permutation to resist forgery attacks. In this paper, we derive a simple security proof by using a modular proof approach and prove that APE+ enjoys at most about minr,c-bit AE security under the RPM assumption, where r and c are, respectively, the rate and the capacity of the permutation. Specifically, given a permutation with parameters b=256,r=96, and c=160 (or b=256,r=128, and c=128), APE+ enjoys at most about 96-bit (or 128-bit) AE security, which is shown in Table 1.The rest of this paper is organized as follows. Notations and some preliminaries are presented in Section2. Section 3 describes the security model of lightweight AE schemes. Section 4 provides a new permutation-based lightweight AE mode with beyond conventional security and derives a security proof. Section 5 shows some discussions for APE+. Finally, Section 6 ends up with a conclusion.


## 2. Preliminaries

Notations. Let 0,1∗ denote the set containing all finite bit strings (including the empty string). Let b be an integer and 0,1b be the set of all strings whose lengths are b bits. For a finite string x, x stands for its bit-length. For two finite strings x and y, let x‖y or xy denote their concatenation and let x⊕y denote their bitwise XOR operation from the least bit to the most bit. If X is a set, let x←$X stand for that x is uniformly sampled from the finite set X. If a is a decimal, let ⌈a⌉ be the smallest integer greater than or equal to a. Let PrA|B be the conditional probability that event A occurs, giving event B.Strong Pseudorandom Permutation (SPRP). One of the most important security concepts in symmetric ciphers is SPRP. What is SPRP? In a nutshell, if a symmetric cipher is indistinguishable from an ideal random permutation under chosen ciphertext attacks, then this symmetric cipher is an SPRP. The detailed definition is shown as follows.LetE:K×0,1b⟶0,1b be a symmetric cipher, where K is a nonempty key set. Then, for any K∈K, EK· is a permutation on b bits and EK−1· is the inverse of EK·. Let Permb be the set of all permutations on b bits. Let P be a primitive utilized in E. Let A be an adversary with access to encryption, decryption, and the primitive and its inverse oracles, i.e., EK±,P±. Let AO⇒1 be the event that an adversary A outputs 1 after interacting with the oracle O.LetK←$K,π←$Permb, then the SPRP advantage of A against E is defined as(1)AdvEsprpA=PrAEK±,P±⇒1−PrAπ±,P±⇒1=ΔEK±,P±;π±,P±.If the advantageAdvEsprpA is negligible, the cipher EK is a secure strong pseudorandom permutation (SPRP).If the resources (such as the overall running timet, the number of querying the encryption and decryption oracles q, the total query complexity of the construction σ, and the number of querying the primitive and its inverse oracles p) used by adversaries are limited, we define the maximum advantage as(2)AdvEsprpt,q,σ,p=maxAAdvEsprpA.Even–Mansour Cipher with a Short Key [21]. Let P be a public random b-bit permutation, c be the capacity of P, r be the rate of P, and b=r+c. Let K=0,1k be a k-bit key set. To minimize the key material of the Even–Mansour cipher and achieve beyond conventional security bound, the Even–Mansour cipher with a short key is presented. The Even–Mansour cipher with a short key is a function E:K×0,1b⟶0,1b that inputs a key K∈K and a plaintext x∈0,1b and produces a ciphertext y=EKx=EK,x=Px⊕0r‖K⊕0r‖K, where k≤c.


## 3. Security Model

Syntax of Authenticated Encryption (AE). Let K, N, ℋ, ℳ, C, and T be, respectively, the sets of the keys, nonce, associated data, plaintexts, ciphertexts, and authentication tags. A nonce-based AE with associated data scheme Π=E,D consists of an encryption algorithm E:K×N×ℋ×ℳ⟶C×T and a decryption algorithm D: K×N×ℋ×C×T⟶ℳ∪⊥, where the symbol ⊥ indicates the failure of the decryption oracle. Let K∈K be a key, N∈N be a nonce, A∈ℋ be an associated data, M∈ℳ be a plaintext, C∈C be a ciphertext, and T∈T be an authentication tag, then the syntax is formalized as follows:(3)C,T←EKN,A,M,M⊥←DKN,A,C,T,where EKN,A,M=C,T if and only if DKN,A,C,T=M. A secure AE scheme returns ⊥ if it receives an error N,A,C,T pair.The nonce-based AE with associated data schemeΠ=E,D is called as an online AE scheme (or authenticated online cipher) if and only if the j-th ciphertext block Cj only depends on the first j plaintext blocks M1,…,Mj, where j=1,…,m=⌈M/r⌉. That is to say, for any fixed key K, nonce N, and associated data A, if two plaintexts M and M′ share an l-block common prefix, where 0≤l≤m−1, then their encrypted ciphertexts C and C′ also share an l-block common prefix. Therefore, a secure authenticated online cipher requires that ciphertexts do not reveal any further information about plaintexts than its length and the longest common prefix with previous plaintexts.Ideal Online Function and Ideal Authenticated Online Cipher. Let fj be a function randomly chosen from N×ℋ×0,1j−1r×0,1s⟶0,1s, where 1≤j≤m=⌈M/r⌉ and 1≤s≤r. We define an ideal online function g:N×ℋ×ℳ⟶C as follows:(4)C=gN,A,M=j=1mfjN,A,M1⋯Mj−1,Mj,Cj=fjN,A,M1⋯Mj−1,Mj,C=C1⋯Cm.Lett be a tag-generation function randomly chosen from N×ℋ×ℳ⟶T, and we define an ideal authenticated online cipher $:N×ℋ×ℳ⟶C×T as follows:(5)C,T=$N,A,M,where C=gN,A,M and T=tN,A,M.AE Security Model. The security model of AE schemes includes the conventional security model (privacy and authenticity) [11, 17] and all-in-one AE security model [18, 22–24]. In fact, all-in-one AE security model covers the conventional privacy and authenticity security models. Therefore, we consider all-in-one AE security model. Let Π=E,D be an AE scheme. The all-in-one AE security model is defined as follows.Definition 1.
(AE security [24]). Let P be a public random permutation, K be a key, and ΠP be a P-based AE scheme. Let q,σ,p>0. Then, the AE security advantage of the adversary is(6)AdvΠPaeq,σ,p=PrAEK,DK,P±=1−PrA$,⊥,P±=1=ΔEK,DK,P±;$,⊥,P±,where q is the number of querying the encryption oracle E or the decryption oracle D, generating at most σ blocks, p is the number of querying the permutation P or its inverse P−1, $ is an ideal authenticated online cipher, and ⊥ stands for the failure of the decryption oracles.


