Revisiting variable output length XOR pseudorandom function

Article Type

Research Article

Publication Title

IACR Transactions on Symmetric Cryptology

Abstract

Let σ be some positive integer and (formula presented). The theory behind finding a lower bound on the number of distinct blocks P 1 , …, P σ ∈ {0, 1} n satisfying a set of linear equations {P i ⊕ P j = c i,j : (i, j) ∈ C} for some c i,j ∈ {0, 1} n , is called mirror theory. Patarin introduced the mirror theory and provided a proof for this. However, the proof, even for a special class of equations, is complex and contains several non-trivial gaps. As an application of mirror theory, XORP[w] (known as XOR construction) returning (w − 1) block output, is a pseudorandom function (PRF) for some parameter w, called width. The XOR construction can be seen as a basic structure of some encryption algorithms, e.g., the CENC encryption and the CHM authenticated encryption, proposed by Iwata in 2006. Due to potential application of XORP[w] and the nontrivial gaps in the proof of mirror theory, an alternative simpler analysis of PRF-security of XORP[w] would be much desired. Recently (in Crypto 2017) Dai et al. introduced a tool, called the χ 2 method, for analyzing PRF-security. Using this tool, the authors have provided a proof of PRF-security of XORP[2] without relying on the mirror theory. In this paper, we resolve the general case; we apply the χ 2 method to obtain a simpler security proof of XORP[w] for any w ≥ 2. For w = 2, we obtain a tighter bound for a wider range of parameters than that of Dai et al.. Moreover, we consider variable width construction XORP[∗] (in which the widths are chosen by adversaries adaptively), and also provide variable output length pseudorandom function (VOLPRF) security analysis for it. As an application of VOLPRF, we propose an authenticated encryption which is a simple variant of CHM or AES-GCM and provides much higher security than those at the cost of one extra blockcipher call for every message.

First Page

314

Last Page

335

DOI

10.13154/tosc.v2018.i1.314-335

Publication Date

1-1-2018

This document is currently not available here.

Share

COinS