Towards Permutation-Based Constructions Sample Clauses

Towards Permutation-Based Constructions. ‌ The focus in our work is on constructions based on cryptographic permutations. In the black-box model, both the keyed sponge [1, 10, 12, 21, 26, 30, 31] and the keyed duplex [8, 15, 30] have received thorough investigation. The security analyses are different from black-box analyses of block cipher based constructions: whereas for the latter one argues security under the assump- tion that the block cipher is a (strong) pseudorandom permutation, in the former one assumes that the permutation is perfect and considers a distinguisher that is computationally unbounded and whose complexity is only measured by the online complexity (the amount of construction queries) and the offline complex- ity (the amount of primitive queries). − The approach is well-established, and in our analysis of the leakage resilience of the duplex, we adopt the approach. This gives two significant advantages in the analysis. First off, we consider computationally unbounded adversaries, and there is no need to make the HILL-detour. In other words, we can directly argue that an n-bit pseudorandom state S has min-entropy at least n λ after λ bits are leaked. Second, there is no issue with repeated min-entropy degradation: the state is transformed through a perfectly random permutation that outputs a random value (bar repetition) for each new input. We remark that concurrent work [23] also builds upon the random permutation model (and, in addition, an ideal tweakable block cipher). These two advantages clearly simplify the rationale and simplicity of the leakage resilience security analysis of the duplex, yet do not make the security analysis a trivial extension of earlier leakage resilience analyses: in the new set- ting, the amount of entropy of a state is not only dependent on the leakage, but also on the primitive queries that the distinguisher makes, recalling that the distinguisher has direct access to the primitive. Indeed, this is not the case in ordinary wPRF-based security proofs. There is another complication in the analysis of our construction: the dis- tinguisher can re-initialize the state and start over. This is in line with the particular application of the duplex: authenticated encryption, where different authenticated encryptions may start from the same state and even have identical first permutation calls. Even if we had the possibility to argue that the duplex primitive is a weak PRF, repeated or mutually related states would invalidate step (1) of above reasoning, as the q...