André ( Dit Le Sage

Gaëtan, Christelle Pascale

María, Léo Nicolas Anthony

Christina Xavier

Rémi

Kevin

Daniel

Antonio Thomas

Clémence, Valentin Dit Le Jeune

Augustin

Nicolas Clara

Kaushik David Pierre

Julia Yann

Joris, Olivier Je Pourrais Mentionner Romain

Fabien, Maxime, Ilhan, Natsuki Quentin

Une thèse commence habituellement par des remerciements où l'humour vient maladroitement cacher l'émotion qui accompagne la fin. Malheureusement, je ne suis pas drôle. Je dédie donc ces remerciements : À tous ceux qui ont rendu possible cette aventure. Cela commence avec Gaëtan Leurent pour un stage de master qui s'est si bien déroulé qu'il semblait évident de continuer à travailler ensemble en thèse. Et plus tôt encore avec Anne Canteaut, au MPRI, qui a diffusé cette offre de stage et est ensuite devenue ma directrice de thèse. Merci, donc, Anne et Gaëtan pour cet encadrement de qualité. J'ai particulièrement apprécié votre disponibilité et votre réactivité, que ce soit pour signer des documents ou bien pour travailler.

Merci aussi à ceux qui sont là pour la fin : à Henri Gilbert et Bart Preneel qui ont accepté de prendre de leur temps pour rapporter ce manuscrit, et à Raphaël Bost, Tetsu Iwata, Antoine Joux et Damien Vergnaud qui complètent le jury afin de valider le travail accompli. Je n'oublie pas non plus Damien Vergnaud et Brice Minaud qui ont assuré mon comité de suivi le long de la thèse.

À tous mes collègues. J'ai eu la chance de faire partie d'une excellente équipe de recherche, l'équipe SECRET devenue COSMIQ. Les occasions de se retrouver étaient nombreuses et toujours appréciées : les conférences, les workshops, les groupes de travail mais aussi la cantine de Bercy, les mots fléchés, le baby-foot... Je remercie donc tous les membres passés et présents de l'équipe que j'ai eu la chance de rencontrer en citant pêlemêle et forcément avec des oublis :

avec k $ ← --{0, 1} κ , p $ ← --P et les choix aléatoires de A. La sécurité PRP de E est l'avantage maximal parmi tous les adversaires A limités à t opérations et σ appels à l'oracle, notée Adv prp E (t).

En fait, il est toujours possible d'énumérer toutes les clés pour vérifier si la permutation provient du chiffrement par bloc ou bien si elle a été tirée aléatoirement. Ceci est une attaque par recherche exhaustive sur la clé et s'applique à n'importe quelle PRP avec un coût de t = O(2 κ ) opérations et quelques appels à l'oracle pour un avantage Ω(1). Un chiffrement par bloc est donc considéré sûr après σ appels si la recherche exhaustive est considérée trop coûteuse pour être utilisée en pratique et si aucune autre attaque n'est connue.

m 0 E k IV c 0 m 1 E k c 1 m 2 E k c 2
Schéma 1: Diagramme du mode de chiffrement Cipher Block Chaining (CBC) qui chiffre un message m = m 0 m 1 . . . à partir d'une clé k et d'une valeur initiale

IV comme c 0 = E k (m 0 ⊕ IV ) et c i = E k (m i ⊕ c i-1 ).
Les modes d'opération. Un s décrit la façon dont des primitives telles que les chiffrements par bloc, les chiffrements par bloc paramétrables ou encore les permutations peuvent être enchaînés dans un but cryptographique précis. Il s'agit là, par exemple, de chiffrer afin de garantir le secret, d'authentifier afin de garantir l'authenticité d'un message voire les deux en même temps. Les modes d'opération sont classés selon leurs buts ; respectivement les modes de chiffrement, les modes d'authentification et les modes de chiffrement authentifié. La représentation en diagramme comme celle du mode CBC en Schéma 1 est souvent utilisée pour décrire un mode, et le déchiffrement associé est le plus souvent évident. La sécurité des modes d'opération peut ainsi être étudiée formellement en faisant l'hypothèse d'une primitive sûre. En effet, avec l'hypothèse que le chiffrement par bloc est une bonne PRP, il est possible de formellement étudier certains modes en remplaçant le chiffrement par bloc par une permutation parfaitement aléatoire.

Attaques Génériques. Puisqu'il est possible de prouver la sécurité des modes, il est aussi possible de monter des attaques génériques sur ceux-ci qui ne dépendent pas de la primitive utilisée. Une attaque peut directement décrire un adversaire avec un grand avantage pour un distingueur. Par exemple, il existe un adversaire IND-CPA contre le mode CBC avec une complexité de σ = O(2 n/2 ) blocs de chiffré. Il suffit pour cela d'attendre une collision de deux blocs de chiffré :

c i = c j E k (m i ⊕ c i-1 ) = E k (m j ⊕ c j-1 ) m i ⊕ m j = c i-1 ⊕ c j-1
puis de vérifier que le XOR des blocs de message est égal au XOR des précédents blocs de chiffré ce qui est toujours le cas en CBC et très peu probable pour une suite aléatoire. Or une collision sur n bits arrive en moyenne après O(2 n/2 ) valeurs selon le paradoxe des anniversaires ; c'est pourquoi O(2 n/2 ) est aussi appelée la borne des anniversaires.

Au delà d'un simple distingueur, une attaque peut aussi se mettre dans des modèles plus réalistes et considérer la complexité en calcul dont les preuves ne parlent pas.

Organisation. Ce chapitre est un court abrégé en langue française des différentes contributions de cette thèse. Il sera suivi des introductions de l'état de l'art aux Chapitres 1, 2, 3 et 7 ainsi que des explications détaillées des contributions aux Chapitres 4, 5, 6, 8 et 9. Ces contributions correspondent respectivement à cinq articles publiés dans des conférences internationales avec comité de lecture et actes [LS18], [LNS18], [START_REF] Chang | Release of Unverified Plaintext: Tight Unified Model and Application to ANYDAE[END_REF], [LS19] et [Sib20] (voir Page 25) et sont résumées ci-dessous dans cet ordre.

Le Problème de la Différence Manquante et ses Applications au Mode Compteur

N 0

E k m 0 c 0 m 1 c 1 E k N 1 m 2 c 2 E k N 2 m 3 c 3 • |m 3 | E k N 3
Schéma 2: Diagramme du mode compteur (CTR) qui produit les blocs de chiffrés c i à partir des blocs de messages m i , d'un nonce N , d'un chiffrement par bloc E et d'une clé k tel que c i = E k (N i) ⊕ m i . La valeur E k (N i) est appelée un bloc de suite chiffrante. Notre première contribution s'intéresse au mode compteur (CTR, voir Schéma 2), un mode de chiffrement largement employé, notamment via le chiffrement authentifié GCM, et reconnu pour son efficacité et sa simplicité. Le mode CTR bénéficie d'une preuve de sécurité jusqu'à la borne des anniversaires, soit jusqu'à O(2 n/2 ) blocs de message avec n la taille du chiffrement par bloc utilisé. À partir de cette borne, une attaque de type distingueur est possible simplement en observant l'absence de collision parmi les blocs de suite chiffrante. En revanche, et au contraire de modes tels que CBC, ce distingueur ne semble presque rien révéler sur le message qui a été chiffré.

De nouveaux algorithmes. Ainsi, nous étudions les attaques qui extraient de l'information sur un message chiffré selon le mode CTR. Pour ce faire nous définissons un problème algorithmique, le problème de la différence manquante (Définition 3). Nous proposons deux algorithmes pour résoudre efficacement ce problème dans deux cas différents : lorsque S = {0} z ×{0, 1} n-z , le crible à préfixe connu requiert O (nz) • 2 n-z + √ nz • 2 n/2 opérations; lorsque S = {0, 1} n , le crible par convolution rapide requiert O(n•2 2n/3 ) opérations grâce à la transformée rapide de Walsh-Hadamard.

Cryptanalyse. Ensuite, nous montrons comment la résolution du problème de la différence manquante permet d'extraire de l'information à partir d'un chiffré selon le mode CTR avec une complexité proche de la borne des anniversaires. Pour ce faire, remarquons d'abord que si l'on connaît le message qui a été chiffré alors nous pouvons en déduire le bloc de suite chiffrante qui a été utilisé en calculant E k (N i) = c i ⊕ m i pour de nombreux i ; notons A l'ensemble de tous les blocs de suite chiffrante observés. D'autre part, nous imaginons avoir accès à de nombreux chiffrements d'un bloc de secret S, c'est à dire à c j = E k (N j) ⊕ m j pour de nombreux j = i ; notons B l'ensemble de tous les blocs de chiffré de S. Enfin, appelons S l'ensemble des valeurs possibles de S qui matérialise ainsi notre connaissance à priori sur le secret. Ainsi, résoudre le problème de la différence manquante avec les ensembles A, B et l'ensemble d'aide S revient à retrouver le secret S pour peu que la solution soit unique. Plus concrètement, nous supposons avoir accès à de multiples chiffrés avec deux types de préfixes connus, H 1 et H 2 , de longueurs respectives d'un bloc et demi et d'un bloc (3n/2 et n bits) et auxquels est systématiquement concaténé le même secret S de longueur arbitraire. Ceci est inspiré de scénarios d'attaques réalistes où les préfixes seraient des requêtes banales tandis que S serait un code d'authentification.

Comme H 1 est de longueur d'un bloc et demi, les premiers n/2 bits de S sont chiffrés dans le même bloc que les derniers n/2 bits du préfixe connu H 1 . Nous pouvons donc utiliser l'algorithme du crible à préfixe connu avec z = n/2 pour récupérer un demi-bloc de secret S. Ensuite, comme H 2 est de taille n, alors le premier bloc de S sera chiffré par un seul bloc de suite chiffrante parmi les chiffrés de H 2 S. Sachant qu'un demi-bloc de S est maintenant connu, nous pouvons encore utiliser le crible à préfixe connu. Finalement, le secret S est intégralement récupéré en répétant un algorithme de complexité O n/2 • 2 n/2 . L'algorithme du crible par convolution rapide a une complexité plus élevée, mais ne demande pas de connaître à priori d'information sur S (le crible à préfixe connu requiert 2 n calculs lorsque z = 0). On peut aussi l'utiliser pour attaquer des modes d'authentification (MACs) qui suivent une construction de type Wegman-Carter-Shoup tels que GMAC (Schéma 3) et Poly1305. En effet, il est possible de récupérer la clé du hachage polynomial en résolvant le problème de la différence manquante. Par exemple, GMAC authentifie un message M de taille d'un bloc par MAC(N, M ) = M • H 2 ⊕ H ⊕ E k (N ) avec N un nonce et donc E k (N ) ne se répète jamais. L'idée est de fixer deux messages M 1 et M 2 d'une taille d'un bloc, de retrouver la différence M 1 • H 2 ⊕ M 2 • H 2 = MAC(N i , M 1 )⊕MAC(N j , M 2 ) pour tout i = j, puis de résoudre l'équation en H pour récupérer la clé de hachage. Ainsi, à l'aide du crible par convolution nous montrons une attaque de type forge universelle sur ce genre de MACs utilisant une fonction de hachage polynomiale avec un complexité de Õ(2 2n/3 ) requêtes, mémoire et opérations. En particulier, cela constitue la première attaque dans ces conditions (nonces respectés et tag non tronqué) sur ces modes en moins de 2 n opérations.

Ceci est un travail commun avec Gaëtan Leurent [LS18].

Attaques Génériques sur les Constructions Double-block Hash-then-Sum MACs

En seconde contribution, nous nous intéressons à la sécurité de plusieurs constructions MACs de type Double-block Hash-then-Sum bénéficiant d'une preuve de sécurité au delà de la borne des anniversaires. Ces constructions utilisent un chiffrement par bloc et possèdent un état interne de la taille de deux blocs (c'est à dire de taille 2n bits). Concrètement, nous étudions SUM-ECBC, PMAC+, 3kf9, GCM-SIV2, et des variantes (LightMAC+, 1kPMAC+). Au moment de la publication de ces résultats, ces MACs avaient une preuve de sécurité jusqu'à 2 2n/3 courtes requêtes mais aucune attaque n'avait été décrite en moins de 2 n requêtes. Notre attaque requiert O(2 3n/4 ) courtes requêtes. Cela s'est avéré optimal : une nouvelle preuve de sécurité améliorée par Kim, Lee et Lee [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] pour les modes SUM-ECBC, PMAC+, LightMAC+ et 3kf9 montre qu'il est impossible d'attaquer ces modes en moins de O(2 3n/4 ) courtes requêtes sans exploiter de particularité du chiffrement par bloc.

Nous montrons aussi une attaque à la borne des anniversaires contre 1kf9. 1kf9 avait été retiré pour cause de problème dans sa preuve, mais cette attaque montre qu'une preuve au delà de cette borne est impossible.

Le Tableau 1 résume la complexité de nos attaques par rapport aux preuves.

Stratégie Générique. Les constructions étudiées sont des MACs de la forme MAC(m) = E(Σ(m)) ⊕ E (Θ(m)) avec deux parties de n bits Σ(m) Tableau 1: Résumé de la sécurité des BBB MACs étudiés et de la complexité de nos attaques. q est le nombre de tags, m la taille maximum d'un message signé, σ le nombre total d'appels au chiffrement par bloc. La borne inférieure et les complexités des attaques sont pour des messages courts ( m = O(1)). "U" signifie forge universelle et "E" signifie forge existentielle.

