Related-Key Forgeries for Prøst-OTR

Christoph Dobraunig; Maria Eichlseder; Florian Mendel

Paper 2015/091

Related-Key Forgeries for Prøst-OTR

Christoph Dobraunig

Maria Eichlseder

Florian Mendel

Abstract

We present a forgery attack on Prøst-OTR in a related-key setting. Prøst is a family of authenticated encryption algorithms proposed as candidates in the currently ongoing CAESAR competition, and Prøst-OTR is one of the three variants of the Prøst design. The attack exploits how the Prøst permutation is used in an Even-Mansour construction in the Feistel-based OTR mode of operation. Given the ciphertext and tag for any two messages under two related keys K and K + Delta with related nonces, we can forge the ciphertext and tag for a modified message under K. If we can query ciphertexts for chosen messages under K + Delta, we can achieve almost universal forgery for K. The computational complexity is negligible.

Metadata

Available format(s): PDF
Category: Secret-key cryptography
Publication info: Published by the IACR in TOSC 2015
DOI: 10.1007/978-3-662-48116-5_14
Keywords: CAESAR competition Prøst authenticated encryption cryptanalysis related-key
Contact author(s): maria eichlseder @ iaik tugraz at
History: 2024-06-07: revised; 2015-02-16: received; See all versions
Short URL: https://ia.cr/2015/091
License: CC BY

BibTeX

@misc{cryptoeprint:2015/091,
      author = {Christoph Dobraunig and Maria Eichlseder and Florian Mendel},
      title = {Related-Key Forgeries for Prøst-{OTR}},
      howpublished = {Cryptology {ePrint} Archive, Paper 2015/091},
      year = {2015},
      doi = {10.1007/978-3-662-48116-5_14},
      url = {https://eprint.iacr.org/2015/091}
}