Cryptology ePrint Archive: Report 2016/444

The QARMA Block Cipher Family -- Almost MDS Matrices Over Rings With Zero Divisors, Nearly Symmetric Even-Mansour Constructions With Non-Involutory Central Rounds, and Search Heuristics for Low-Latency S-Boxes

Roberto Avanzi

Abstract: This paper introduces QARMA, a new family of lightweight tweakable block ciphers targeted at applications such as memory encryption, the generation of very short tags for hardware-assisted prevention of software exploitation, and the con- struction of keyed hash functions.

QARMA is inspired by reflection ciphers such as PRINCE, to which it adds a tweaking input, and MANTIS. However, QARMA differs from previous reflector constructions in that it is a three-round Even-Mansour scheme instead of a FX-construction, and its middle permutation is non-involutory and keyed. We introduce and analyse a family of Almost MDS matrices defined over a ring with zero divisors that allows us to encode rotations in its operation while maintaining the minimal latency associated to {0,1}-matrices. The purpose of all these design choices is to harden the cipher against various classes of attacks.

We also describe new S-Box search heuristics aimed at minimising the critical path.

QARMA exists in 64- and 128-bit block sizes, where block and tweak size are equal, and keys are twice as long as the blocks.

We argue that QARMA provides sufficient security margins within the constraints de- termined by the mentioned applications, while still achieving best-in-class latency. Implementation results on a state-of-the art manufacturing process are reported.

We also introduce a technique to extend the length of the tweak by using, for instance, a universal hash function, which, additionally, can be used to strengthen the security of QARMA.

Category / Keywords: Tweakable Block Ciphers, Reflection Ciphers, Even-Mansour Schemes, Almost MDS Matrices, S-Box Search Heuristics, Memory Encryption, Pointer Authentication, Short Hashes, Tweak Masking, Tweak Extension

Original Publication (in the same form): IACR-FSE-2017

Date: received 4 May 2016, last revised 27 Feb 2017

Contact author: roberto avanzi at gmail com

Available format(s): PDF | BibTeX Citation

Note: Typos and style.

Version: 20170227:135829 (All versions of this report)

Short URL: ia.cr/2016/444

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]