Mode

O q 4 m 2 2 3n + q m 2 2 n [KLL20] Ω(2 3n/4 ) O(2 3n/4 ) O(2 3n/2 ) E LightMAC+ [Nai17] O q 4 2 3n [KLL20] Ω(2 3n/4 ) O(2 3n/4 ) O(2 3n/2 ) E 1kPMAC+ [Dat+17] O σ 2 n + qσ 2 2 2n Ω(2 2n/3 ) O(2 3n/4 ) O(2 3n/2 ) E 3kf9 [Zha+12] O q 4 m 6 2 3n [KLL20] Ω(2 3n/4 ) O( 4 √ n • 2 3n/4 ) O(2 5n/4 ) U 1kf9 [Dat+15] O q m 2 2 n + q 3 m 4 2 2n + q 4 m 4 2 3n + q 4 m 6 2 4n Ω(2 2n/3 ) O(2 n/2 ) O(2 n/2 ) U m 1 E 1 m 1 E 3 m 2 E 1 m 2 E 3 m m-1 E 1 ... m m-1 E 3 ... m m E 1 m m E 3 E 2 E 4 MAC(m) Σ Θ
Schéma 4: Diagramme du mode SUM-ECBC avec m blocs de message. et Θ(m) (Double-bloc Hash-then-Sum). Voir le diagramme de SUM-ECBC (Schéma 4) pour un exemple. Notre cryptanalyse recherche des quadruplets de messages avec 4 collisions deux à deux sur une moitié de l'état interne. Cela signifie que nous cherchons un quadruplet de messages (X, Y, Z, T ) tel qu'il satisfasse la relation R : modes qui nécessite de déchiffrer le message pour en vérifier l'authenticité. Si l'attaquant à accès au résultat du déchiffrement avant qu'il soit vérifié, la confidentialité et l'authenticité de futurs chiffrés pourraient être compromises. La notion de sécurité en présence de telles fuites, sécurité RUP, a été formalisée par Andreeva et al. [And+14]. Nous proposons un modèle unifié avec celle du chiffrement authentifié classique et adapté aux modes déterministes que nous appellons AERUP, et nous prouvons son équivalence avec l'ensemble des notions classiques de sécurité du chiffrement authentifié couplées à celles de RUP.

R(X, Y, Z, T ) :=

             Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T ) Θ(T ) = Θ(X)
Application. Nous décrivons ensuite le chiffrement authentifié ANYDAE (Schéma 5) inspiré de SUNDAE de Banik et al. [START_REF] Banik | SUNDAE: Small Universal Deterministic Authenticated Encryption for the Internet of Things[END_REF]. ANYDAE est un mode déterministe à bas coût utilisant un chiffrement par bloc et des fonctions de traitement. Nous prouvons le Théorème 1, à savoir que ANYDAE est résistant aux fuites de déchiffrements non-vérifiés et est, de fait, AERUP. Une simple attaque prouve en revanche que SUNDAE n'offre aucune protection dans ce scénario.

E K ρ 1 δ 1 B 2 B 1 E K ρ 1 δ 2 B 3 E K ρ 1 δ 3 ... B E K T T ρ 2 E K M 1 C 1 ρ 3 E K M 2 C 2 ... ρ 3 E K • |Mm| M m C m
Définition 5. Soit > 0, n ∈ N et une function ρ : {0, 1} n × T → {0, 1} n pour un ensemble non-vide T .

• ρ(X, t) est dit -quasi uniforme si pour tout t ∈ T et tout Y ∈ {0, 1} n , Pr X $ ← --{0, 1} n : ρ(X, t) = Y ≤ .

• ρ(X, t) est dit -quasi XOR-universelle ( -AXU) si pour tout t et

t ∈ T distincts et tout Y ∈ {0, 1} n , Pr X $ ← --{0, 1} n : ρ(X, t) ⊕ ρ(X, t ) = Y ≤ .
)| = 0 et |F 1 ∩ Im(ρ 3 )| = Ω, alors Adv AERUP ANYDAE (σ, q v , t) ≤ Adv PRP E (σ, t ) + σ 2 1 2 n + max{ 1 , γ 1 , γ 2 , γ 3 } + Ωσ • γ 3 + q v 2 n ,
pour tout adversaire limité à σ utilisations du chiffrement par bloc, q v appels à l'oracle de vérification et opérant respectivement en temps t et t t.

Enfin, nous proposons deux instances concrètes de ANYDAE : MONDAE et TUESDAE qui réunissent toutes les conditions nécessaires à la notion de sécurité robuste AERUP et rivalisent avec SUNDAE en termes d'efficacité et d'optimalité. En particulier, MONDAE montre que le simple ajout d'une function fix 1 , qui fixe le bit de poids faible à 1, à SUNDAE permet d'obtenir

x P 1 P 2 E k (x) k k k
Schéma 6: Diagramme de deux tours de construction Even-Mansour (2EM) avec clé unique k et deux permutations indépendentes

P 1 et P 2 . Ainsi, E k (x) = k ⊕ P 1 (k ⊕ P 2 (k ⊕ x)).
un mode plus robuste, alors que TUESDAY vise à optimiser le nombre d'utilisation du chiffrement par bloc par rapport à la longueur des messages en entrée.

Ceci est un travail commun initié au huitième Asian Workshop on Symmetric Key Cryptography avec Donghoon Chang, Nilanjan Datta, Avijit Dutta, Bart Mennink, Mridul Nandi et Somitra Sanadhya [START_REF] Chang | Release of Unverified Plaintext: Tight Unified Model and Application to ANYDAE[END_REF].

Cryptanalyse Efficiente en Mémoire de Deux Tours d'Even-Mansour via le Problème du 3-XOR

Even-Mansour. La construction d'Even-Mansour itérée est une façon élégante de construire un chiffrement par bloc à partir de permutations publiques. C'est aussi une façon d'abstraire les constructions de type Substitution-Permutation utilisées entre autres par l'AES. Dans ce travail, nous nous concentrons sur deux tours d'Even-Mansour avec une seule clé (Schéma 6) qui est la construction la plus simple offrant des garanties de sécurité au delà de la borne des anniversaires. En effet, il existe une preuve de sécurité jusqu'à 2 2n/3 évaluations des permutations et du chiffrement.

En revanche, les meilleurs attaques connues ont une complexité en temps d'environ 2 n /n opérations.

Définition 6 (Problème du 3-XOR). Soit trois fonctions f 0 , f 1 , f 2 à valeurs dans {0, 1} w pour un w ∈ N. Trouvez trois entrées (x 0 , x 1 , x 2 ) telles que f 0 (x 0 ) ⊕ f 1 (x 1 ) ⊕ f 2 (x 2 ) = 0.

Cryptanalyse. Afin d'obtenir de nouvelle cryptanalyse de cette construction, nous faisons le lien avec le problème du 3-XOR (Définition 6)

Tableau 2: Comparaison des complexités asymptotiques des attaques contre 2EM. "Données" est le nombre de chiffrements, et "Requêtes" est le nombre de calculs des permutations publiques P i . 0 < λ < 1; log n ≤ β ≪ n; KP : Message connu; CP : Message choisi.

Ref

Données

Requêtes Temps

Mémoire Stratégie [START_REF] Nikolic | Cryptanalysis of Round-Reduced LED[END_REF] KP 2 n ln n/n 2 n ln n/n 2 n ln n/n 2 n ln n/n Multi-collisions [START_REF] Dinur | Key Recovery Attacks on 3-round Even-Mansour, 8-step LED-128, and Full AES2[END_REF] CP 2 n ln n/n 2 n ln n/n 2 n ln n/n 2 n ln n/n Diff. m-c (clés indep.) [START_REF] Dinur | Key Recovery Attacks on 3-round Even-Mansour, 8-step LED-128, and Full AES2[END_REF] KP 2 λn 2 n ln n/n 2 n ln n/n 2 n ln n/n Multi-collisions [START_REF] Dinur | Key Recovery Attacks on Iterated Even-Mansour Encryption Schemes[END_REF] CP 2 n /λn 2 n /λn 2 n /λn avec des éléments de taille w = 2n. Le 3-XOR est un problème algorithmique bien connu qui, pour être résolu, nécessite au minimum 2 w/3 requêtes mais dont les meilleurs algorithmes demandent 2 w/2 /w opérations. Cela correspond à l'état de l'art pour la cryptanalyse de 2 tours d'Even-Mansour.

Concrètement, il est facile de voir que résoudre le problème du 3-XOR avec les fonctions :

f 0 (x) := x x ⊕ E(x)
f 1 (y) := y ⊕ P 1 (y) y f 2 (z) := z P 2 (z) est équivalent à récupérer la clé k car pour une solution x, y, z nous avons avec bonne probabilité k = x ⊕ y. Grâce à ce lien, nous décrivons de nouvelles attaques sur 2 tours d'Even-Mansour. Nous parvenons ainsi à décrire la première cryptanalyse où le nombre de chiffrés et de mémoire requis sont significativement en dessous de 2 n . D'un point de vue pratique, les attaques demandant près de 2 n de mémoire et/ou blocs de chiffrés ont peu de chance de rivaliser avec une simple recherche exhaustive de la clé.

Grâce à cette réduction, n'importe quel algorithme pour le 3-XOR peut être utilisé pour attaquer 2EM. Cela signifie qu'une future amélioration des algorithmes pour résoudre le 3-XOR améliorera directement l'état de l'art de la cryptanalyse de 2EM. De plus, en utilisant une variante pour le 3-XOR d'un algorithme pour le 3-SUM de Baran, Demaine et Pǎtraşcu [START_REF] Baran | Subquadratic Algorithms for 3SUM[END_REF], nous obtenons un algorithme avec une complexité asymptotique en calcul de O(2 n ln 2 n/n 2 ), asymptotiquement meilleur que O(2 n /n), mais peu performant pour des valeurs pratiques.

En exploitant la forme particulière de notre instance de 3XOR, nous proposons un autre algorithme qui requiert très peu de données et est efficient en mémoire. Pour une constante 0 < λ < 1, cet algorithme utilise seulement λn paires de message/chiffré et 2 λn mémoire. Par exemple, en prenant n = 64 et λ = 1/2 la mémoire reste tout à fait raisonnable et nous gagnons un facteur 32 par rapport à la recherche exhaustive.

Une comparaison asymptotique de nos résultats et d'autres cryptanalyses est donnée au Tableau 1.

Ceci est un travail commun avec Gaëtan Leurent [LS19].

Attaques Génériques sur les Constructions FX Itérées Paramétrables

Notre dernière contribution s'intéresse à une construction générique pour construire des chiffrements par bloc paramétrables à partir de chiffrements par bloc classiques. Alors qu'un chiffrement par bloc classique de taille n avec une clé, sécrète, de taille κ est une application E : {0, 1} κ × {0, 1} n → {0, 1} n , un chiffrement par bloc paramétrable admet en plus un paramètre (tweak), public, de taille τ et est donc une application E : {0, 1} κ × {0, 1} τ × {0, 1} n → {0, 1} n . La sécurité des chiffrements par bloc paramétrables a été formalisée par Liskov, Rivest et Wagner [START_REF] Liskov | Tweakable Block Ciphers[END_REF].

Notre construction générique généralise une technique fréquement employé pour ce genre de construction : d'abord la taille de la clé est augmentée via une construction FX, puis la clé maître est mixée avec la valeur du paramètre pour produire les sous-clés nécessaires. La construction peut naturellement se répéter en série.

La construction générique. Décrivons formellement la construction FX paramétrable itérée. Soit E 1,2,...,r (u, •) r chiffrements par bloc admettant une clé u de κ bits avec une entrée et sortie de n bits. Soit k la clé maître du chiffrement par bloc paramétrable de taille κ bits, t le paramètre de longueur arbitraire. Enfin, soit γ i (k, t) la sous-clé de taille κ de E i pour 1 ≤ i ≤ r et λ i (k, t) la sous clé de taille n pour 0 ≤ i ≤ r. Pour toute paire d'entrée message/paramètre (m, t), la sortie E k (t, m) = c de r tours de construction FX paramétrable est définie comme :

s 0 := m ⊕ λ 0 (k, t) s i := E i (γ i (k, t), s i-1 ) ⊕ λ i (k, t)
, pour 1 ≤ i ≤ r c := s r .

Voir le Schéma 7 de la construction pour r = 2 tours.

Cryptanalyse. Notre résultat sur deux tours est une attaque théorique possible lorsque κ ≤ 2n en complexité, toutes requêtes confondues, de :

Q = O 2 2 3 (n+κ) • 3 κ/n . Sous l'hypothèse raisonnable que κ = O(n) alors Q = O(2 2 3 (n+κ) ). m E 1 E 2 Ẽk (t, m) γ 1 (k, t) γ 2 (k, t) λ 0 (k, t) λ 1 (k, t) λ 2 (k, t)
Schéma 7: Diagramme de deux tours de la construction FX paramétrable Ẽk (t, m) = E 2 γ 2 (k, t), E 1 γ 1 (k, t), m ⊕ λ 0 (k, t) ⊕ λ 1 (k, t) ⊕ λ 2 (k, t).

Plusieurs constructions dans la littérature suivent ce paradigme sur deux tours pour construire des chiffrements paramétrables et notamment la construction récente XHX2 par Lee et Lee [START_REF] Lee | Tweakable Block Ciphers Secure Beyond the Birthday Bound in the Ideal Cipher Model[END_REF] qui est un cas particulier de notre généralisation où λ 1 (k, t) = λ 0 (k, t) ⊕ λ 2 (k, t). [START_REF] Lee | Tweakable Block Ciphers Secure Beyond the Birthday Bound in the Ideal Cipher Model[END_REF] prouve que la sécurité de XHX2 est min{2 2 3 (n+κ) , 2 n+κ/2 }. En particulier, la sécurité est de 2 2 3 (n+κ) lorsque κ ≤ 2n ce qui correspond à la complexité de notre cryptanalyse. Ainsi, notre attaque prouve l'optimalité de leur preuve, et inversement.

Ensuite, nous généralisons cette attaque pour un nombre arbitraire de tours de cette construction et nous obtenons une attaque sur r tours lorsque κ ≤ rn en :

Q = O 2 r r+1 (n+κ) • r+1 κ/n
Encore une fois, si on suppose raisonnablement que κ = O(n) alors

Q = O(2 r r+1 (n+κ) ).
Le Tableau 3 montre plusieurs constructions en comparant la meilleure attaque connue avec notre attaque générique. Le principe de notre attaque générique ressemble à l'attaque sur la construction classique FX de Gaži [START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF] et prouve qu'une complexité totale de requête plus basse que O(2 r-1 r n+κ ) est atteignable lorsque κ > r/n dans le cas d'une construction paramétrable. Néanmoins l'idée reste la même : nous collectons suffisamment de données pour pouvoir reconstruire les valeurs intermédiaires qu'aurait prit l'état interne avec chaque valeur possible de clé maître. Ainsi, nous pouvons vérifier si le résultat que l'on a reconstruit correspond au résultat obtenu en appelant directement l'oracle de chiffrement. Si ce n'est pas le cas, alors la valeur choisit ne correspond pas à celle de la clé maître.

Tableau 3: Comparaison des bornes asymptotiques connus et de notre attaque sur divers constructions.