## 4. APE+: Authenticated Permutation-Based Encryption Scheme with Beyond Conventional Security for Lightweight Applications

In this section, we provide a new pure permutation-based lightweight online AE modeAPE+ which enjoys beyond conventional security. Section 4.1 describes the specification of APE+. Section 4.2 derives the security proofs of APE+.


### 4.1.APE+: Pure Permutation-Based Lightweight Authenticated Online Cipher

LetP be a public b-bit random permutation and b=r+c. Let K∈K be a key with k-bit, N∈N be a nonce, and A∈ℋ be an associated data. Let M=M1‖M2⋯Mm∈ℳ be a plaintext, C=C1‖C2⋯Cm∈C be the corresponding ciphertext, and T∈T be the corresponding authentication tag, where m=⌈M/r⌉ is the block length of the plaintext. Let τ be the bit-length of the tag and τ=k=c.To design a lightweight online AE mode with beyond conventional security, we utilize the iterated Even–Mansour cipher with a short key [21] to generate the ciphertext for the encryption part and invoke the Even–Mansour cipher with a short key [21] to generate the authentication tag for the authentication part. Moreover, to prevent forgery attacks, the rate of the last permutation is XOR-ed to the capacity of the last permutation with the short key to realize the authentication tag with a random mask. To make the number of invoking the underlying permutation as few as possible, we utilize the concurrent absorption method [25] to process the associated data and the message. The overview of APE+ is shown in Figure 1.Figure 1
APE+: permutation-based lightweight AE mode with beyond conventional security and concurrent absorption for a-block associated data and m-block plaintext (upper: a≤m; lower: a>m).APE+ consists of an encryption algorithm E and a decryption algorithm D. The encryption algorithm E takes as input a key K, a nonce N, an associated data A, and a plaintext M and returns a ciphertext C and a tag T. The decryption algorithm D takes K, N, A, C, and T as inputs and returns either M or ⊥. The encryption and decryption algorithms are depicted in Algorithms 1 and 2.Algorithm 1: Encryption algorithm: EKN,A,M.
Input: a key K, a nonce N, an associated data A, and a plaintext MOutput: a ciphertext C and a tag T(1)
PartitionM into M1⋯Mm, M=r,1≤i≤m(2)
PartitionA intoA1⋯Aa, |Aj|=c,1≤j≤a(3)
C0=N,V0=K(4)
ifa≤mthen(5)
for0≤i≤a−1do(6)
Ki+1,Wi+1=PCi,Vi(7)
Ci+1=Ki+1⊕Mi+1(8)
Vi+1=Wi+1⊕Ai+1(9)
end for(10)
fora≤i≤m−1do(11)
Ki+1,Wi+1=PCi,Vi(12)
Ci+1=Ki+1⊕Mi+1(13)
Vi+1=Wi+1(14)
end for(15)
Km+1,Wm+1=PCm,Vm⊕1(16)
T=Wm+1⊕K⊕Km+1(17)
else(18)
for0≤i≤m−1do(19)
Ki+1,Wi+1=PCi,Vi(20)
Ci+1=Ki+1⊕Mi+1(21)
Vi+1=Wi+1⊕Ai+1(22)
end for(23)
form≤i≤a−1do(24)
Ki+1,Wi+1PCi,Vi(25)
Ci+1=Ki+1(26)
Vi+1=Wi+1⊕Ai+1(27)
end for(28)
Ka+1,Wa+1=PCa,Va⊕1(29)
T=Wa+1⊕K⊕Ka+1(30)
end if(31)
returnC=C1‖C2⋯Cm−1‖Cm,TAlgorithm 2: Decryption algorithm: DKN,A,C,T.
Input: a key K, a nonce N, an associated data A, a ciphertext C, and a tag TOutput: a plaintext M or ⊥(1)
PartitionC into C1⋯Cm, Ci=r,1≤i≤m(2)
PartitionA into A1⋯Aa, Aj=c,1≤j≤a(3)
C0=N,V0=K(4)
ifa≤mthen(5)
for0≤i≤a−1do(6)
Ki+1,Wi+1=PCi,Vi(7)
Mi+1=Ki+1⊕Ci+1(8)
Vi+1=Wi+1⊕Ai+1(9)
end for(10)
fora≤i≤m−1do(11)
Ki+1,Wi+1=PCi,Vi(12)
Mi+1=Ki+1⊕Ci+1(13)
Vi+1=Wi+1(14)
end for(15)
Km+1,Wm+1=PCm,Vm⊕1(16)
T′=Wm+1⊕K⊕Km+1(17)
else(18)
for0≤i≤m−1do(19)
Ki+1,Wi+1=PCi,Vi(20)
Mi+1=Ki+1⊕Ci+1(21)
Vi+1=Wi+1⊕Ai+1(22)
end for(23)
form≤i≤a−1do(24)
Ki+1,Wi+1=PCi,Vi(25)
Ci+1=Ki+1(26)
Vi+1=Wi+1⊕Ai+1(27)
end for(28)
Ka+1,Wa+1=PCa,Va⊕1(29)
T′=Wa+1⊕K⊕Ka+1(30)
end if(31)
ifT′=Tthen(32)
returnM=M1M2⋯Mm−1Mm(33)
else(34)
return⊥ (INVALID)(35)
end if


