Cryptology ePrint Archive: Report 2014/373

Beyond 2^{c/2} Security in Sponge-Based Authenticated Encryption Modes

Philipp Jovanovic and Atul Luykx and Bart Mennink

Abstract: The Sponge function is known to achieve 2^{c/2} security, where c is its capacity. This bound was carried over to keyed variants of the function, such as SpongeWrap, to achieve a min{2^{c/2},2^kappa} security bound, with kappa the key length. Similarly, many CAESAR competition submissions are designed to comply with the classical 2^{c/2} security bound. We show that Sponge-based constructions for authenticated encryption can achieve the significantly higher bound of min{2^{b/2},2^c,2^kappa} asymptotically, with b>c the permutation size, by proving that the CAESAR submission NORX achieves this bound. Furthermore, we show how to apply the proof to five other Sponge-based CAESAR submissions: Ascon, CBEAM/STRIBOB, ICEPOLE, Keyak, and two out of the three PRIMATEs. A direct application of the result shows that the parameter choices of these submissions are overly conservative. Simple tweaks render the schemes considerably more efficient without sacrificing security. For instance, NORX64 can increase its rate and decrease its capacity by 128 bits and Ascon-128 can encrypt three times as fast, both without affecting the security level of their underlying modes in the ideal permutation model.

Category / Keywords: secret-key cryptography / Authenticated encryption, CAESAR, Ascon, CBEAM, ICEPOLE, Keyak, NORX, PRIMATEs, STRIBOB

Original Publication (with minor differences): IACR-ASIACRYPT-2014

Date: received 27 May 2014, last revised 10 Sep 2014

Contact author: bart mennink at esat kuleuven be

Available format(s): PDF | BibTeX Citation

Version: 20140910:064552 (All versions of this report)

Short URL: ia.cr/2014/373

Discussion forum: Show discussion | Start new discussion