Ref

Construction r Preuve Attaque connue Attaque générique

[LRW11] LRW2 1 2 n/2 2 n/2 2
Telle qu'elle est décrite, cette attaque demande autant de calculs qu'une recherche exhaustive, c'est à dire O(2 κ ). Le but de cette attaque n'est donc pas d'être pratique mais plutôt de répondre aux preuves. En particulier, en restant à ce niveau de généralité qui englobe de nombreuses constructions, cette attaque répond à la question suivante : en utilisant la stratégie des constructions FX itérées paramétrables pour construire un chiffrement par bloc paramétrable, quel niveau de sécurité peut-on espérer atteindre ? En effet, pour toute construction à r tours, notre attaque montre qu'aucune preuve ne pourra garantir une sécurité au-delà de O(2 r r+1 (n+κ) ) requêtes avec κ ≤ rn.

Ceci est un travail personnel [Sib20].

Conclusion

Cette thèse aura ainsi exploré et contribué à de nombreux sujets concernant la sécurité des constructions cryptographiques symmétriques formellement prouvables. Nous avons décrit des attaques considérant la complexité total de temps et de mémoire (sur le mode CTR, GMAC, 2EM, SUM-ECBC, etc) ainsi que des attaques plus théoriques qui ne regardent que la complexité en requêtes et répondent ainsi aux preuves (sur les Double-bloc Hash-then-Sum MACs et les constructions FX itérées paramétrables). Nous avons également étudié des notions de sécurité plus robustes, sécurité RUP, en dérivant la preuve de sécurité du chiffrement authentifié ANYDAE.

De nombreuses constructions cryptographiques, techniques de preuves et problèmes algorithmiques étudiés tout au long de cette thèse sont abordés plus en détail dans ce manuscrit.

On Provably Secure Schemes

In symmetric cryptography, provably secure schemes are constructions that can be proven secure under some assumptions. They all rely on some lower-level cryptographic function that we call a primitive and typically come with a proof that reduces their security to the primitive's security under some conditions.

Though the proof and cryptanalysis techniques are somewhat similar, we classify provable secure schemes into two parts. Part I is about modes of operation which describe ways to use an actual primitive to achieve a concrete cryptographic goal such as encryption or authentication. Part II is about idealized designs which describe how to build new primitives upon existing primitives. Examples of what we call idealized designs are the Even-Mansour construction that builds a block cipher from a permutation, and the FX construction that builds a block cipher with a stronger resistance to generic attacks from another block cipher.

As the name suggests, provably secure schemes allow for formal proofs to be made. However, most of this manuscript focuses on the cryptanalysis of such schemes, but we nevertheless introduce proofs techniques and apply them in Chapter 6. Cryptanalysis can be seen as the dual of proofs: while proofs state sufficient conditions that make a scheme secure, cryptanalysis states necessary conditions for its security.

Organisation. The chapters are organized as follows. A general introduction to cryptography is given in Chapter 1 along with some useful results and a motivation for the study of modes of operation. Chapter 2 and Chapter 7 present the state of the art regarding modes of operations and idealized designs to introduce Part I and II, respectively. Chapter 3 pursues the presentation of the state of the art and details generic attacks on various modes of operation. Although it belongs to Part I, algorithmic techniques introduced in Chapter 3 will remain relevant in Part II when talking about cryptanalysis of idealized designs.

The remaining chapters correspond to the contributions of a publication each. In Part I, Chapters 4, 5, and 6 describe the contributions of [LS18], [LNS18], and [START_REF] Chang | Release of Unverified Plaintext: Tight Unified Model and Application to ANYDAE[END_REF], respectively. And, in Part II, Chapters 8 and 9 describe the contributions of [LS19] and [Sib20], respectively. See the list of publications on page 25.

Notations

Cryptography from Antiquity to Today

Though cryptography is now a computer science field, the need for secure communication largely predates the Internet and the rise of information theory. Interestingly, the earliest evidences of cryptography may not have had the goal of hiding information but were mainly used to give a sense of mystery. Examples of such use are to be found in the Egyptian tomb of Khnumhotep II, 1900 BC, where some new hieroglyph-like symbols replace the usual ones, or again in the Old Testament where some words are written in Atbash which reverses the Hebrew alphabet (in the Latin alphabet 'a' would become 'z', 'b' would become 'y' and so on).

Domination of Cryptanalysis.

Following early ideas, most encryption schemes used were some kind of substitution cipher where each letter is replaced by another letter or symbol. However, those ciphers were routinely broken by cryptanalysts using frequency analysis. The idea is that the most frequently used letter heavily depends on the language and hence corresponds with good probability to the most frequent symbol in the ciphertext.

The earliest known description of cryptanalysis by frequency analysis dates back to the 9th century by Al-Kindi [AlKry]. It has later been rediscovered in Europe and, by the 15th century, it became very usual among ambassadors to encrypt important messages while employing cryptanalysts to break other's communications. Overall, cryptanalysts were able to break through most ciphers with a certain success despite innovative counter-measures such as adding useless symbols or employing poor orthography. From the 14th to early 20th centuries, cryptanalysts routinely overcame most ciphers by adapting the frequency analysis technique.

Many people would still rely on encryption to hide from curious eyes or, more dangerously, to get a false sense of security. This was the fall of Mary, Queen of Scots, who held confidence throughout her trial in 1586 that her letters couldn't have been deciphered. She believed no one could prove that she approved of the Babington Plot to assassinate the Queen of England Elizabeth I [START_REF] Singh | The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography[END_REF]. Her trust relied on her multiple ciphers where additional symbols were used for both useless distractions (Nulles) and common words. Figure 1.1 shows one of Mary's cipher which employs many tricks to deter cryptanalysis by frequency analysis. Nevertheless, all of her letters were systematically brought to the cryptanalyst Thomas Phelippes which had no trouble understanding their contents. Moreover, in order to know who were involved in the Babington Plot, Phelippes imitated Mary's writing and asked in a post-scriptum for all the plotters' name in Mary's behalf by coding it properly. This is a great example of a forgery attack where the secrecy of the cipher wrongly authenticates the author. Following her trial, Mary was executed the next year in 1587.

Figure 1.1: One of more than 100 ciphers used by Mary Queen of Scots and seized in her apartment in 1586. Collection of The National Archives (UK) [START_REF] Queen | Page of ciphers used by Mary Queen of Scots, c.1586[END_REF].

Cryptography during the First World War. In the early 20th century the need for secure communications became more critical than ever. Every army during World War I made extensive use of a new technology: wireless telecommunications. This allowed for faster and more reliable communications than ever, especially at sea, but it also allowed the enemy to easily wiretap any signal sent and intercept the ciphertext.

Interestingly, no notable encryption scheme came out of World War I. Cryptanalysts kept breaking new ciphers as quickly as they came out. Messages of critical importance were routinely decrypted in matter of hours. The most notorious example is probably the invitation by the German Foreign Minister sent to Mexico asking to form an alliance and declare war on the USA. This message, though carefully encrypted, was mostly deciphered within a day by British Intelligence's cryptanalysts Montgomery and de Grey [START_REF] Singh | The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography[END_REF]. In the end, this message is what finally convinced the USA to go to war.

Modern Symmetric Cryptography

Perfect Encryption. The early 20th century also saw the development of the science of information theory. As information started to be thought of at a bit level, a simple and elegant idea for encryption surfaced: the One-Time-Pad. The idea is to randomly flip, or not, each bit of the message. To do this is easy: produce a random key k of the same length of the message m and XOR each bit of the message with each bit of the key to produce the ciphertext c as c = m ⊕ k. Indeed, at a bit level, if the i th bit of key is 1 then the i th bit of message is flipped in the ciphertext; otherwise it is not flipped. Given a random key, this is equivalent to independently flip each bit with probability 1/2.

In 1919, Vernam deposed a patent for an encryption scheme relying on the XOR operation, thus the One-Time-Pad is also sometimes called the Vernam's cipher.

There is, of course, a heavy drawback: the two parties need to share a key which is at least as long as the message sent, and the key cannot ever be reused again. However, the benefit is just as huge: in 1949 Shannon published a proof for the unconditional security of such a system [START_REF] Shannon | Communication theory of secrecy systems[END_REF] given a perfectly random key.

Unconditional or perfect security has a precise meaning here that knowing the ciphertext does not change our a priori knowledge of the message content or, equivalently, that the ciphertext is independent from the message. Formally speaking, let M = m the event "the message is m" and C = c the event "the ciphertext is c", then perfect security means that the following holds:

∀ ∈ N, ∀m, c ∈ {0, 1} : Pr(M = m|C = c) = Pr(M = m) ,
for any adversary with no knowledge of the key.

Notice that this condition does not ensure that the scheme is sound. Indeed, sending a truly random ciphertext might be secure, but the receiver might not be able to recover the message from the ciphertext. However, this is very easy with the One-Time-Pad when knowing the key as we know what are the flipped bits. We simply need to compute m = c ⊕ k. Asymmetric Cryptography. Two major breakthroughs will give rise to modern cryptography as we know it. The first one solves the issue of key distribution. Indeed, sharing a secret key value is far from trivial. It was traditionally done by hand: cryptographic keys would be physically brought to the front line or loaded in a ship before departure. However, in 1976, Diffie and Hellman [START_REF] Diffie | New Directions in Cryptography[END_REF] published a key exchange algorithm that solves this issue and is now known as the Diffie-Hellman key exchange. Given an authenticated but public channel, two parties can now share pieces of information and securely derive a common secret key. This secret key can subsequently be used to enable private communication over the channel.

The second major breakthrough came shortly after, and public-key cryptography was invented. In 1977, Rivest, Shamir and Adleman described the RSA cryptosystem [START_REF] Rivest | A Method for Obtaining Digital Signatures and Public-Key Cryptosystems[END_REF], the first asymmetric encryption scheme using both a public key and a secret key. Using RSA, one can use its private key to make a signature over a document which can be verified by anyone using the corresponding public key. Conversely, anyone can use one's public key to encrypt a message which can only be deciphered using the corresponding secret key. The keys for encryption and decryption are not the same anymore, and one of them, the public key, can be safely broadcasted. This is called public-key cryptography, or asymmetric-key cryptography.

On the other hand, private-key cryptography, or symmetric-key cryptography, assumes that the communicating parties already share a common and secret key. In practice, symmetric cryptography is much faster than its asymmetric counterpart. Most communications are actually encrypted via symmetric encryption using a key that was either shared via a Diffie-Hellman key exchange or encrypted with a public-key cryptosystem like RSA. Far from replacing symmetric cryptography, asymmetric cryptography allowed everyone to authenticate themselves and safely share secret keys over the Internet. Nowadays, a massive amount of data is encrypted daily using the combination of asymmetric and symmetric cryptographic schemes in a way that is almost oblivious to the users. Practical Cryptography. Modern symmetric cryptography uses many types of building blocks or primitives, but the most prominent ones are surely stream ciphers and block ciphers. Stream ciphers can take a key of limited size and produce a key stream of arbitrary size which is then XORed with the message. It can be seen as a practical way of applying the One-Time-Pad but with a pseudo-random key generated by a smaller master key.

On the other hand, block ciphers can be used in multiple ways and are the most common primitive for modes of operation.

Concretely, we define a permutation as a bijective function P : {0, 1} n → {0, 1} n and a block cipher as a family of permutations indexed by a secret key. An n-bit block cipher E with a κ-bit key is therefore an application E : {0, 1} κ × {0, 1} n → {0, 1} n . When one knows the key, one knows how to transform any n-bit value into an n-bit codeword. Cryptographers often refer to those n-bit values as words and the transition table as a dictionary. In some sense, given a key, a block cipher provides a compact way of describing a dictionary that enciphers every n-bit words just like we used to transform letters back in early cryptography.

Security of Block Ciphers

Informally, a block cipher is considered secure if, when given a random key, its outputs look like the output of a random permutation. We talk about pseudo-random permutations (PRP) as the randomness in block ciphers really comes from the key while the rest is deterministic.

PRP Security. The security of a block cipher is formally defined using a security game. The game is a distinguisher: a hypothetical adversary A is given a black-box access to a function f , also called an oracle, and must distinguish between the ideal and real worlds. In the real world, the function is the block cipher f (•) = E k (•) with a random key k $ ← --{0, 1} κ , that is a random permutation from the family defined by the block cipher E. In the ideal world, the function is a random permutation. Definition 1.1 (PRP Security). Let P be the set of all n-bit to n-bit permutations and let A f (•) → 1 the event "A outputs 1 when interacting with the function f ". The PRP security game advantage of an adversary A for a block cipher E is defined as: A low advantage bound makes for a good PRP security as it means that any algorithm or adversary A will behave the same whether it uses a pseudo-random permutation from the block cipher E or a truly random permutation. In the case where the adversary has access to both f and its inverse f -1 , we talk about the strong pseudo-random permutation security or sPRP security. Definition 1.2 (sPRP Security). The sPRP security game advantage of an adversary for a block cipher E is defined as:

Adv prp E (A) = Pr(A E k (•) → 1) -Pr(A p(•) → 1) , with the randomness of k $ ← --{0, 1}
Adv sprp E (A) = Pr(A E k (•),E -1 k (•) → 1) -Pr(A p(•),p -1 (•) → 1) .
with the randomness of k $ ← --{0, 1} κ , p $ ← --P and A. Then, the sPRP security is Adv sprp E (t), that is the maximum advantage over all adversaries A running in time t.

Pseudo-Random Functions. A random permutation is a permutation taken at random among all n-bit to n-bit permutations. Similarly, we define a random function as a function taken at random among all functions and a PRF as a family of functions indexed by a key. Therefore, we also define the prf security game that measures how close is a keyed construction from a truly random function.

Definition 1.3 (PRF Security). Let F be the set of all X → Y functions and let A f (•) → 1 the event "A outputs 1 when interacting with the function f ". The PRF security game advantage of an adversary for a construction G : K × X ← Y is defined as:

Adv prf G (A) = Pr(A G k (•) → 1) -Pr(A f (•) → 1) ,
with the randomness of a parameter k

$ ← --K, f $ ← --F and A. Then, the PRF security is Adv prf G (t)
, that is the maximum advantage over all adversaries A running in time t.