### 4.2. Beyond Conventional Security ofAPE+

APE,APERI, APEOW, and APECA only ensure at most about 2c/2 adversarial queries (i.e., c/2-bit security). APE+ is a pure permutation-based lightweight AE scheme with beyond conventional security. Besides, APE+ is also an authenticated online cipher. In this section, we prove that APE+ enjoys at most about minr,c-bit AE security. Let ΠP=E,D stand for our APE+ scheme with a permutation P.Theorem 1.
LetP←$Permbbe a publicb-bit random permutation andb=r+c. Then,(7)AdvΠPaeq,σ,p≤epσ2b+1.5σ+q22b+2σ2r+q2c,wheree=2.71828182845…is the base of the natural logarithm.Proof.
We utilize the modular proof approach. First, our scheme can be described as a scheme based on an Even–Mansour cipher with a short keyEK, i.e., ΠP can be represented as ΠEK, where K is the secret key. Then, we replace the Even–Mansour modular structure of our scheme by the random permutation Q and rename the new scheme as ΠQ. There exists a nontrivial gap for this replacement. According to the definition of the AE security, we have(8)AdvΠPaeq,σ,p=ΔEK,DK,P;$,⊥,P=ΔEEK,DEK,P;$,⊥,P≤ΔEEK,DEK,P;EQ,DQ,P+ΔEQ,DQ,P;$,⊥,P≤AdvEsprpq,σ,p+AdvΠQaeq,σ,p.
It follows that we need to calculate the upper bounds ofAdvEsprpq,σ,p and AdvΠQaeq,σ,p. First, according to the advantage of the Even–Mansour cipher with a short key [21], we have(9)AdvEsprpq,σ,p=ΔEEK,DEK,P;EQ,DQ,P≤μp2c,where μ is the maximal multiplicity. Now, we consider the rationality of μ. The probability that the multiplicity exceeds μ is upper bounded by σμ1/2rμ−1, which is very close to zero. By Stirling’s approximation, this probability is also bounded by 2reσ/μ2rμ, where e=2.71828182845…. Assume that eσ/μ2r=epσ/2r+c1/2 and 16epσ/2r+c≪1, and we have μ=eσ·2c/p·2r1/2. It follows that(10)AdvEsprpq,σ,p≤epσ2b1/2.
Then, we need to compute the following advantage:(11)AdvΠQaeq,σ,p=ΔEQ,DQ,P;$,⊥,P.
Now, we replace the random permutationQ by the random function f and rename the new scheme as Πf. According the hybrid argument and the RP/RF switch lemma, we have(12)AdvΠQaeq,σ,p=ΔEQ,DQ,P;$,⊥,P≤ΔEQ,DQ,P;Ef,Df,P+ΔEf,Df,P;$,⊥,P≤σ+q22b+1+ΔEf,Df,P;$,⊥,P.
Next, we need to evaluateΔEf,Df,P;$,⊥,P. According to the definitions of privacy and authenticity [17], we have(13)ΔΕf,Df,P;$,⊥,P≤ΔΕf,Df,P;Εf,⊥,P+ΔΕf,⊥,P;$,⊥,P=ΔΕf,Df,P;Εf,⊥,P+ΔΕf,P;$,P=AdvΠfauthq,σ,p+AdvΠfprivq,σ,p,where(14)AdvΠfauthq,σ,p=ΔEf,Df,P;Ef,⊥,P,AdvΠfprivq,σ,p=ΔEf,P;$,P.
In the first step, we calculate the PRIV advantageAdvΠfprivq,σ,p. Assume that the adversary queries N1,A1,M1,…,Nq,Aq,Mq to the encryption oracle Ef and gains the corresponding responses C1,T1,…,Cq,Tq. Here, the adversary is deterministic and adaptive, i.e., each query of the adversary Nw+1,Aw+1,Mw+1 is completely determined by the previous query-response pairs N1,A1,M1,C1,T1,…,Nw,Aw,Mw,Cw,Tw, where 1≤w≤q−1 and N1,A1,M1,…,Nq,Aq,Mq are distinct.
Let us define some symbols for thei-th encryption query-response pair Ni,Ai,Mi,Ci,Ti, where 1≤i≤q. Let ai=⌈Ai/c⌉ and mi=⌈Mi/r⌉ be, respectively, the block lengths of the associated data Ai and the plaintext Mi. Then, Ai=A1i‖A2i⋯Aaii and Mi=M1i‖M2i⋯Mmii. Here, we assume that the block length of the associated data is always less than or equal to the block length of the plaintext. Let I0i=Ni,0,I1i=C1i,V1i,…,Iaii=Caii,Vaii,…,Imii=Cmii,Vmii⊕1 and O1i=K1i,W1i,…,Oaii=Kaii,Waii,Oai+1i=Kai+1i,Vai+1i,…,Omii=Kmii,Vmii,Omi+1i=Kmi+1i,Ti⊕Kmi+1i be the inputs and outputs of the random function f, where Csi=Ksi⊕Msi for 1≤s≤mi and Vti=Wti⊕Ati for 1≤t≤ai.
We define an eventColl that stands for a collision between the inputs of the random function f. For an authenticated online cipher, we consider that any two distinct queries Ni,Ai,Mi≠Nj,Aj,Mj share a common prefix, where 1≤i≠j≤q. The adversary is nonce-misuse; therefore, Ni=Nj=N is a common prefix. We consider the following cases:Case 1: ifAi=Aj=A is fully common, then Mi≠Mj. Assume that Mi and Mj have an α-longest common prefix, i.e., M1i⋯Mαi=M1j⋯Mαj and Mα+1i≠Mα+1j, where α≥0 (α=0 means M1i≠M1j). Therefore, I0i⋯Iαi=I0j⋯Iαj and Iα+1i≠Iα+1j. The event Coll occurs if one of the following collisions happens:(1)
Iα+1i=Itj for t≠α+1, where 1≤i≠j≤q.(2)
