Paper 2016/444

The QARMA Block Cipher Family -- Almost MDS Matrices Over Rings With Zero Divisors, Nearly Symmetric Even-Mansour Constructions With Non-Involutory Central Rounds, and Search Heuristics for Low-Latency S-Boxes

Roberto Avanzi

Abstract

This paper introduces QARMA, a new family of lightweight tweakable block ciphers targeted at applications such as memory encryption, the generation of very short tags for hardware-assisted prevention of software exploitation, and the con- struction of keyed hash functions. QARMA is inspired by reflection ciphers such as PRINCE, to which it adds a tweaking input, and MANTIS. However, QARMA differs from previous reflector constructions in that it is a three-round Even-Mansour scheme instead of a FX-construction, and its middle permutation is non-involutory and keyed. We introduce and analyse a family of Almost MDS matrices defined over a ring with zero divisors that allows us to encode rotations in its operation while maintaining the minimal latency associated to {0,1}-matrices. The purpose of all these design choices is to harden the cipher against various classes of attacks. We also describe new S-Box search heuristics aimed at minimising the critical path. QARMA exists in 64- and 128-bit block sizes, where block and tweak size are equal, and keys are twice as long as the blocks. We argue that QARMA provides sufficient security margins within the constraints de- termined by the mentioned applications, while still achieving best-in-class latency. Implementation results on a state-of-the art manufacturing process are reported. We also introduce a technique to extend the length of the tweak by using, for instance, a universal hash function, which, additionally, can be used to strengthen the security of QARMA.

Note: Typos and style.

Metadata
Available format(s)
PDF
Publication info
Published by the IACR in FSE 2017
Keywords
Tweakable Block CiphersReflection CiphersEven-Mansour SchemesAlmost MDS MatricesS-Box Search HeuristicsMemory EncryptionPointer AuthenticationShort HashesTweak MaskingTweak Extension
Contact author(s)
roberto avanzi @ gmail com
History
2017-02-27: last of 10 revisions
2016-05-06: received
See all versions
Short URL
https://ia.cr/2016/444
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2016/444,
      author = {Roberto Avanzi},
      title = {The QARMA Block Cipher Family -- Almost MDS Matrices Over Rings With Zero Divisors, Nearly Symmetric Even-Mansour Constructions With Non-Involutory Central Rounds, and Search Heuristics for Low-Latency S-Boxes},
      howpublished = {Cryptology ePrint Archive, Paper 2016/444},
      year = {2016},
      note = {\url{https://eprint.iacr.org/2016/444}},
      url = {https://eprint.iacr.org/2016/444}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.