The PRP/PRF Switching Lemma. Consider a random n-bit to n-bit function. The set of all n-bit to n-bit functions surely includes permutations, but it is easy to see that the set of all permutations is a relatively small subset. In other words, such a random function is extremely unlikely to be a permutation as n grows. The fundamental difference between a PRF and a PRP is that a permutation is bijective, that is every different input maps to a different output, while a PRF has collisions with overwhelming probability for large n. We can compare a PRP with a PRF by looking at the PRP advantage of a PRF or vice-versa: Lemma 1.1 (PRP/PRF Switching Lemma). Let n ≥ 1 an integer and A an adversary performing at most σ oracle queries. Then

Pr(A f (•) → 1) -Pr(A p(•) → 1) ≤ σ(σ -1) 2 n+1
with f a function uniformly drawn from the set of all n-bit to n-bit functions and p a permutation uniformly drawn from the set of all n-bit to n-bit permutations.

This is the PRP/PRF Switching Lemma 1.1 that was first proved by Bellare and Rogaway [START_REF] Bellare | The Security of Triple Encryption and a Framework for Code-Based Game-Playing Proofs[END_REF]. It implies that a PRF and a PRP are indistinguishable up to σ 2 n/2 computations. Indeed, after 2 n/2 computations we expect to observe a repetition in the output of a pseudorandom function which cannot happen for a pseudo-random permutation.

It is critical to limit the power of the adversary to t time or operations even though it makes formal proof difficult. Indeed, an all-powerful A can always brute-force the key and see whether the permutation belong to the family defined by E or not. Enumerating all the keys requires O(2 κ ) operations giving a substantial advantage.

In practice, sustained cryptanalysis efforts allow us to conjecture that there are no better attacks than brute-force to win the PRP or sPRP security game. The AES block cipher [AES], for one, has earned a great deal of trust, and it is now routinely conjectured that the advantage is Adv sprp AES (t) ≤ 2 t-128 with a 128-bit key size. This conjecture means that any adversary limited to a realistic computation time has only a low advantage in the PRP and sPRP security game. But what is a realistic computation time? Let us make a comparison: the blockchain community is a good example of people going to great lengths to compute some cryptographic functions over and over again. In March 2020 they reached a rate of 120 quintillions hash per second [BCC], that makes for around 2 67 computations every second. This is huge. Nevertheless, at this rate and according to the AES conjuncture, it would still take about 73 billions years to reach 2 128 computations and break a single instance of AES or, alternatively, one billion years to reach a 1/73 PRP advantage.

The Need for Modes of Operation

A good block cipher along with a random secret key thus defines a codebook or a dictionary from any n-bit words to another n-bit words that looks random enough for any adversary. However, messages are of arbitrary size while a block cipher has a typical size of n = 64 or 128 bits. Modes of operation allow us to deal with those arbitrary long messages.

A mode of operations is a description of how to treat any messages using a secure primitive such as a block cipher. Typically, the message is first split into n-bit blocks and padded if necessary such that m = m 1 m 2 ... m . It is then processed according to the mode's specifications. We like to represent a mode of operation with a diagram like the one for CBC on Figure 1.3 that produces a ciphertext c from a message m and, optionally, an initial value IV.

m 0 E k IV c 0 m 1 E k c 1 m 2 E k c 2 Figure 1.3: Diagram of the Cipher Block Chaining mode of operation (CBC) where c 0 = E k (m 0 ⊕ IV ) and c i = E k (m i ⊕ c i-1 ).
One could be tempted to use a block cipher just like one used substitution ciphers in earlier times. Simply split and pad the message into n-bit blocks and independently pass them through the block cipher to get the ciphertext as c i = E k (m i ). This is the Electronic Code Book mode (ECB), and we show in Section 2.1.2 how it actually fails to provide any satisfying level of security.

From Assumptions to Proofs. A mode of operation usually comes with a formal proof of security. A formal proof is possible with the assumption that the underlying primitive is secure. A secure mode using a block cipher typically assumes a bound on the PRP or sPRP advantage of Definition 1.1. Concretely, modes of operation can be proven secure after replacing the block cipher by a random permutation. If an adversary can break a given construction when instanced with a block cipher but not when instanced with a random permutation, this would be a distinguisher for the sprp security game and break the sPRP security assumption.

In practice, there are many proofs that start by replacing the block cipher by a random function instead of a random permutation. This includes the proof of ANYDAE shown in Chapter 6. The idea is to first replace the block cipher by a random permutation (PRP security assumption) and then apply the PRP/PRF Switching Lemma 1.1.

• • • • • • • f (•) f (•) f (•) f (•) f (•) f (•) f (•) O(2 n/2 ) values • • • • • • • • • • p(•) p(•) p(•) p(•) p(•) p(•) p(•) p(•) p(•) p(•) O(2 n ) values

Random Functions and Permutations

Here we wish to give some insights on the difference in behavior of random functions and random permutations which will be useful throughout this manuscript. Unlike a permutation, a random function can be defined with arbitrary input length though in this Section we limit ourselves to n-bit-input functions. The behavior we expect from random permutations is the same as the behavior we expect from secure PRPs and the same can be said for random functions and PRFs.

Iterating Behavior. While random permutations and random functions are indistinguishable up to 2 n/2 computations, their respective expected behavior diverges afterwards. This is especially true when iterating over and over the function as

x → f (x) → f (f (x)) → ....
A random function is expected to reach a collision after about 2 n/2 computations which makes the sequence starts looping over previously seen values. As the image set {0, 1} n is finite, any permutation will also have to cycle through previously seen values. However, since a permutation has no collision, it will necessarily loop back to the starting value. In fact, we know the order of magnitude of the length of such cycles. For a random function, it is O(2 n/2 ) as it corresponds to the first collision. This comes from the birthday paradox, see Section 3.1.1 for more details. For a random permutation, it is O(2 n ). Indeed, knowing that a random permutation was iterated σ times without closing a cycle, the probability of going back to the starting value in the next iteration is only 1/(2 nσ), thus it most probably won't loop until σ is of order of magnitude O(2 n ). We illustrate the difference in behavior in Figure 1.4.

Why Permutations? At first glance, the reason why we wish for a block cipher to define a family of permutations is so that it is invertible. However, we see in Chapter 2 that many modes actually allow for decryption without the use of the inverse. This is an appreciated feature as it lowers the implementation cost. Some of the most widely used modes, including the Counter mode shown in Section 2.1.4, actually benefits from a better security when used with a PRF instead of a PRP.

The reason may instead be that PRPs are easier to build. We present a few design strategies for building block ciphers in Chapter 7. Such iterative strategies can't be applied to build a pseudo-random function as composing PRFs is a delicate thing to do.

For instance, composing two random permutations p 1 and p 2 as p(•) = p 1 (p 2 (•)) is perfectly fine: it is akin to shuffling a deck twice instead of once. Hence, it provides for another random permutation that is absolutely equivalent to being randomly drawn from the set of all permutations. When composing the same random permutation as p(•) = p 1 (p 1 (•)), the conclusion is less obvious. If we consider the iterating behavior of such p against p 1 , all the loops of even size will be halved so that p will contain an unexpected number of loops of odd size. Nevertheless, Minaud and Seurin [START_REF] Minaud | The Iterated Random Permutation Problem with Applications to Cascade Encryption[END_REF] proved that such a p is indistinguishable from a truly random permutation up to Ω(2 n ) computations, meaning that the difference in behavior (the sPRP advantage) is mostly negligible. On the other hand, composing twice a random function like

f (•) = f 1 (f 1 (•)
) is only behaving like a true random function up to O(2 n/2 ) computations. The intuition is that composing makes a collision more likely to happen and the iterating behavior (Figure 1.4) will be shorter in expectation for every loop. Concretely, the first collision happens after π 4 2 n/2 computations instead of π 2 2 n/2 [START_REF] Canteaut | Distinguishing and Key-recovery Attacks against Wheesht[END_REF]. This leads to a prf security game distinguisher running in O(2 n/2 ). This distinguisher even works when composing different random functions like f (

•) = f 1 (f 2 (•)).
Those results show how subtle it is to deal with random functions while hoping to preserve the expected behavior.

Introduction to Modes of Operation

Modes of operation describe how we can use some primitive to achieve a concrete cryptographic goal. The primitive can be a permutation, a hash function, a block cipher, a tweakable block cipher, etc. Typically, this primitive is assumed to be secure which allows for the security to be proven information theoretically. The modes of operation are thus naturally classified according to their goals.

In this chapter we successively introduce modes that aim at encrypting messages in Section 2.1, authenticating messages in Section 2.2 and both encrypting and authenticating in Section 2.3. Finally, we conclude by dwelling deeper on various security notions of modes of operation with Section 2.4 that will motivate the contributions shown in later Chapters. Most of the presented modes will rely on the use of block ciphers as it is to date the most widely deployed type of primitive thanks to the standardization and popularity of the DES followed by the AES. However, there are also modes relying on public permutations and others relying on tweakable block ciphers. We give example of such in Section 2.3.4.

Modes for Encryption

Privacy or confidentiality is the cryptographic goal of an encryption. We want to hide all information about the message, also called plaintext, into a ciphertext.

They are now many modes for encryption but not all of them are standardized and much less in use. In this section we'll introduce some of the most well-known modes and comment on their merits with a focus on the security profile. Not only must an encryption hide the message content but it must also allow the recipient to recover the message knowing the key. Such a mode therefore takes a secret key k, a message m and, sometimes, an initial value IV as input and outputs a ciphertext c that will be sent along with the IV . Thus, c = Enc IV k (m). A decryption algorithm, m = Dec IV k (c), is also necessary for completeness but is most of the time obvious given the specification of the encryption.

Security Game

Indistinguishability from Random Bits. To assess the security of a mode of operation doing encryption we imagine the following security game. As for any distinguishing game, the adversary has a black box access to a function, we call it an oracle, and must distinguish between two worlds, the real and the ideal worlds. In the real world, a key k is chosen at random and the adversary has access to the encryption of any message m under a possibly chosen IV and gets the proper corresponding ciphertext: Enc IV k (m). In the ideal world, whatever the adversary requests he will get a random bit string of corresponding size, that is the random function The attacker advantage for the indistinguishability from random bits against Chosen Plaintext Attack, IND$-CPA, of a mode of operation is defined as: The advantage really measures how close we are from perfect security of the ideal world where every ciphertext is equally likely and independent of the message.

$(IV, m) $ ← --{0, 1} |Enc IV 0 (m)| . A Enc • k (•) A $(•, •) Real World Ideal World
Adv IND$-CPA • (A) = Pr(A Enc • k (•) → 1) -Pr(A $(•,•) → 1) , ( 2
Other Security Notions. There exists other security notions. For example there is the indistinguishability notion that asks the attacker to distinguish the encryption of the input message against the encryption of a random message; or the left-or-right notion where the attacker inputs two messages m 0 and m 1 and receives the encryption of only one of them before guessing which message was encrypted.

The main point is that the discussed IND$-CPA notion is one of the strongest security notion and implies the other ones. In particular, IND$-CPA implies the indistinguishability and the left-or-right security notions.

On Chosen Ciphertext Attack. In this section we won't consider security under Chosen Ciphertext Attack (CCA) where the adversary can freely choose the ciphertext as well as the plaintext. IND-CCA notions are common in public key cryptography but translate poorly in the symmetric setting. This is particularly true for encryption modes whose aim is not to provide security against malleability of the ciphertext. We discuss later ways protect the integrity of the message. In some sense, CCA security will be achieved by the AE notion shown in Section 2.3.1 Assumptions. To allow for a proof of a mode of operation, we need the assumption that the underlying primitive is secure. For instance modes of operation using a block cipher E will be proven by first assuming E is either PRP or sPRP secure and then replacing the block cipher by a truly random permutation. Consider the CBC mode of Section 2.1.3 and let p be a truly random permutation, then:

Adv IND$-CPA CBC-E (t) ≤ Adv prp E (t) + Adv IND$-CPA CBC-p .
Therefore, we can give a bound of Adv IND$-CPA

CBC-E

(t) by independently bounding the PRP security of E and proving the security of the mode instanced with a random permutation. While the primitive has a computational security depending on the running time t, the security of modes using a perfect primitive are typically proven in the information theoretic setting and thus does not depend on t. Instead, it will depend on the size and number of queries made.

Leakage.

It is harder for an adversary to recover any unknown bit of information on an encrypted message than to win the IND$-CPA security game. This IND$-CPA notion thus captures the leakage of any kind of bit of information.

The only leakage allowed here is the message length. A ciphertext necessarily leaks a maximum message length so avoiding this kind of leakage is beyond the goal of such modes of operation.

An Insecure Mode

m 0 E k c 0 c 1 E k m 1 c 2 E k m 2 c 3 E k m 3 c 4 E k m 4 Figure 2.2: Electronic Code Book mode (ECB) where c i = E k (m i ).
The Electronic Codebook mode of operation (ECB) is one of the earliest mode of operation as well as one of the simplest. We give its diagram in Figure 2.2. Though it has been standardized as early as 1980 by the FIPS81 document of the NIST for use along with the DES block cipher [START_REF]DES Modes of Operation[END_REF], it is also a good example of how to NOT use a block cipher.

Algorithm 2.1 IND$-CPA distinguisher for ECB mode for encryption.

1: input: f is either encryption or random. 2: output:

1 if f (•) = Enc k (•), 0 otherwise. 3: procedure ECBDistinguisher(f (•)) 4:
Take any m ∈ {0, 1} n .

5:

c 0 c 1 ← f (m m) 6: return c 0 ? = c 1 return 1 if true, 0 otherwise.
Distinguisher. We can easily show that ECB is not IND$-CPA secure by describing a distinguisher that only needs a single query: the attacker A requests a 2-block message with two identical blocks m m, gets the encryption c 0 c 1 and simply check whether c 0 ?

= c 1 which will happen every time with ECB but is very unlikely in the random case. We explicitly describe such an adversary in Algorithm 2.1.

The advantage of such an adversary A that implements Algorithm 2.1 can be easily computed: Pr(A Enc k (•) → 1) = 1 by construction of ECB mode and Pr(A $(•) → 1) = 2 -n since there is a 1 2 n chance that equality of the cipher occurs randomly. Thus, there exists an A that has an advantage Adv IND$-CPA ECB (A) = 1 -2 -n after a single query and a single comparison. Independently of the cipher used, the ECB mode therefore offers no security guarantees after a single encryption.

In Practice. The ECB mode is well known to spectacularly fail at encrypting raw images. Images have a lot of redundancy thus the input will often repeat and recognizable patterns will be preserved through encryption.