Isi=Itj for α+2≤s≤mi,1≤t≤mj, where 1≤i≠j≤q.(3)
Isi=Iti for 1≤s≠t≤mi, where 1≤i≤q.(4)
Isi=I0i=I0j=Ni,0 for 1≤s≤mi, where 1≤i≠j≤q.Letl be the maximum block length of the plaintext, i.e., mi≤landmj≤l, and let σ=ql. Therefore, after removing the duplicate conditions, the probability that the event Coll occurs is(15)PrColl=∑1≤i≠j≤q∑t≠α+112b+∑1≤i≠j≤q∑α+2≤s≤mi∑1≤t≤mj12b+∑i=1q∑1≤s≠t≤mi12b+∑i=1q∑s=1mi12r≤∑1≤i≠j≤ql−1+ll−22b+∑i=1qll−1/22b+∑i=1q∑s=1l12rAsIs−1i=∗,Ti≤q+σ22b+1+σ2r.Case 2: ifAi≠Aj but Ai and Aj have an α-longest common prefix, then A1i⋯Aαi=A1j⋯Aαj and Aα+1i≠Aα+1j, where α≥0. We assume that Mi and Mj have a β-longest common prefix, where β≥0. Then, M1i⋯Mβi=M1j⋯Mβj and Mβ+1i≠Mβ+1j.Case 2.1: ifβ≥α, then Aα+1i,Mα+1i≠Aα+1j,Mα+1j. Therefore, I0i⋯Iαi=I0j⋯Iαj and Iα+1i≠Iα+1j. The probability that the event Coll occurs is the same with Case 1.Case 2.2: ifβ<α, then Aβ+1i,Mβ+1i≠Aβ+1j,Mβ+1j. Therefore, I0i⋯Iβi=I0j⋯Iβj and Iβ+1i≠Iβ+1j. The event Coll occurs if one of the following collisions happens:(1)
Iβ+1i=Itj for t≠β+1, where 1≤i≠j≤q.(2)
Isi=Itj for β+2≤s≤miand1≤t≤mj, where 1≤i≠j≤q.(3)
Isi=Iti for 1≤s≠t≤mi, where 1≤i≤q.(4)
Isi=I0i=I0j=Ni,0 for 1≤s≤mi, where 1≤i≠j≤q.
It follows that, in Case 2.2, the probability that the eventColl occurs is(16)PrColl=∑1≤i≠j≤q∑t≠β+112b+∑1≤i≠j≤q∑β+2≤s≤mi∑1≤t≤mj12b+∑i=1q∑1≤s≠t≤mi12b+∑i=1q∑s=1mi12r≤∑1≤i≠j≤ql−1+ll−22b+∑i=1qll−1/22b+∑i=1q∑s=1l12rAsIs−1i=∗,Ti≤q+σ22b+1+σ2r.
Summarizing the above mutually exclusive cases, the probability that the eventColl occurs is(17)PrColl≤q+σ22b+1+σ2r.
If the eventColl does not occur, all inputs of f are fresh, except that the inputs from the common prefix are equal. Therefore, Ef is indistinguishable from $. In the nonce-misuse setting, we have(18)AdvΠfprivq,σ,p≤PrColl≤q+σ22b+1+σ2r.
In the second step, we evaluate the AUTH advantageAdvΠfauthq,σ,p. Assume that the adversary makes qd nontrivial forgery attempts N′1,A′1,C′1,T′1,…,N′qd,A′qd,C′qd,T′qd to the decryption oracle Df after querying qe encryption oracles, where N′1,A′′1,C′1,T′1,…,N′qd,A′qd,C′qd,T′qd∉N1,A1,C1,T1,…,Nqe,Aqe,Cqe,Tqe and q=qe+qd. Here, we define an event Forge that some decryption queries among qd forgery attempts do not return ⊥. If the event Forge does not occur, the responses of querying Ef,Df and $,⊥ are identical. Therefore, by the total probability formula, we have(19)AdvΠfauthq,σ,p≤PrForge=PrForge|CollPrColl+PrForge|¬CollPr¬Coll≤PrColl+PrForge|¬Coll.
The probability that the eventColl happens is similar to the PRIV advantage except that we need to consider an extra query complexity—the decryption query complexity under the forgery attempts, i.e., PrColl≤q+σ2/2b+1+σ/2r, where σ is the total query complexity of the encryption and decryption queries.
To compute the probabilityPrForge|¬Coll, we consider the following cases:Case 1:T′i is new, i.e., T′i∉T1,…,Tqe, where 1≤i≤qd. For each forgery attempt, the probability of correctly guessing the image of a new point for the adversary is at most 1/2c−qe.Case 2:T′i is old, but N′i,A′i,C′i is new. We further analyze this case as follows.Case 2.1:N′i is new, i.e., N′i∉N1,…,Nqe. The image of this new point under a new random function is uniform, random, and independent. Therefore, the probability for correctly guessing the tag T′i is at most 1/2c.Case 2.2:N′i is old, but A′i,C′i is new. Under the condition of the event ¬Coll, the input of the last random function f is new. The outputs of f with distinct inputs are random and independent. Therefore, the probability for correctly guessing the same tag is at most 1/2c.
Summarizing the above two cases, the successful probability ofqd forgery attempts is upper bounded by qd/2c−qe.
Therefore, according the sugar water inequalitya/b≤a+m/b+m, where b>a>0 and m≥0, and q=qe+qd, we have(20)AdvΠfauthq,σ,p≤PrForge≤PrColl+PrForge|¬Coll≤q+σ22b+1+σ2r+q2c.
Therefore, combining (1)–(6), we can obtain the result of Theorem 1.
According to Theorem1, the AE security of APE+ is up to 2minb/2,r,c=2minr,c adversarial queries against nonce-misusing adversaries. In other words, APE+ ensures at most about minr,c-bit AE security, which is a beyond conventional (c/2-bit) security.


