Cryptology ePrint Archive: Report 2012/497

The low-call diet: Authenticated Encryption for call counting HSM users

Mike Bond and George French and Nigel P. Smart and Gaven J. Watson

Abstract: We present a new mode of operation for obtaining authenticated encryption suited for use in banking and government environments where cryptographic services are only available via a Hardware Security Module (HSM) which protects the keys but offers a limited API. The practical problem is that despite the existence of better modes of operation, modern HSMs still provide nothing but a basic (unauthenticated) CBC mode of encryption, and since they mediate all access to the key, solutions must work around this. Our mode of operation makes only a single call to the HSM, yet provides a secure authenticated encryption scheme; authentication is obtained by manipulation of the plaintext being passed to the HSM via a call to an unkeyed hash function. The scheme offers a considerable performance improvement compared to more traditional authenticated encryption techniques which must be implemented using multiple calls to the HSM. Our new mode of operation is provided with a proof of security, on the assumption that the underlying block cipher used in the CBC mode is a strong pseudorandom permutation, and that the hash function is modelled as a random oracle.

Category / Keywords: secret-key cryptography /

Original Publication (in the same form): CT-RSA 2013
DOI: 10.1007/978-3-642-36095-4_23

Date: received 29 Aug 2012, last revised 12 Aug 2013

Contact author: nigel at cs bris ac uk,Mike Bond@cryptomathic com,george french@barclays com,gavenjwatson@gmail com