ECB is still largely supported mainly for legacy reasons but, surprisingly, we sometimes also see new products implementing it. For example, a report from Marczak and Scott-Railton analyzing the web meeting service Zoom showed that the AES128 block cipher is used in ECB mode [START_REF] Marczak | Move Fast and Roll Your Own Crypto[END_REF]. A later white paper by the company itself confirmed the use of ECB though it claims to use the AES256 block cipher [START_REF]White Paper: Zoom Encryption[END_REF].

Legacy Modes for Encryption

Among the earliest modes of operation we can cite the Cipher Block Chaining mode (CBC), but also the Output Feedback mode (OFB) and the Cipher Feedback mode (CFB). They were standardized early with the ECB mode in the FIPS81 document [START_REF]DES Modes of Operation[END_REF] to be used with the DES block cipher. Thus, they are largely deployed and still supported by many systems.

m 0 E k IV c 0 m 1 E k c 1 m 2 E k c 2 Figure 2.3: Cipher Block Chaining mode (CBC) where c 0 = E k (m 0 ⊕ IV ) and c i = E k (m i ⊕ c i-1 ).
Cipher Block Chaining. The CBC mode (Figure 2.3) is probably the most popular encryption mode out of the 4 early standardized modes. The security of CBC was first proved in 1997 by Bellare et al. [START_REF] Bellare | A Concrete Security Treatment of Symmetric Encryption[END_REF], nearly 17 years after its standardization. They used the left-or-right notion of security, and their result also holds for the IND$-CPA-rIV notion of security according to Rogaway [START_REF] Rogaway | Evaluation of Some Blockcipher Modes of Operation[END_REF]. We won't go into the details of the proof but we give its statement:

Adv IND$-CPA-rIV CBC-E ≤ Adv prp E + σ 2 /2 n , (2.2)
with σ the number of calls to the block cipher which corresponds to σn bits of processed plaintext.

Output Feedback. The OFB mode (Figure 2.4) can be seen as a stream cipher built with a block cipher. It produces a key stream by applying iteratively the block cipher and then simply XORs the key stream with the plaintext to produce the ciphertext. OFB possesses some advantages over CBC: the decryption is the same as the encryption, it only uses the block cipher in the forward direction, and padding of the message to a IV

E k m 0 c 0 E k m 1 c 1 E k m 2 c 2 E k • |m 3 | m 3 c 3 Figure 2.4: Output Feedback mode (OFB)
where where

c 0 = E k (IV )⊕m 0 and c i = E k (m i-i ⊕ c i-1 ) ⊕ m i .
length multiple of n is not needed as one can truncate the unnecessary bits of key stream. The proof of security of OFB is a direct corollary of the security of CBC. Indeed, the key stream can be seen as the CBC encryption of an all zero 0 σn message. As long as CBC is IND$-CPA-rIV, the encryption of any message is undistinguishable from a random string. Simply XORing a random string to the message to produce the ciphertext is perfectly secure as it is a One-Time-Pad. Thus,

Adv IND$-CPA-rIV OFB-E ≤ Adv prp E + σ 2 /2 n , (2.3)
where σ is the number of block cipher calls.

Cipher Feedback. The CFB mode (Figure 2.5) can be seen as a selfsynchronizing stream cipher. The message is split into blocks of r bits, and we only use the r most significant bits of the output of the block cipher while throwing out the rest. A proof of security was shown by Alkassar et al. [START_REF] Alkassar | Optimized Self-Synchronizing Mode of Operation[END_REF] with the same bound as the CBC. Again their result can easily be translated into the IND$-CPA-rIV notion of security:

Adv IND$-CPA-rIV CFB-E ≤ Adv prp E + σ 2 /2 n , (2.4)
with σ the number of block cipher calls (processing σr bits of message). An advantage of CFB over CBC is the use of the block cipher exclusively in the forward direction and the absence of padding. However, when r < n the CFB mode requires more computations for the same message length.

IV

E k • r m 0 c 0 << r E k • r m 1 c 1 << r E k • r m 2 c 2 << r E k • |m 3 | m 3 c 3 Figure 2.5: Cipher Feedback mode (CFB) where S 0 = IV , c 0 = E k (S 0 ) r ⊕ m i and S i = S i-1 [0:(n-r)] c i-1 , c i = E k (S i ) r ⊕ m i .
Random IV. The security of modes CBC, OFB and CFB can only be proven secure for random IVs. Concretely, the security game of Section 2.1.1 does not allow the adversary to choose the IV for encryption. Instead, the IV value is sampled randomly by the real world oracle and is returned to the attacker along with the ciphertext. There are indeed easy distinguishers if we let the attacker choose the next IV value to be used. This can be considered as a weakening of the concept of the IND$-CPA security. In practice, this makes those modes more prone to implementation errors and implicitly requires additional works to properly produce random values.

Matching Distinguishers. All these modes have a matching distinguisher based on collision searching. In every of those modes an attacker can detect a collision in the outputs of a block cipher and thus deduce a collision in the inputs. For example, with the CBC mode, when one detects c i = c j for some i = j, the equality in input can be verified as c i-1 ⊕m i ? = c j-1 ⊕m j . Since this equality won't hold with great probability in the ideal world, this makes for a distinguisher.

The probability for a random collision goes up with σ and is roughly σ 2 /2 n . This is the birthday paradox, and the implied 2 n/2 security bound is the birthday bound. Notice that the security upper bound also grows like σ 2 /2 n . This is a matching distinguisher showing the proof is tight.

Since the attacker can choose the message, a random collision is unavoidable for CBC and CFB. For the OFB mode, the situation is slightly different: one avoids collision by encrypting its messages as a single very long message. It suffices to use a single IV and chain the permutation. This ensures that the only possible collision is when the internal state goes back to the initial IV. We've seen in Section 1.2.3 that the expected number of blocks before the internal state goes back to the starting value (initial IV) is in the order of O(2 n ), much greater than 2 n/2 . However, even in that case, there is a matching distinguisher as one can detect the absence of collision. In the ideal world the values m i ⊕ c i are completely random, thus collisions are bound to happen after 2 n/2 block encryptions. The absence of such collision when σ approaches the birthday bound is sufficient to build a matching distinguisher. Therefore, the OFB mode used in this way shares the same distinguisher as the CTR mode shown in Section 2.1.4 and even shares the more advanced plaintext recovery attack of Chapter 4.

Conclusion.

Those three legacy modes of encryption have the great advantage of being secure, especially compared with the ECB mode. Among those, the popularity of CBC was probably due the vague protection against tampering of the message. If one changes a bit of the ciphertext, it will make a whole block of plaintext looks like garbage after decryption. But it will still predictably change another block of plaintext which may be problematic.

Drawbacks of the CBC mode therefore include this fake sense of protection but, more importantly, the need for random IVs as well as the need for a good padding scheme of the message to a multiple of a block size or some ciphertext stealing. While the CBC mode seems easy, it is just as easy to get it wrong. On the other hand, the Counter mode of encryption (Section 2.1.4) solves those issues while keeping it simple.

The Counter Mode

At the time of this writing the Counter mode (CTR) is arguably the most deployed and used standard for encrypting data, in particular for TLS secured connections. The idea of the Counter mode is due to Diffie and Hellman [START_REF] Diffie | Privacy and authentication: An introduction to cryptography[END_REF] as early as the legacy modes of Section 2.1.3, but its standardization is more recen. The NIST started recommending the CTR in 2001 [START_REF] Dworkin | Recommendation for Block Cipher Modes of Operation[END_REF], and it is mostly used along with the AES block cipher.

N 0

E k m 0 c 0 m 1 c 1 E k N 1 m 2 c 2 E k N 2 m 3 c 3 • |m 3 | E k N 3
c i = E k (N i)⊕m i .
The CTR mode (Figure 2.6) can be seen as a stream cipher built upon a block cipher. It uses a nonce N as an IV to initialize a counter that goes as input of the block cipher. The message is encrypted with a simple XOR of the output with the plaintext to produce the ciphertext as

c i = m i ⊕ E k (N i).
Thus, the block cipher is only used in the forward direction, and decryption is the same as encryption. It also doesn't require any padding as it can simply cut the key stream to the exact message size. The CTR mode is also highly parallelizable.

Security Proof. Not only is the CTR mode provably secure, but its proof is actually quite simple. The proof is mainly about bounding the advantage an adversary has in distinguishing E from a random function, that is bounding the value Adv prf E (t). Then we simply need to realize that the CTR mode used with a random function is perfectly secure: as the counter ensures the input is never repeated, the output is always a "fresh" random value and perfectly masks the plaintext like a One-Time-Pad would do.

The proof unfolds:

Adv IND$-CPA-N CTR-E ≤ Adv prf E + Adv IND$-CPA-N CTR-prf ≤ Adv prf E As Adv IND$-CPA-N CTR-prf = 0. ≤ Adv prp E + Adv prf prp
As E is a block cipher.

≤ Adv prp E + σ(σ -1)/2 n+1
Apply Lemma 1.1.

(2.5)

Adv IND$-CPA-N CTR-E ≤ Adv prp E + σ 2 2 n+1 ,
with σ the number of block cipher calls, that is the number of encrypted blocks of message. The step 2.5 uses the PRP/PRF switching lemma (Lemma 1.1) to bound Adv prf prp .

Matching Distinguisher. A matching distinguisher directly comes from the fact that a block cipher is a pseudo-random permutation and not a pseudo-random function. As the input never repeats, every block of key stream will be different and no collision is ever possible in the m i ⊕ c i using the CTR mode. On the other hand, in the ideal world, a completely random cipher will end up giving an n-bit collision at the birthday bound, that is after about 2 n/2 blocks. Thus, after about 2 n/2 blocks a distinguisher can discriminate with good probability between the ideal and real worlds by looking at the presence or absence of collision between blocks, respectively. In fact, the upper-bound of the security proof and the lower-bound of this distinguisher both grow at the same rate that is roughly σ 2 /2 n . Therefore this is a matching distinguisher.

Nonce-based Encryption. Per definition, a nonce never repeats. If the inputs of the block cipher repeat a single time, the security of the CTR mode completely collapses as it will reuse the same key stream twice. In our description of the CTR these inputs are described as N i which avoids any repetition. However, any sound way of incrementing the input would be secure. In practice, N is often a message counter.

For the IND$-CPA-N security, the adversary can choose the IV himself but it is strictly forbidden to use the same IV twice. This is an improvement over random IVs based encryption that couldn't allow the adversary to freely choose this value.

Nonce-based encryption like the CTR mode is therefore more robust and less prone to implementation errors. However, one still has to be careful of not repeating the nonces which still makes room for devastating attacks.

Conclusion.

The Counter mode is probably the best choice for encryption among the ones presented so far. It achieves a stronger notion of security with an easy proof while keeping the specification simple. Being nonce-based, it may be less prone to implementation errors though one still have to carefully avoid any repetitions.

The late adoption of the CTR mode may be due to its high malleability. Flipping a bit of the ciphertext will predictably flip the corresponding bit of the plaintext. While avoiding malleability is not the goal of an encryption scheme, it is true that CTR must be combined with an authentication mode of operation in order to avoid tampering of the ciphertext.

Modes for Authentication

The goal of authentication modes of operation is to avoid any undetected tampering of the message. Concretely, an authentication mode outputs an authentication code, also called a tag or a MAC, that is sent along with the message. Cryptographers routinely use the word MAC to describe both the authentication mode and its output, the tag. The message can again be of arbitrary size while the output of a MAC is of fixed size, say s bits, meaning that MAC(m) ∈ {0, 1} s . The message itself is not encrypted.

They are few situations where one needs authentication without encryption but it happens. For example, the Network Time Protocol (NTP) is a protocol to synchronize several distant clocks as precisely as possible which only requires authentication [START_REF] Leurent | Generic Attacks against MAC algorithms[END_REF]. While the timing is not a secret, it must be authentic as it may be critical to detect replay attacks or to assess the validity of certificates. Authentication-only usually makes much more sense than encryption without authentication. Moreover, a good understanding of authentication modes of operation allows us to build authenticated encryption modes in the next Section 2.3.

Security Game

Existential Unforgeability. To attack an authentication mode of operation, the adversary has to build a forgery. A forgery is defined as a valid message and tag pair that was produced without using the key. Any message will do as long as the tag is correct, that is an existential forgery. As we assume the adversary can choose the message and adapt from the answer, we define the notion of Existential Unforgeability under Adaptive Chosen-Message Attack, we'll call it EUF-ACMA or simply EUF security.

In the EUF security game, a key k is first randomly chosen and the adversary is given access to two oracles:, a MAC generation and a MAC verification. The MAC generation takes any message m and returns MAC k (m). The MAC verification asks for a pair (m, T ) ∈ {0, 1} * × {0, 1} s and outputs V (m, T ) = or ⊥ whether the MAC is valid or not, respectively. So, we define the EUF security advantage for an authentication scheme MAC as:

Adv EUF MAC (A) = Pr(A MAC k (•),V k (•,•) forges) , (2.6)
with the randomness of k and A. Forging in this context means finding (m, T ) such that V k (m, T ) = for an m never queried before.

In the case of a nonce-based MAC, the adversary can choose a nonce when querying for a tag T = MAC k (N, m) but cannot repeat it for two different queries. However, it can repeat the nonces for verification queries V k (N, m, T ), we'll call this notion EUF-N:

Adv EUF-N MAC (A) = Pr(A MAC k (•,•),V k (•,•,•) forges) .
(2.7)

Provable Security. In order to be able to prove anything about such statement, one must again assume the underlying primitive to be secure. Block cipher-based authentication modes typically assume the PRP security of the block cipher. Then, when dealing with provable security, we want to look at the number of queries to the MAC generation oracle, q t , the number of queries to the MAC verification oracle, q v and the query length, q . For instance, an attacker can always randomly guess the MAC of a given message with an advantage of q v /2 s . It is a kind of brute-force attack that is generic for any authentication mode. A typical proof statement will give an upper-bound of the advantage growing in function of q , q t and q v . PRFs are good MACs. The EUF security notion does a good job at capturing the security of an authentication mode but it may often be simpler to compare the authentication mode to a pseudo-random function.