## 4.1.APE+: Pure Permutation-Based Lightweight Authenticated Online Cipher

LetP be a public b-bit random permutation and b=r+c. Let K∈K be a key with k-bit, N∈N be a nonce, and A∈ℋ be an associated data. Let M=M1‖M2⋯Mm∈ℳ be a plaintext, C=C1‖C2⋯Cm∈C be the corresponding ciphertext, and T∈T be the corresponding authentication tag, where m=⌈M/r⌉ is the block length of the plaintext. Let τ be the bit-length of the tag and τ=k=c.To design a lightweight online AE mode with beyond conventional security, we utilize the iterated Even–Mansour cipher with a short key [21] to generate the ciphertext for the encryption part and invoke the Even–Mansour cipher with a short key [21] to generate the authentication tag for the authentication part. Moreover, to prevent forgery attacks, the rate of the last permutation is XOR-ed to the capacity of the last permutation with the short key to realize the authentication tag with a random mask. To make the number of invoking the underlying permutation as few as possible, we utilize the concurrent absorption method [25] to process the associated data and the message. The overview of APE+ is shown in Figure 1.Figure 1
APE+: permutation-based lightweight AE mode with beyond conventional security and concurrent absorption for a-block associated data and m-block plaintext (upper: a≤m; lower: a>m).APE+ consists of an encryption algorithm E and a decryption algorithm D. The encryption algorithm E takes as input a key K, a nonce N, an associated data A, and a plaintext M and returns a ciphertext C and a tag T. The decryption algorithm D takes K, N, A, C, and T as inputs and returns either M or ⊥. The encryption and decryption algorithms are depicted in Algorithms 1 and 2.Algorithm 1: Encryption algorithm: EKN,A,M.
Input: a key K, a nonce N, an associated data A, and a plaintext MOutput: a ciphertext C and a tag T(1)
PartitionM into M1⋯Mm, M=r,1≤i≤m(2)
PartitionA intoA1⋯Aa, |Aj|=c,1≤j≤a(3)
C0=N,V0=K(4)
ifa≤mthen(5)
for0≤i≤a−1do(6)
Ki+1,Wi+1=PCi,Vi(7)
Ci+1=Ki+1⊕Mi+1(8)
Vi+1=Wi+1⊕Ai+1(9)
end for(10)
fora≤i≤m−1do(11)
Ki+1,Wi+1=PCi,Vi(12)
Ci+1=Ki+1⊕Mi+1(13)
Vi+1=Wi+1(14)
end for(15)
Km+1,Wm+1=PCm,Vm⊕1(16)
T=Wm+1⊕K⊕Km+1(17)
else(18)
for0≤i≤m−1do(19)
Ki+1,Wi+1=PCi,Vi(20)
Ci+1=Ki+1⊕Mi+1(21)
Vi+1=Wi+1⊕Ai+1(22)
end for(23)
form≤i≤a−1do(24)
Ki+1,Wi+1PCi,Vi(25)
Ci+1=Ki+1(26)
Vi+1=Wi+1⊕Ai+1(27)
end for(28)
Ka+1,Wa+1=PCa,Va⊕1(29)
T=Wa+1⊕K⊕Ka+1(30)
end if(31)
returnC=C1‖C2⋯Cm−1‖Cm,TAlgorithm 2: Decryption algorithm: DKN,A,C,T.
Input: a key K, a nonce N, an associated data A, a ciphertext C, and a tag TOutput: a plaintext M or ⊥(1)
PartitionC into C1⋯Cm, Ci=r,1≤i≤m(2)
PartitionA into A1⋯Aa, Aj=c,1≤j≤a(3)
C0=N,V0=K(4)
ifa≤mthen(5)
for0≤i≤a−1do(6)
Ki+1,Wi+1=PCi,Vi(7)
Mi+1=Ki+1⊕Ci+1(8)
Vi+1=Wi+1⊕Ai+1(9)
end for(10)
fora≤i≤m−1do(11)
Ki+1,Wi+1=PCi,Vi(12)
Mi+1=Ki+1⊕Ci+1(13)
Vi+1=Wi+1(14)
end for(15)
Km+1,Wm+1=PCm,Vm⊕1(16)
T′=Wm+1⊕K⊕Km+1(17)
else(18)
for0≤i≤m−1do(19)
Ki+1,Wi+1=PCi,Vi(20)
Mi+1=Ki+1⊕Ci+1(21)
Vi+1=Wi+1⊕Ai+1(22)
end for(23)
form≤i≤a−1do(24)
Ki+1,Wi+1=PCi,Vi(25)
Ci+1=Ki+1(26)
Vi+1=Wi+1⊕Ai+1(27)
end for(28)
Ka+1,Wa+1=PCa,Va⊕1(29)
T′=Wa+1⊕K⊕Ka+1(30)
end if(31)
ifT′=Tthen(32)
returnM=M1M2⋯Mm−1Mm(33)
else(34)
return⊥ (INVALID)(35)
end if


