Paper 2022/817

Overloading the Nonce: Rugged PRPs, Nonce-Set AEAD, and Order-Resilient Channels

Jean Paul Degabriele, Technology Innovation Institute, TU Darmstadt
Vukašin Karadžić, TU Darmstadt

We introduce a new security notion that lies right in between pseudorandom permutations (PRPs) and strong pseudorandom permutations (SPRPs). We call this new security notion and any (tweakable) cipher that satisfies it a $\textit{rugged pseudorandom permutation}$ (RPRP). Rugged pseudorandom permutations lend themselves to some interesting applications, have practical benefits, and lead to novel cryptographic constructions. Our focus is on variable-length tweakable RPRPs, and analogous to the encode-then-encipher paradigm of Bellare and Rogaway, we can generically transform any such cipher into different AEAD schemes with varying security properties. However, the benefit of RPRPs is that they can be constructed more efficiently as they are weaker primitives than SPRPs (the notion traditionally required by the encode-then-encipher paradigm). We can construct RPRPs using only two layers of processing, whereas SPRPs typically require three layers of processing over the input data. We also identify a new transformation that yields RUP-secure AEAD schemes with more compact ciphertexts than previously known. Further extending this approach, we arrive at a new generalized notion of authenticated encryption and a matching construction, which we refer to as $\textit{nonce-set AEAD}$. Nonce-set AEAD is particularly well-suited in the context of secure channels, like QUIC and DTLS, that operate over unreliable transports and employ a window mechanism at the receiver's end of the channel. We conclude by presenting a generic construction for transforming a nonce-set AEAD scheme into an order-resilient secure channel. Our channel construction sheds new light on order-resilient channels and additionally leads to more compact ciphertexts when instantiated from RPRPs.

Note: Full version of the original paper published in CRYPTO 2022

Available format(s)
Secret-key cryptography
Publication info
A minor revision of an IACR publication in CRYPTO 2022
Tweakable CiphersRugged Pseudorandom PermutationsAEADSecure Channels
Contact author(s)
jeanpaul degabriele @ tii ae
vukasin karadzic @ tu-darmstadt de
2023-07-05: revised
2022-06-22: received
See all versions
Short URL
Creative Commons Attribution


      author = {Jean Paul Degabriele and Vukašin Karadžić},
      title = {Overloading the Nonce: Rugged {PRPs}, Nonce-Set {AEAD}, and Order-Resilient Channels},
      howpublished = {Cryptology ePrint Archive, Paper 2022/817},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.