Remember the PRF security Definition 1.3. We apply it with the construction being the MAC function that takes as input any message m ∈ {0, 1} * and outputs an s-bit value that is:

Adv prf MAC (A) = Pr(A MAC k (•) → 1) -Pr(A f (•) → 1) , (2.8)
where

k $ ← --{0, 1} κ and f $ ← --F where F is the set of all {0, 1} * → {0, 1} s functions.
While a MAC that is a good PRF is EUF secure, the converse is not true: a MAC could for example leak some information about the message and still be hard to forge, but it would immediately miss the PRF requirement. On the other hand, a non-generic attack on the EUF security directly translate into an attack on the PRF property of the studied authentication mode. More precisely, Bellare, Goldreich, and Mityagin [START_REF] Bellare | The Power of Verification Queries in Message Authentication and Authenticated Encryption[END_REF] showed that:

Adv EUF MAC (t) ≤ Adv prf MAC (t + q t + q v ) + q v 2 s
with q t and q v the number of tagging and verification queries, respectively. We recognize q v /2 s , the probability of success of randomly guessing the correct tag. Indeed, even a perfect PRF would be subject to this generic attack.

Proofs for deterministic MAC therefore often tend to use this PRF specification, as it will be the case in Chapter 6, while cryptanalysis often looks at the EUF security game as in Chapter 5. On the other hand, nonce-based MACs like the Wegman-Carter in Section 2.2.3 cannot be described as PRFs.

CBC-MAC

One way to build an authentication mode of operation is to adapt the CBC mode to produce a tag or a MAC. As the tag must depend on the whole message and must be of length s ≤ n, the only value of interest is the last output of a CBC style encryption.

CBC-MAC variants shown here are all secure as PRFs with birthdaybound provable security. Used as it is CBC-MAC is clearly insecure. There is an easy forgery attack assuming s = n: first query the tag T 1 = MAC(m 1 ) for some message m 1 , then query T 2 = MAC(T 1 ⊕ |m 2 ). By construction, T 2 is a valid tag for the message m 1 m 2 .

m 0 E k m 1 E k m 2 E k m 3 E k • s MAC(m)
Notice that the attacker can freely choose messages m 1 and m 2 before interacting with the oracles. Therefore, this attack is stronger than an existential forgery attack. We call it a universal forgery attack. Note that we can't deduce the security of CBC-MAC from the IND$-CPA security of CBC encryption as CBC-MAC is deterministic and doesn't use any IV.

However, the mode can actually be made secure by adding the requirement that the processed messages be all prefix-free. Definition 2.1 (Prefix-free Formatting). A formatting function Fmt is prefix-free if and only if no output is the prefix of another output, that is for any two messages m, m with Fmt(m) and Fmt(m ) of lengths and respectively and < we have Fmt(m) = Fmt(m ) . Some padding schemes can act like prefix-free formatting functions (Definition 2.1) by encoding the length of the message in the first block. Another way to do it is to restrict the messages to a fixed length, but that defeats the point of dealing with arbitrary size messages.

Encrypt-last-block CBC-MAC. Alternatively, one can improve the security to deal with any messages by encrypting the output of a raw CBC-MAC under a second key. This is the ECBC construction shown in Figure 2.8. At the price of an additional block cipher call, ECBC can be proven secure without requiring prefix-free formatting. A classic 10 * padding is enough: append the message with a 1 and add as many 0 as needed to get to a length multiple of n. CMAC. One can do even better with CMAC, Figure 2.9. CMAC uses three different keys, k 0 for the block cipher, k 1 when padding is required and k 2 when it is not. Simply masking the last input with a key is enough to guarantee security and avoids the need for an additional block cipher computation. Avoiding this kind of additional computation is especially good for short messages. Moreover, the use of two different keys allows CMAC to optimally deal with messages of length multiple of n. A 10 * padding would append a full block to such a message, but with CMAC it is only used when necessary.

m 0 E k 1 m 1 E k 1 m 2 E k 1 m 3 E k 1 E k 2 • s MAC(m)
m 0 E k 0 m 1 E k 0 m 2 E k 0 m 3 pad E k 0 • s MAC(m) |m 3 | < n ? k 1 : k 2
Macthing Forgery Attacks. Matching attacks can be shown for all CBC-MAC modes. In fact, a generic forgery attack by Preneel and van Oorschot [START_REF] Preneel | MDx-MAC and Building Fast MACs from Hash Functions[END_REF] implies a matching birthday-bound cryptanalysis against all iterated deterministic MAC with an n-bit internal state. We detail this generic attack in Section 3.1.2.

The Wegman-Carter Construction

The idea of Wegman and Carter [START_REF] Wegman | New Hash Functions and Their Use in Authentication and Set Equality[END_REF] is to use a keyed almost XORuniversal (AXU) hash function h along with a pseudo-random function

F . The Wegman-Carter MAC is MAC(m) = h k (m) ⊕ F k (N )
with the secret keys k and k and a nonce N . This construction benefits from strong security guarantees as it is as strong as the PRF and the universal hash function employed. Let a construction WCh, F using a δ-almost XOR-universal hash function h (Definition 2.2) and a family of functions F then:

Adv EUF-N
WC-h,F (t) ≤ Adv prf F (t + q t + q v ) + q v δ + 2 -n , against nonce-respecting adversaries with q v the number of verification queries.

Definition 2.2. Let δ > 0 and a function h : K × T → Y for non-empty binary string sets K, T , Y. h(k, t) is said to be δ-almost XOR-universal (AXU) if for any distinct t and t ∈ T and any y ∈ Y,

Pr k $ ← --K : h(k, t) ⊕ h(k, t ) = y ≤ δ .
Wegman-Carter-Shoup. In practice, we like to use block ciphers as it is often the most readily available primitive. Block ciphers are pseudorandom permutations, but the PRP/PRF switch (Lemma 1.1) tells us that

N E k • τ MAC(m)
(m) = h k (m) ⊕ E k (N ).
The drawback is that the provable security falls down to the birthday bound. One can easily see that by using the PRP/PRF switch Lemma 1.1 and get the bound:

Adv EUF-N WC-h,E (t) ≤ Adv prp E (t + q t + q v ) + (q t + q v )(q t + q v -1) 2 n+1 + q v δ + 2 -n ,
since (q t + q v ) is the number of block cipher calls. However, there's been a few works trying to prove that the security still holds as we get near the 2 n/2 bound. Shoup [START_REF] Shoup | On Fast and Provably Secure Message Authentication Based on Universal Hashing[END_REF] first showed that as long as q t < 1/δ, then: block length, at a secret value H that is the hash key. For example, a 3-block message is processed as

Adv EUF-N WC-h,E (t) ≤ Adv prp E (t + q t + q v ) + 2q v δ . Later,
GHASH(m) = m 1 H 4 ⊕ m 2 H 3 ⊕ m 3 H 2 ⊕ 3H.
An advantage of the GMAC construction is the possibility of computing the hash in parallel as well as sequentially. As a drawback, we note the need to implement Galois Field arithmetics to perform quick multiplications.

Matching Attack. In the nonce respecting model and untruncated tag (s = n), a forgery attack on GMAC in the information theoretic setting by Preneel and Luykx [START_REF] Luykx | Optimal Forgeries Against Polynomial-Based MACs and GCM[END_REF] matches the latest bound by Bernstein [START_REF] Daniel | Stronger Security Bounds for Wegman-Carter-Shoup Authenticators[END_REF]. Independently, and at the same time, Leurent and I [LS18] also found a similar forgery attack but with a greater focus on time and memory complexity which gives the first attack in this setting in time complexity less than O(2 n ).

The main idea of these forgeries is to solve to recover a difference h k (m) ⊕ h k (m ) and deduce the hash key k by solving the equation. Therefore, this approach works for all Wegman-Carter-Shoup constructions with h a polynomial hashing function. This includes GMAC and Poly1305. We give details on Chapter 4 for this attack and notably introduce the missing difference problem to recover the difference h k (m) ⊕ h k (m ).

Modes for Authenticated Encryption

Whenever a secure communication is needed, both privacy and authenticity are required. Hence, authenticated encryption schemes are what we usually aim for: those modes satisfy both encryption and authentication security requirements.

The reason why we often study encryption and authentication separately is because they are generic constructions that can combine a secure encryption with a secure authentication to build a secure AE mode.

Typically, an AE encryption (AEnc(m)) takes a message m as input and returns both a ciphertext c and a tag T . The AE decryption (ADec(c, T )) takes the ciphertext and tag as inputs and outputs m if the tag is correct, ⊥ otherwise.

Authenticated Encryption with Associated Data, or AEAD mode, simply adds as input some associated data that is a message we wish to authenticate but not to encrypt. It is, most of the time, trivial to deal with associated data in an AE scheme to build an AEAD scheme.

AE Security Game

AE Security. The security we aim for an authenticated encryption mode of operation is roughly the addition of the IND$-CPA and EUF notions in the sense that the mode must satisfy both games.

The IND$-CPA game in this context considers the MAC as being part of the ciphertext, while the EUF game can query for ciphertext and considers as a forgery any successful decryption that was not the result of a previous encryption query. We'll call those notions IND$-CPA-AE and EUF-AE respectively:

Adv IND$-CPA-AE • (A) = Pr(A AEnc k (•) → 1) -Pr(A $(•) → 1)
(2.9)

Adv EUF-AE • (A) = Pr(A AEnc k (•),ADec k (•,•) forges.) (2.10)
Thus, the AE security advantage can be defined as:

Adv AE • ≤ Adv IND$-CPA-AE • + Adv EUF-AE • (2.11)
Unifying the Security Games. To prove the AE security of a scheme, we can give two proofs: a proof for each game. However, there is a way to define a single game that allows us to prove the AE security in one go. Let AEnc k (•) and ADec k (•, •) be the authenticated encryption and decryption oracles respectively. Let $(•) be a random function that returns a random bit string of length |AEnc k (•)| and ⊥(•, •) be a function that always returns ⊥. Then, the AE unified security game is:

Adv AE • (A) = Pr(A AEnc k (•),ADec k (•,•) → 1) -Pr(A $(•),⊥(•,•) → 1) , (2.12)
with the randomness of k, A and $(•). Of course, the attacker cannot pass a previously queried ciphertext and tag to the verification oracle. For nonce-based modes the attacker is also required to never repeat the nonce in any encryption query, but he can repeat it for decryption ones.

A AEnc k (•) ADec k (•, •) A $(•) ⊥(•,
(•), ADec k (•, •)) or ($(•), ⊥(•, •)).
If the decryption query doesn't output ⊥, then it is a forgery and A 2 outputs 1. Thus, in the real world, the probability of outputting 1 is the same as the EUF-AE advantage of A 1 . If the decryption always output ⊥, then A 2 outputs 0, and the probability of outputting 1 is 0 in the ideal world. Therefore, the advantage of A 1 and A 2 are the same in their respective game.

Finally, breaking AE either breaks IND$-CPA-AE or EUF-AE or, equivalently:

Adv AE • ≤ Adv IND$-CPA-AE • + Adv EUF-AE

•

For any AE adversary A 1 , we build an EUF-AE adversary A 2 and an IND$-CPA-AE adversary A 3 . A 2 forwards all A 1 queries, while A 3 forwards A 1 encryption queries but answers ⊥ at all its decryption queries then mimics decision. Let F be the forgery event, that is "ADec k (•, •) does not answer ⊥ on some query", then:

Adv AE • (A 1 ) =Pr(A AEnc k (•),ADec k (•,•) 1 → 1) -Pr(A $(•),⊥(•,•) 1 → 1) Adv AE • (A 1 ) =Pr(F )Pr(A AEnc k (•),ADec k (•,•) 1 → 1|F ) + (1 -Pr(F ))Pr(A AEnc k (•),ADec k (•,•) 1 → 1|¬F ) -Pr(A $(•),⊥(•,•) 1 → 1) Adv AE • (A 1 ) ≤Adv EUF-AE • (A 2 ) + Pr(A AEnc k (•),⊥(•,•) 1 → 1) -Pr(A $(•),⊥(•,•) 1 → 1) Adv AE • (A 1 ) ≤Adv EUF-AE • (A 2 ) + Adv IND$-CPA-AE • (A 3 )
This result seamlessly applies whether we have random IVs, AE-rIV, or nonces, AE-N.

Generic Construction for Authenticated Encryption

Both encryption and authentication schemes are rarely used by themselves as we rather combine them to get secure Authenticated Encryption AE modes. There are multiple ways to combine them:

• Encrypt-then-MAC (EtM), that is Enc(m) MAC(Enc(m));

• Encrypt-and-MAC (E&M), that is Enc(m) MAC(m); Encrypt-then-MAC. Bellare and Namprempre [START_REF] Bellare | Authenticated Encryption: Relations among notions and analysis of the generic composition paradigm[END_REF] showed that the only generically proven secure scheme is the Encrypt-then-Mac construction (Figure 2.13) with two independent keys for encryption and authentication each. The other constructions can be used, and are actually used, but they require a careful examination or even a new proof to guarantee their security. Associated Data. Given a good AE scheme, adding in associated data to make for an AEAD mode is often trivial. In the case of EtM, one can simply compute c = Enc k 1 (m) then authenticate and send the associated data a as a c MAC k 2 (a c).

• MAC-then-Encrypt (MtE), that is Enc m MAC(m) . m Enc k 1 (•) MAC k 2 (•) MAC(c) || c c

Concrete Examples

Widely deployed through the TLS protocol, the AEAD modes of operation GCM and CCM are securing a significant part of the web traffic.

Galois/Counter Mode. The GCM mode is a design by McGrew and Viega [START_REF] Mcgrew | The Security and Performance of the Galois/Counter Mode (GCM) of Operation[END_REF]. It is a combination of the Counter mode for encryption and Galois MAC for authentication. It basically follows the Encryptthen-MAC construction with the important difference that the keys are not independent. The master key k is used to derive the hash key H as H = E k (0) and to derive the key stream both for encryption and Wegman-Carter-Shoup authentication.

McGrew and Viega [START_REF] Mcgrew | The Security and Performance of the Galois/Counter Mode (GCM) of Operation[END_REF] also proposed a proof of the AE security of GCM. However, flaws in their proof was later shown by Iwata, Ohashi and Minematsu [START_REF] Iwata | Breaking and Repairing GCM Security Proofs[END_REF] who repaired it and gave the following bounds when the nonce is restricted to 96 bits:

N 0 E k • s MAC ... ... a m c m c 1 a a a 1 H H H H H E k N 1 m 1 E k N m m m ...
Adv IND$-CPA-N GCM-E (t) ≤ Adv prp E (t) + 1 2 (σ + q e + 1) 2 2 n Adv EUF-N GCM-E (t) ≤ Adv prp E (t) + 1 2 (σ + q e + q v + 1) 2 2 n + q v (q + 1) 2 s
for adversaries running in time t with σ the number of block cipher calls, q e and q d the number of encryption and verification queries respectively and q the maximum block size of a c over all queries.