## 4.2. Beyond Conventional Security ofAPE+

APE,APERI, APEOW, and APECA only ensure at most about 2c/2 adversarial queries (i.e., c/2-bit security). APE+ is a pure permutation-based lightweight AE scheme with beyond conventional security. Besides, APE+ is also an authenticated online cipher. In this section, we prove that APE+ enjoys at most about minr,c-bit AE security. Let ΠP=E,D stand for our APE+ scheme with a permutation P.Theorem 1.
LetP←$Permbbe a publicb-bit random permutation andb=r+c. Then,(7)AdvΠPaeq,σ,p≤epσ2b+1.5σ+q22b+2σ2r+q2c,wheree=2.71828182845…is the base of the natural logarithm.Proof.
We utilize the modular proof approach. First, our scheme can be described as a scheme based on an Even–Mansour cipher with a short keyEK, i.e., ΠP can be represented as ΠEK, where K is the secret key. Then, we replace the Even–Mansour modular structure of our scheme by the random permutation Q and rename the new scheme as ΠQ. There exists a nontrivial gap for this replacement. According to the definition of the AE security, we have(8)AdvΠPaeq,σ,p=ΔEK,DK,P;$,⊥,P=ΔEEK,DEK,P;$,⊥,P≤ΔEEK,DEK,P;EQ,DQ,P+ΔEQ,DQ,P;$,⊥,P≤AdvEsprpq,σ,p+AdvΠQaeq,σ,p.
It follows that we need to calculate the upper bounds ofAdvEsprpq,σ,p and AdvΠQaeq,σ,p. First, according to the advantage of the Even–Mansour cipher with a short key [21], we have(9)AdvEsprpq,σ,p=ΔEEK,DEK,P;EQ,DQ,P≤μp2c,where μ is the maximal multiplicity. Now, we consider the rationality of μ. The probability that the multiplicity exceeds μ is upper bounded by σμ1/2rμ−1, which is very close to zero. By Stirling’s approximation, this probability is also bounded by 2reσ/μ2rμ, where e=2.71828182845…. Assume that eσ/μ2r=epσ/2r+c1/2 and 16epσ/2r+c≪1, and we have μ=eσ·2c/p·2r1/2. It follows that(10)AdvEsprpq,σ,p≤epσ2b1/2.
Then, we need to compute the following advantage:(11)AdvΠQaeq,σ,p=ΔEQ,DQ,P;$,⊥,P.
Now, we replace the random permutationQ by the random function f and rename the new scheme as Πf. According the hybrid argument and the RP/RF switch lemma, we have(12)AdvΠQaeq,σ,p=ΔEQ,DQ,P;$,⊥,P≤ΔEQ,DQ,P;Ef,Df,P+ΔEf,Df,P;$,⊥,P≤σ+q22b+1+ΔEf,Df,P;$,⊥,P.
Next, we need to evaluateΔEf,Df,P;$,⊥,P. According to the definitions of privacy and authenticity [17], we have(13)ΔΕf,Df,P;$,⊥,P≤ΔΕf,Df,P;Εf,⊥,P+ΔΕf,⊥,P;$,⊥,P=ΔΕf,Df,P;Εf,⊥,P+ΔΕf,P;$,P=AdvΠfauthq,σ,p+AdvΠfprivq,σ,p,where(14)AdvΠfauthq,σ,p=ΔEf,Df,P;Ef,⊥,P,AdvΠfprivq,σ,p=ΔEf,P;$,P.
In the first step, we calculate the PRIV advantageAdvΠfprivq,σ,p. Assume that the adversary queries N1,A1,M1,…,Nq,Aq,Mq to the encryption oracle Ef and gains the corresponding responses C1,T1,…,Cq,Tq. Here, the adversary is deterministic and adaptive, i.e., each query of the adversary Nw+1,Aw+1,Mw+1 is completely determined by the previous query-response pairs N1,A1,M1,C1,T1,…,Nw,Aw,Mw,Cw,Tw, where 1≤w≤q−1 and N1,A1,M1,…,Nq,Aq,Mq are distinct.
Let us define some symbols for thei-th encryption query-response pair Ni,Ai,Mi,Ci,Ti, where 1≤i≤q. Let ai=⌈Ai/c⌉ and mi=⌈Mi/r⌉ be, respectively, the block lengths of the associated data Ai and the plaintext Mi. Then, Ai=A1i‖A2i⋯Aaii and Mi=M1i‖M2i⋯Mmii. Here, we assume that the block length of the associated data is always less than or equal to the block length of the plaintext. Let I0i=Ni,0,I1i=C1i,V1i,…,Iaii=Caii,Vaii,…,Imii=Cmii,Vmii⊕1 and O1i=K1i,W1i,…,Oaii=Kaii,Waii,Oai+1i=Kai+1i,Vai+1i,…,Omii=Kmii,Vmii,Omi+1i=Kmi+1i,Ti⊕Kmi+1i be the inputs and outputs of the random function f, where Csi=Ksi⊕Msi for 1≤s≤mi and Vti=Wti⊕Ati for 1≤t≤ai.
We define an eventColl that stands for a collision between the inputs of the random function f. For an authenticated online cipher, we consider that any two distinct queries Ni,Ai,Mi≠Nj,Aj,Mj share a common prefix, where 1≤i≠j≤q. The adversary is nonce-misuse; therefore, Ni=Nj=N is a common prefix. We consider the following cases:Case 1: ifAi=Aj=A is fully common, then Mi≠Mj. Assume that Mi and Mj have an α-longest common prefix, i.e., M1i⋯Mαi=M1j⋯Mαj and Mα+1i≠Mα+1j, where α≥0 (α=0 means M1i≠M1j). Therefore, I0i⋯Iαi=I0j⋯Iαj and Iα+1i≠Iα+1j. The event Coll occurs if one of the following collisions happens:(1)
Iα+1i=Itj for t≠α+1, where 1≤i≠j≤q.(2)
