Please use this identifier to cite or link to this item:
Title: ZOCB and ZOTR : tweakable blockcipher modes for authenticated encryption with full absorption
Authors: Bao, Zhenzhen
Guo, Jian
Iwata, Tetsu
Minematsu, Kazuhiko
Keywords: Science::Mathematics
Issue Date: 2019
Source: Bao, Z., Guo, J., Iwata, T., & Minematsu, K. (2019). ZOCB and ZOTR : tweakable blockcipher modes for authenticated encryption with full absorption. IACR Transactions on Symmetric Cryptology, 2019(2), 1-54. doi:10.13154/tosc.v2019.i2.1-54
Journal: IACR Transactions on Symmetric Cryptology
Abstract: We define ZOCB and ZOTR for nonce-based authenticated encryption with associated data, and analyze their provable security. These schemes use a tweakable blockcipher (TBC) as the underlying primitive, and fully utilize its input to process a plaintext and associated data (AD). This property is commonly referred to as full absorption, and this has been explored for schemes based on a permutation or a pseudorandom function (PRF). Our schemes improve the efficiency of TBC-based counterparts of OCB and OTR called OCB3 (Krovetz and Rogaway, FSE 2011) and OTR (Minematsu, EUROCRYPT 2014). Specifically, ΘCB3 and OTR have an independent part to process AD, and our schemes integrate this process into the encryption part of a plaintext by using the tweak input of the TBC. Up to a certain length of AD, ZOCB and ZOTR completely eliminate the independent process for it. Even for longer AD, our schemes process it efficiently by fully using the tweak input of the TBC. For this purpose, based on previous tweak extension schemes for TBCs, we introduce a scheme called XTX*. To our knowledge, ZOCB and ZOTR are the first efficiency improvement of ΘCB3 and OTR in terms of the number of TBC calls. Compared to Sponge-based and PRF-based schemes, ZOCB and ZOTR allow fully parallel computation of the underlying primitive, and have a unique design feature that an authentication tag is independent of a part of AD. We present experimental results illustrating the practical efficiency gain and clarifying the efficiency cost for it with a concrete instantiation. The results show that for long input data, our schemes have gains, while we have efficiency loss for short input data.
ISSN: 2519-173X
DOI: 10.13154/tosc.v2019.i2.1-54
Rights: © 2019 Zhenzhen Bao, Jian Guo, Tetsu Iwata, Kazuhiko Minematsu. This work is licensed under a Creative Commons Attribution 4.0 International License.
Fulltext Permission: open
Fulltext Availability: With Fulltext
Appears in Collections:SPMS Journal Articles


Updated on Sep 3, 2020


Updated on Nov 29, 2020

Page view(s)

Updated on Dec 1, 2020


Updated on Dec 1, 2020

Google ScholarTM




Items in DR-NTU are protected by copyright, with all rights reserved, unless otherwise indicated.