In both bounds the first term is dominated by quadratic terms over 2 n , so this confirms the birthday bound security that is security up to O(2 n/2 ) processed blocks.

The term q v (q + 1)/2 s shows a security degradation as we shorten the tag length s and allows for longer messages to be processed. This loss is stronger than the expected q v /2 s from generic tag guessing. Moreover, Ferguson [START_REF] Ferguson | Authentication weaknesses in GCM. Comment to NIST[END_REF] showed that this term is no artifact: there is a forgery attack using a single encryption of a message of length 2 s/2+1 blocks N 0 followed by 2 s/2 expected short verification queries. This can be a problem for short tags, however, for untruncated tags s = n, the first birthdaybound term clearly dominates.

E k • s MAC E k E k ... E k E k b b -1 b 2 b 1 c m E k N m m m ... c 2 E k N 2 m 2 c 1 E k N 1 m 1

CCM.

The CCM mode, Counter with CBC-MAC (Figure 2.15), is an AEAD mode by Whiting, Housle, and Ferguson that has also been standardized by the NIST [START_REF] Dworkin | Recommendation for Block Cipher Modes of Operation[END_REF]. It is thought as a combination of the CTR mode with a raw CBC-MAC in an MAC-then-Encrypt fashion. The particularity of the scheme is that it only uses a single key, the same key for encryption and authentication.

As shown in Figure 2.15, CCM seems simple but all its complexity might actually be hidden in the format function Fmt(N, a, m). The NIST document [START_REF] Dworkin | Recommendation for Block Cipher Modes of Operation[END_REF] imposes some restrictions on this function derived from the security proof of CCM. First, Fmt(N, a, m) must be prefix-free as per Definition 2.1. This is not surprising considering it's using raw CBC-MAC for authentication. Moreover, the first block of output b 1 must uniquely determine the nonce N and must be distinct from all other input blocks during the CTR encryption. This, again, is not hard to do, but it imposes some restrictions on the nonce and counter size as they must fully enter into the n-bit state while ensuring domain separation. For instance, the counter function used in practice forces the first 5 bits of the input to be 0 and encode b 1 such that its first 5 bits can't be 0.

Given those properties for the format function, the security of CCM has been proven by Jonsson [Jon03] who showed:

Adv IND$-CPA-N CCM-E ≤ Adv prp E (t) + σ 2 2 n , (2.13) Adv EUF-N CCM-E ≤ Adv prp E (t) + σ 2 2 n + q v 2 s , (2.14)
with σ the number of block cipher calls, q v the number of verification queries and t the running time of the attackers. Thus, we can directly deduce the AE security of CCM:

Adv AE-N CCM-E ≤ Adv prp E + 2σ 2 2 n + q v 2 s .
(2.15)

Notice that the value σ depends on the specification of the format function and is at least twice the block lengths of all encrypted plaintext. Hence, CCM benefits from strong security guarantees up to birthday bound and truncating the tag to s bits induce a loss of security as expected by generic tag guessing that succeeds with probability q v /2 s . With respect to GCM, CCM is probably easier to implement as it reuse the same block cipher without the need for Galois field arithmetics but it surely is less efficient. One of the reason is that using CBC-MAC for authentication is inherently sequential and must be done from scratch for every nonce.

Tweakable Block Cipher and Permutation based Modes

In this section we'll give AEAD modes that aren't directly built on a block cipher. We will show the OCB mode abstraction built on a tweakable block cipher and the sponge duplex built on a permutation.

Permutation and Tweakable Block

Cipher. An n-bit permutation is simply a bijection P : {0, 1} n → {0, 1} n . As it is deterministic and keyless, the security definition of a cryptographically secure permutation is a bit tricky to define. Informally speaking, a secure permutation is expected to behave just like a random permutation. However, there is no security game that can formally define such a security notion. We call distinguisher any test that makes the permutation behaves differently from a random one although the compact and deterministic description of any practical permutations is, in itself, a distinguisher. In practice, the AES with the key set to 0 can be considered a good, albeit relatively small, permutation.

On the other hand, proofs of permutation based modes are still possible: they replace the public permutation by a random permutation only accessible through an additional oracle. We call this the ideal permutation setting. Concretely, the AE advantage of a scheme based on a public permutation P 0 is defined as:

Adv AE • (A) = Pr(A AEnc k (•),ADec k (•,•),P (•),P -1 (•) → 1) -Pr(A $(•),⊥(•,•),P (•),P -1 (•) → 1) ,
where AEnc k and ADec k use P instead of P 0 with a random key k and a random permutation P . As P 0 does not appear in the game the studied construction is not, strictly speaking, the true construction. Nevertheless, a low AE advantage is still a good indicator that the construction is secure.

Real World

Ideal World We remind that a block cipher is defined to be a family of n-bit permutations indexed by a κ-bit key k that is an application E : {0, 1} κ × {0, 1} n → {0, 1} n . Then, we define a tweakable block cipher as a family of n-bit permutations indexed by both a κ-bit key k, meant to be secret, and a τ -bit tweak t, meant to be public, that is an application E : {0, 1} κ × {0, 1} τ × {0, 1} n → {0, 1} n . Ideally, a tweakable block cipher behave like independent PRPs for each different tweak.

A AEnc k (•) ADec k (•, •) A $(•) ⊥(•, •) p(•) p -1 (•)
a 1 a 2 a 3 a 4 E k E k E k E k 0 2 0 2 2 0 2 4 0 2 8 m 1 E k c 1 m 2 E k c 2 m 3 E k c 3 N 2 N 2 2 N 2 3 m 1 m i E k • s MAC N 2 3 ⊕ 1 T a Figure 2
.17: The abstracted OCB mode with authenticated data a of block length a = 4 and message m of block length m = 3. Formula m 1 m i represents the checksum of all blocks of message and sequential doubling are done inside a Galois Field of proper size. The ciphertext is computed as

c i = E N 2 i-1 k (m i ).
The OCB mode. The first version of OCB was developed by Rogaway with Bellare, Black and Krovetz [START_REF] Rogaway | OCB: A Block-Cipher Mode of Operation for Efficient Authenticated Encryption[END_REF] as an AE scheme before going through multiple evolutions OCB1, OCB2 up to the current OCB3 AEAD mode of operation patented by Krovetz and Rogaway in RFC 7253 [START_REF] Krovetz | The OCB Authenticated-Encryption Algorithm[END_REF]. Plain OCB usually refers to the latest version which is currently OCB3.

As it is described by the RFC, the OCB AEAD mode is based on a classical block cipher, but its security actually relies on an abstraction suggested by Liskov, Rivest and Wagner [START_REF] Liskov | Tweakable Block Ciphers[END_REF]. Indeed, the OCB mode can be thought to be built upon a tweakable block cipher, this is the abstraction we study in this section. Of course the actual OCB mode specifies how to implement a tweakable block cipher based on a secure block cipher. We'll talk about this kind of construction in Chapter 7.

The security of OCB relies on the nonce ensuring that each tweak is used only once except for computing T a for authenticating associated data, Figure 2.17. One can see the sequential doubling N 2 i-1 as some sort of counter that guarantees non repetition. At this level of abstraction the OCB mode is fully secure that is as secure as the underlying tweakable block cipher or generic tag guessing. The security of the actual OCB mode falls down to birthday bound only because the underlying implementation of the tweakable block cipher is secure up to birthday bound. However, one should still be careful when using this kind of hybrid arguments. Indeed, Inoue and Minematsu [START_REF] Inoue | Cryptanalysis of OCB2[END_REF] found an easy attack on the second version of OCB, OCB2, using a handful of queries by exploiting the relations between the tweak values used. With the help of Iwata and Poettering [START_REF] Inoue | Cryptanalysis of OCB2: Attacks on Authenticity and Confidentiality[END_REF] this attack soon developed into a full break of the authenticity and confidentiality of the mode.

Overall the OCB mode is quite efficient. Galois field operations are light: doubling is done with a 1-bit shift followed by a conditional XOR. We say OCB is rate-1 (one block cipher call and one negligible doubling per processed block) while other AEAD schemes are rate-2 (GCM needs one block cipher call and one Galois Field multiplication while CCM needs two block cipher calls per processed block). Moreover, it is possible to precompute the value T a as, in practice, associated data are often static to encode public information like IP addresses. It also deals nicely with padding by handling the last block differently (this is not shown in Figure 2.17) hence only padding when necessary. On the downside we note the need to implement the inverse of the tweakable block cipher for decryption which may not be ideal especially in hardware.

AEAD from Sponge.

The sponge construction has gained popularity as a way to build hash functions with Keccak by Bertoni, Daemen, Peeters and Van Assche who won the SHA-3 NIST competition and thus became known as the SHA-3 standard [START_REF] Dworkin | SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions[END_REF]. The same authors also showed the duplex construction that outputs a random key stream for encryption while absorbing the message for authentication [START_REF] Bertoni | Duplexing the Sponge: Single-Pass Authenticated Encryption and Other Applications[END_REF]. They called it SpongeWrap of which we show a variant in Figure 2.18 that makes for an AEAD mode of operation based on a public permutation.

P P P P a 1 a 2 a 3 1 N k ○ P P P m 1 c 1 m 2 c 2 m 3 c 3 ○ 2 MAC
The security of the SpongeWrap can be directly deduced from the security of the sponge construction for a hash. The n-bit state is separated into two parts: the α-bit rate and the β-bit capacity such that n = α + β. The rate α influences the efficiency of the scheme, message will be absorbed and encrypted by block of α bits. On the other hand the capacity β influences the security of the scheme.

Indeed, the sponge construction for a hash function enjoys a provable collision-resistance security up to the birthday bound of the capacity. That is up to 2 β/2 computations of the permutation P and so does the AEAD mode variant of SpongeWrap for the nonce based AE-N security notion. Notice that the MAC can be expanded to any size by iterating the permutation and concatenating many r-bit blocks of the rate part just like one would expand the hash output of SHA-3.

On the Security of Modes of Operation

In the previous sections we've introduced some modes of operation with their security notions that provide provable guarantees that we can trust.

Here we present some advanced notions and open questions that explore the various security profiles of modes of operation and will motivate the contributions of this thesis.

Quest for Concrete Security

Advantage lower and upper-bounds. Since proofs give an upperbound on the adversary advantage, we can deduce safe parameters' bounds that guarantee security. Typical parameters include the length and number of messages that we can process before rekeying. However, proofs can get better and modes of operation really benefit from improved proofs as they can run with improved parameters. The only way we can know that there is no way one can get a better proof is when there is a matching cryptanalysis for the considered security game. Hence, the security profile of a mode shall not be complete without a proper distinguisher that gives a lower-bound matching the upper-bound of the proof. The Sponge's Case. All modes we've seen so far have a matching distinguisher except one: the SpongeWrap using the duplex construction for AEAD. There are so far no distinguisher matching the 2 β/2 bound, the generic attack on the hash function cannot work in this setting. An improved proof would definitely improve the mode's parameters. For example, having the rate and capacity size set to n/2 bits would improve the efficiency of the scheme, but it would set the provable security down to 2 n/4 queries as it stands.

In fact, Chakraborti, Datta, Nandi and Yasuda presented another sponge-based mode Beetle [Cha+18] that mainly adds a small feedback function in the rate part, and they are able to improve the proof up to 2 min(β-log(α),n/2,α) calls. This would allow for a larger rate α without lowering the provable security guarantees. In the absence of a matching distinguisher, and at the time of this writing, the true security of the original SpongeWrap construction is still an open question.

N 0 0 N 0 1 N 0 2 N 0 3 N 1 0 N 1 1 E k E k E k E k E k E k c 1 m 1 c 2 m 2 c 3 m 3 c 4 m 4 • |m 4 | Figure 2.19:
The CENC beyond birthday-bound secure mode for encryption for ω = 3. Let i = kω + j with 1 ≤ j ≤ ω then we have

c i = E k (N ||k 0) ⊕ E k (N k j) ⊕ m i .
Beyond-Birthday-Bound modes. Going further, many new designs try to achieve beyond-birthday-bound security at a minimal cost. For instance the CENC mode for encryption (Figure 2.19) is a beyond-birthdaybound IND$-CPA-N secure encryption for the cost of 1 + 1/ω cipher calls per block of plaintext with ω the size of the frame. It has first been proposed by Iwata [START_REF] Iwata | New Blockcipher Modes of Operation with Beyond the Birthday Bound Security[END_REF] with a proof showing security up to O(2 2n/3 /ω) block cipher calls. Iwata, Mennink and Vizár [START_REF] Iwata | CENC is Optimally Secure[END_REF] later improved the bound up to O(2 n/ /ω) calls which matches an obvious distinguisher: repetitions inside windows of ω blocks cannot happen in CENC but happen with probability ω(ω -1)/2 n in the random case. Thus, after σ encrypted blocks we have σ/ω windows hence a collision probability of σ(ω -1)/2 n which is Ω(1) when σ is O(2 n ω).

We've also seen that the Wegman-Carter construction can be made beyond birthday-bound secure when used with a good pseudo random function. For instance using the CENC mode to build a seemingly random key stream would build an EUF-N secure beyond birthday bound MAC. There are also recent works trying to build a deterministic EUF secure beyond birthday bound MAC. Such modes that follow the double-block hash-then-sum strategy like SUM-ECBC [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF] or PMAC+ [START_REF] Yasuda | A New Variant of PMAC: Beyond the Birthday Bound[END_REF] came with a proof of security up to O(2 2n/3 ) short tags. In Chapter 5, as a contribution of this thesis and in collaboration with Leurent and Nandi [LNS18], we show a generic attack on those modes using O(2 3n/4 ) tags effectively reducing the cryptanalysis/proof gap. Later Kim, Lee and Lee [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] actually improved the proof to O(2 3n/4 ) tags, matching our distinguisher and finally closing the gap.

Proof and Cryptanalysis. Thus, proofs and cryptanalysis are needed to concretely assess the theoretical security of a scheme. A proof can benefit from better parameters thanks to a better proof and only cryptanalysis tells us where we have hope to improve the security bound.