Isi=Itj for α+2≤s≤mi,1≤t≤mj, where 1≤i≠j≤q.(3)
Isi=Iti for 1≤s≠t≤mi, where 1≤i≤q.(4)
Isi=I0i=I0j=Ni,0 for 1≤s≤mi, where 1≤i≠j≤q.Letl be the maximum block length of the plaintext, i.e., mi≤landmj≤l, and let σ=ql. Therefore, after removing the duplicate conditions, the probability that the event Coll occurs is(15)PrColl=∑1≤i≠j≤q∑t≠α+112b+∑1≤i≠j≤q∑α+2≤s≤mi∑1≤t≤mj12b+∑i=1q∑1≤s≠t≤mi12b+∑i=1q∑s=1mi12r≤∑1≤i≠j≤ql−1+ll−22b+∑i=1qll−1/22b+∑i=1q∑s=1l12rAsIs−1i=∗,Ti≤q+σ22b+1+σ2r.Case 2: ifAi≠Aj but Ai and Aj have an α-longest common prefix, then A1i⋯Aαi=A1j⋯Aαj and Aα+1i≠Aα+1j, where α≥0. We assume that Mi and Mj have a β-longest common prefix, where β≥0. Then, M1i⋯Mβi=M1j⋯Mβj and Mβ+1i≠Mβ+1j.Case 2.1: ifβ≥α, then Aα+1i,Mα+1i≠Aα+1j,Mα+1j. Therefore, I0i⋯Iαi=I0j⋯Iαj and Iα+1i≠Iα+1j. The probability that the event Coll occurs is the same with Case 1.Case 2.2: ifβ<α, then Aβ+1i,Mβ+1i≠Aβ+1j,Mβ+1j. Therefore, I0i⋯Iβi=I0j⋯Iβj and Iβ+1i≠Iβ+1j. The event Coll occurs if one of the following collisions happens:(1)
Iβ+1i=Itj for t≠β+1, where 1≤i≠j≤q.(2)
Isi=Itj for β+2≤s≤miand1≤t≤mj, where 1≤i≠j≤q.(3)
Isi=Iti for 1≤s≠t≤mi, where 1≤i≤q.(4)
Isi=I0i=I0j=Ni,0 for 1≤s≤mi, where 1≤i≠j≤q.
It follows that, in Case 2.2, the probability that the eventColl occurs is(16)PrColl=∑1≤i≠j≤q∑t≠β+112b+∑1≤i≠j≤q∑β+2≤s≤mi∑1≤t≤mj12b+∑i=1q∑1≤s≠t≤mi12b+∑i=1q∑s=1mi12r≤∑1≤i≠j≤ql−1+ll−22b+∑i=1qll−1/22b+∑i=1q∑s=1l12rAsIs−1i=∗,Ti≤q+σ22b+1+σ2r.
Summarizing the above mutually exclusive cases, the probability that the eventColl occurs is(17)PrColl≤q+σ22b+1+σ2r.
If the eventColl does not occur, all inputs of f are fresh, except that the inputs from the common prefix are equal. Therefore, Ef is indistinguishable from $. In the nonce-misuse setting, we have(18)AdvΠfprivq,σ,p≤PrColl≤q+σ22b+1+σ2r.
In the second step, we evaluate the AUTH advantageAdvΠfauthq,σ,p. Assume that the adversary makes qd nontrivial forgery attempts N′1,A′1,C′1,T′1,…,N′qd,A′qd,C′qd,T′qd to the decryption oracle Df after querying qe encryption oracles, where N′1,A′′1,C′1,T′1,…,N′qd,A′qd,C′qd,T′qd∉N1,A1,C1,T1,…,Nqe,Aqe,Cqe,Tqe and q=qe+qd. Here, we define an event Forge that some decryption queries among qd forgery attempts do not return ⊥. If the event Forge does not occur, the responses of querying Ef,Df and $,⊥ are identical. Therefore, by the total probability formula, we have(19)AdvΠfauthq,σ,p≤PrForge=PrForge|CollPrColl+PrForge|¬CollPr¬Coll≤PrColl+PrForge|¬Coll.
The probability that the eventColl happens is similar to the PRIV advantage except that we need to consider an extra query complexity—the decryption query complexity under the forgery attempts, i.e., PrColl≤q+σ2/2b+1+σ/2r, where σ is the total query complexity of the encryption and decryption queries.
To compute the probabilityPrForge|¬Coll, we consider the following cases:Case 1:T′i is new, i.e., T′i∉T1,…,Tqe, where 1≤i≤qd. For each forgery attempt, the probability of correctly guessing the image of a new point for the adversary is at most 1/2c−qe.Case 2:T′i is old, but N′i,A′i,C′i is new. We further analyze this case as follows.Case 2.1:N′i is new, i.e., N′i∉N1,…,Nqe. The image of this new point under a new random function is uniform, random, and independent. Therefore, the probability for correctly guessing the tag T′i is at most 1/2c.Case 2.2:N′i is old, but A′i,C′i is new. Under the condition of the event ¬Coll, the input of the last random function f is new. The outputs of f with distinct inputs are random and independent. Therefore, the probability for correctly guessing the same tag is at most 1/2c.
Summarizing the above two cases, the successful probability ofqd forgery attempts is upper bounded by qd/2c−qe.
Therefore, according the sugar water inequalitya/b≤a+m/b+m, where b>a>0 and m≥0, and q=qe+qd, we have(20)AdvΠfauthq,σ,p≤PrForge≤PrColl+PrForge|¬Coll≤q+σ22b+1+σ2r+q2c.
Therefore, combining (1)–(6), we can obtain the result of Theorem 1.
According to Theorem1, the AE security of APE+ is up to 2minb/2,r,c=2minr,c adversarial queries against nonce-misusing adversaries. In other words, APE+ ensures at most about minr,c-bit AE security, which is a beyond conventional (c/2-bit) security.


## 5. Discussions

The original intention of designing ourAPE+ scheme is to achieve higher efficiency, better performance, and stronger security on the lightweight devices. APE+ is an improved version of APE series (including APE, APERI, APEOW, and APECA). Therefore, APE+ inherits most of the advantages of APE series. Besides, it has the following advantages in the hardware implementation:(1)
APE+ is a pure permutation-based lightweight online AE mode with concurrent absorption. The rate of processing the associated data and the message is faster on hardware devices.(2)
APE+ is inverse-free, i.e., its decryption circuit does not invoke the inverse of permutation. Moreover, it is a stream-cipher encryption mode.(3)
APE+ is built by the cascade method and has no backward feedback. Therefore, it can be fully pipeline implemented.(4)
To the best of our knowledge,APE+ is the first AE mode which supports beyond conventional security against blockwise adaptive adversaries in the lightweight devices.(5)
APE series andAPE+ are designed and have proven security against nonce-misusing adversaries up to common prefix. Jovanovic et al. showed an attack on APE with a complexity of about 2c/2 in the nonce-respecting setting (here, “nonce-respecting” means that the nonce is never repeated in the encryption queries) according to the defect Mi⊕Ci−1 [26]. If there exists k such that Mk⊕Ck−1=M1=0, the adversary breaks the privacy with a complexity of about 2c/2 in the nonce-respecting setting. In fact, this attack also works for APE series. This defect exists in APERI, APEOW, and APECA, while it does not exist in APE+. Therefore, APE+ is robust against this kind of attack.Table2 shows the comparison of permutation-based lightweight AE modes. From the perspective of hardware implementation costs, APE+ just needs the permutation circuit on hardware devices as its encryption and decryption algorithms only call the permutation P. Therefore, the area of the hardware device and the number of hardware footprints are minimized. From the perspective of the efficiency, the bandwidth of implementing is N|+A+M+c. Moreover, the computational costs of the encryption and decryption algorithms are 1+max⌈A/r⌉,⌈M/r⌉ as we utilize the method of concurrent absorption to process the associated data and the message. Therefore, the computational complexity is obviously reduced. From the perspective of the security, APE+ enjoys at most about minr,c-bit AE security, which is a great contribution of this paper. Fixing a permutation with recommended parameters b=256,r=96, and c=160, APE series ensure at most about 80-bit security while APE+ enjoys at most about 96-bit security. Security levels of permutation-based AE modes using recommended parameters are shown in Table 1.Table 2
Comparison of permutation-based AE modes. LetX=A+M,n=⌈N/r⌉,a=⌈A/c⌉,m=⌈M/r⌉, and m′=⌈M−c/2/r⌉.
SchemeAPEAPERIAPEOWAPECABettleAPE+BandwidthN+X+cN+X+cX+bN+X+c/2N+X+bN+X+cEncryptionPPPPPPDecryptionP,P−1P−1P−1P−1PPEncryption costn+a+mn+a+mn+a+mn+a+m′1+a+m1+maxa,mDecryption costn+a+mn+a+mn+a+mn+a+m′1+a+m1+maxa,mSecurityc/2c/2minr,c/2c/2minb/2,c−logr,rminr,cNonce-misuseYesYesYesYesNoYesReference[17][18][18][18][20]This paperThis paper just focuses on the single-key security ofAPE+. Recently, the multikey or multiuser security and related-key security are also very hot research topics of lightweight ciphers. The implementation of APE+ on the hardware circuit and the security under the multikey or multiuser and related-key settings are our next important works.


## 6. Conclusions

Most of the devices widely used in smart home and Internet of Things are resource constrained. The privacy security and authenticity security of data from these devices are crucial in the process of data transmission. The lightweight AE modes designed by permutations have more advantages and attractions for the protection of data security due to its simple structure, convenient lookup table, and fast running speed. However, almost all of permutation-based lightweight AE modes enjoy conventional security. In this paper, we discuss the problem of whether can we design an efficient lightweight AE mode to achieve beyond conventional security bound for permutation-based lightweight ciphers. We propose a new permutation-based lightweight AE modeAPE+ with beyond conventional security, derive its security proof, and discuss the properties of APE+. APE+ has proven AE security up to about 2minr,c adversarial queries and it is robust, where r and c are, respectively, the rate and the capacity of the permutation. APE+ is an improved version of APE series and inherits most of the advantages of APE series. It is well suited for the protection of the data security in some special environments, such as an insufficiently large capacity of the permutation or the partial information leakage of permutation by side channel attacks.



---

*Source: 1468007-2021-10-27.xml*