Cryptanalysis can also disprove a result. Doing proof is hard as it needs to exhaustively treat everything that could go wrong and bound its probability. It is not rare for a cryptanalysis to refute a proof showing that its upper-bound on the attacker advantage is wrong. It was the case of our distinguisher for double-block hash-then-sum MACs that refuted a now retired proof for LightMAC+ [START_REF] Naito | Improved Security Bound of LightMAC_Plus and Its Single-Key Variant[END_REF].

Quest for Practical Security

Limits of Information Theoretic Thinking. Security game with corresponding proofs and distinguishers for modes of operation are usually defined in the information theoretic setting. This means that we assume an attacker with unlimited computing power, but limited number of queries, attacking a scheme using a perfect primitive. The reason is that there is no proof techniques that can formally bound a limited adversary. We have to assume a limited adversary to conjecture the security of primitives but, again, it's only conjectures though back up by experience and analysis of generic attacks.

In practice, though, the real world is not information theoretic and no attacker has unlimited computing power. Optimizing the time and memory complexity of attacks is of interest. Moreover, distinguishers can range from recovering a single bit of information, which might not be threatening depending on the context, to a devastating key recovery revealing all previous and future plaintext. Forgery attacks can also range from finding the tag for a single seemingly random plaintext to a full control of the plaintext we want to sign, the latter is called a universal forgery attack.

As we already said, the information theoretic world allows for great proofs to be made and cryptanalysis in this setting is just as important to concretely assess the security of a mode. With this we can come up with parameter bounds where we can fully trust the security of the studied scheme. However, we also need to ask ourselves what happens after we reach the said bound and think about cryptanalysis is more realistic, practical models.

Practical vs Theoretical gaps. They are quite many schemes that still have a gap between the information theoretic complexity of their attack and the actual time and memory needed to perform them. The Wegman-Carte-Shoup with polynomial AXU hash functions, like GMAC or Poly1305, is a good example. Using the techniques developed for the missing difference in Chapter 4.1 we could describe a partial key recovery attack on those schemes running in O(2 2n/3 ) time and memory which is the first cryptanalysis with a running time lower than 2 n but still leave a gap with the information theoretic attack of complexity 2 n/2 .

Other examples include the double-block hash-then-sum constructions of Chapter 5 where the proposed forgeries, even though some are universal forgeries, still require Õ(2 3n/2 ) operations. That's the reason why we also give an attack that is not optimal in queries, it uses O(2 6n/7 ) queries, but runs in Õ(2 6n/7 ) time, less than 2 n , though this is not generic and only applicable to the SUM-ECBC and GCM-SIV2 MAC constructions.

Notice that the exact same phenomenon arises for provable ideal designs. In Chapter 8 we'll look at the 2-round Even-Mansour block cipher construction. This construction has an information theoretic proof holding up to 2 2n/3 queries, but no actual distinguisher runs in less than 2 n /n time. The analysis we propose greatly reduces the memory and online query complexity while gaining some insights on why a faster cryptanalysis might be really hard to achieve.

The Beastly Attack Setting. The Beastly attack setting is a framework inspired by the BEAST attack of Duong and Rizzo [START_REF] Duong | Here Come The ⊕ Ninjas[END_REF] allowing for practical chosen plaintext attacks. The Beastly attack model is an example of a practical chosen plaintext attack: it assumes a malicious webpage that runs some JavaScript code on the target's computer. The malicious code can then send requests to another domain like a social network. The target's computer will naturally encrypt and send those requests with all the personal authentication token required. These are called cross-origin requests and are an intended feature for Cross-origin resource sharing (CORS). Even though the code can choose the content of the requests made, it is impossible to manipulate the answer. Thus, the security should be ensured by using a strong encryption key that is never manipulated outside the transport layer in the TLS protocol. The model furthermore assume that the adversary can observe queries going in and out of the target's computer. This is a typical assumption in cryptography and can be done in practice by listening to communications in a public Wi-Fi or wiretapping on a router. This setting has notably been used by Bhargavan and Leurent [START_REF] Bhargavan | On the Practical (In-)Security of 64-bit Block Ciphers: Collision Attacks on HTTP over TLS and OpenVPN[END_REF] to mount a practical plaintext recovery attack over HTTPS secured web connection using CBC mode for encryption along with the 3DES block cipher. Their attack named Sweet32 can recover a web authentication token to successfully log onto an account without knowing its password. It essentially takes advantage of the relatively small state size of 3DES, that is n = 64 bits, for a birthday bound attack. In fact, they noticed that many implementations did not put a limit on the number of processed blocks of plaintext before rekeying. Sweet32 led to a change in the NIST standardization of the CBC mode so that early rekeying far away from the birthday bound is enforced unambiguously. This example shows that there are practical Chosen Plaintext Attacks with direct consequences.

In Chapter 4 we ask ourselves what could be a practical attack on the CTR mode. We've seen in Section 2.1.4 that there is a matching distinguisher on the CTR mode that looks for collisions in the key stream blocks. However, looking for collisions won't help to recover block of plaintext for a good reason: key stream collision won't happen with the CTR mode. Therefore, we define the missing difference problem upon the resolution of which we can recover some encrypted plaintext, and then we show how to solve it in query, time and memory complexity close to birthday bound that is Õ(2 n/2 ). For that we place ourselves in the Chosen-Prefix Secret-Suffix attack model by Hoang et al. [START_REF] Viet | Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance[END_REF] where the attacker can choose a message M and get the encryption Enc(M S) for some fixed secret S. Notice that the Chosen-Prefix Secret-Suffix attack model is a simplified model in the Beastly attack setting where a secret authentication token is often appended right after the chosen request content. Hence, as a contribution of this thesis, we show how an attack on the CTR mode would work in a practical setting though we also observed that the CTR mode, unlike CBC, is mostly used along with the AES block cipher whose relatively large internal state, n = 128 bits, makes a birthday bound attack too costly to perform.

Quest for Robust Security

A Need for Robustness. Previously in Section 2.1.4 we've argued that nonce based security left less room for implementation errors compared to random IV based security. This is what robust security is about: strengthening our security definition to prevent or at least mitigate misuses of the mode. For example, the GCM mode is secure under the relatively robust nonce based security notion, but it is also true that a single nonce reuse leads to a leak of the hash key thus compromising all future authentication. Informally speaking, a more robust mode of operation is harder to get it wrong. Looking at implementation errors is outside the scope of this work, but they are the source of many practical attacks on cryptography.

With regard to provable security, a more robust security notion assume a more powerful attacker and a more robust mode is secure under a more robust notion. In that sense, a deterministic notion is more robust than its nonce-based version: the user has no additional IV or counter to deal with, the only allowed leaks are the equality of the messages. Also, a nonce-based notion is more robust than its random IV based version: an attacker can choose any nonce value for an IV while he has not control on the IV in the random IV version.

Notice though that robustness in practice depends on many more factors including human factors. For instance a blog entry by Matthew Green titled "Why I hate CBC-MAC" [START_REF] Green | Why I hate CBC-MAC[END_REF] provides some high-level insights on the lack of robustness of raw CBC-MAC mode of authentication. Indeed, although raw CBC-MAC should be a fine and provable deterministic secure MAC, the need for prefix-free formatting, the lack of proper standardization and its similarity to CBC encryption with only subtle, but critical, differences makes it seemingly easy to get wrong.

Using Synthetic IV.

In order to gain more robustness, Rogaway and Shrimpton [START_REF] Rogaway | A Provable-Security Treatment of the Key-Wrap Problem[END_REF] proposed a construction to combine an IND$-CPA-rIV secure mode for encryption with a prf into a deterministic AE secure AEAD mode of operation. This is the synthetic IV construction or SIV. Figure 2.20 shows the SIV construction for encryption. It is basically a MAC-and-Encrypt construction where the MAC is required to be a secure prf and the tag is also interpreted as an IV for encryption. Thus, the IV is then used both for decryption and authentication in the SIV decryption, Figure 2.21. Let MOD be an IND$-CPA-rIV secure mode for encryption, F a prf secure keyed function and SIV(MOD, F ) be the SIV construction using MOD and F . Then, Rogaway and Shrimpton proved that:

m F k 1 (•) IV Enc • k 2 (•) c
IV c = F k 1 (m) Enc F k 1 (m) k 2 (m). c Dec • k 2 (•) IV m F k 1 (•) • ? = • ⊥ m False True
Adv AE SIV(MOD,F ) ≤ Adv IND$-CPA-rIV MOD + Adv prf F + q/2 n (2.16)
with q the total number of queries and for adversaries with about the same running time t. The original work also included associated data, but it is fairly easy to add to our diagrams in Figures 2.20 and 2.21: simply add the associated data as input to F to produce the IV and encrypt with this.

The main motivation for the SIV construction was to gain robustness against nonce misuse. Indeed, the counter mode is secure with a nonce but also with a random IV as a collision is not expected to happen before the birthday bound. From a deterministic AE secure scheme it is possible to enforce in the specification that it needs a nonce: simply to add it to, for example, the last block of associated data. This way you can ensure the messages will be all different thus randomizing the ciphertext. On the other hand, the leakage in case of nonce repetition is minimal as any difference, whether in the plaintext or in the associated data, will be enough to prevent any leakage of information.

Following this work robust versions of commonly used AEAD modes were designed. We can cite GCM-SIV by Gueron and Lindell [START_REF] Gueron | GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte[END_REF] followed by a different mode AES-GCM-SIV by Gueron, Langley and Lindell [START_REF] Gueron | AES-GCM-SIV: Specification and Analysis[END_REF] or again CCM-SIV by Kresmer and Zeh [START_REF] Kresmer | CCM-SIV: Single-PRF Nonce-Misuse-Resistant Authenticated Encryption[END_REF].

Release of Unverified Plaintext. AEAD modes of operation are expected to decrypt and reveal the plaintext only after it has been properly authenticated. Some modes of operation can be severely compromised if the implementation releases the plaintext before completing the authentication. However, many schemes require that we decrypt beforehand to be able to authenticate. This includes paradigms such as MAC-then-Encrypt and MAC-and-Encrypt (and thus the SIV construction), the duplex and OCB constructions. In that contextn an implementation has two choices: either keep the decrypted message in a secure memory before it's passed to the application layer or not storing anything but decrypt the message again after it's been verified. Both solutions come with constraints not welcomed in restricted environment where cryptography is costly. A third solution is to start using the message and roll back if the tag isn't verified at the end. This is more convenient but obviously insecure ! For this reason we ask ourselves what can of security can we hope to have under release of unverified plaintext, that is RUP security. To answer this question Andreeva et al. [And+14] proposed the notion of plaintext awareness (PA) security that deals with privacy in this setting and the notion of integrity under release of unverified plaintext (INT-RUP) for authenticity.

We formally describe the PA and INT-RUP security game in Section 6.1.1. Moreover, we also show the INT-RUP insecurity of SUNDAE, a deterministic AEAD mode by Banik et al. [START_REF] Banik | SUNDAE: Small Universal Deterministic Authenticated Encryption for the Internet of Things[END_REF], by describing a forgery attack in this setting.

Unified notion.

In Chapter 6 we'll propose a new notion, AERUP, that captures the RUP security we aim at for AEAD schemes. Basically an AERUP secure scheme is also AE, PA and INT-RUP secure. In Section 2.3.1 we've argued that unified notions like AE security allowed for proving security of a scheme with a single proof instead of one proof per security notion. Thus, we illustrate this by proving that a small change in SUNDAE can make it AERUP secure. We prove the security of a generic scheme, named ANYDAE, in one single proof.

Chapter 3 Algorithms for Generic Attacks

This chapter is dedicated to generic attacks techniques and algorithms. Though this lays in the Modes of Operation part, similar techniques will be used in the second part about Idealized Designs.

Collisions

When exploring the cryptanalysis of modes of operation, looking for collisions is one of the most, if not the most, frequent approach. Distinguishers of CBC, OFB, CFB, CTR and all CBC-MAC variants rely on looking for such a collision. Definition 3.1 generically summarizes the collision problem. Though in cryptanalysis we often use the collision problem with a unique function as in Definition 3.2, it is handled the same way as the generic one.

Definition 3.1 (Collision problem with Two Functions). Given two n-bit

functions f 0 , f 1 , find two inputs (x 0 , x 1 ) such that f 0 (x 0 ) = f 1 (x 1 ).

Definition 3.2 (Collision problem with a Single Function)

. Given an n-bit function f , find two inputs (x 0 , x 1 ) :

x 0 = x 1 such that f (x 0 ) = f (x 1 ).

Definition 3.3 (Collision problem with lists). Given two lists of n-bit values

L 0 , L 1 , find a couple (e 0 , e 1 ) ∈ L 0 × L 1 such that e 0 = e 1 .
Moreover, we only discuss the random collision problem where the functions simply output a random value at a fresh input. This is the behavior we expect for cryptographically secure pseudo-random functions. The idea is that the attack can only get better if the underlying PRF has a bias. 85

Complexity

The Birthday Paradox. In a 30 people classroom, there is more than 70% chance of having two persons with the same birthday. More of a counterintuitive fact than a true paradox, the birthday problem answers this question: How many data do we need to collect before there is a collision? The birthday paradox, or birthday problem, states that we need about O( √ N ) random values among N possibilities before two of them collide with high probability. More precisely, among N possible values the collision probability grows with the number of data, d, as 1 -

N ! (N -d)!•N d . This can be approximated to 1 -e -d•(d-1) 2•N
for large N and d. Thus, after collecting d = 2 n/2 n-bit values (N = 2 n ), the probability of a collision is about 40%. This is why we say birthday bound secure schemes are secure up to 2 n/2 block cipher calls, but one must actually be careful to stay sufficiently away from that bound. For instance taking n = 64 bits, after 2 30 blocks of data the probability of collision is still around 3%, too high to properly guarantee security (3 out of 100 such encryptions are expected to be insecure). Hence, a birthday bound secure scheme needs to be rekeyed way before birthday bound to make sure collisions won't happen.

Nevertheless, when using a 128-bit block cipher, and thus n = 128 bits values, the birthday bound is far enough so that rekeying won't be needed. Indeed, while 2 32 64-bit blocks amount to 32 GiB of data, 2 64 128-bit blocks makes for 256 exbibytes that is unlikely to be processed under a single key. To give a comparison, the company Cisco estimated that the 2016 global IP traffic summed up to 83.3 exbibytes per month [START_REF]Cisco Visual Networking Index Predicts Global Annual IP Traffic to Exceed Three Zettabytes by 2021[END_REF].

The main point is that when we talk about birthday bound complexity, the constant hidden in the O(2 n/2 ) notation is often actually smaller than 1 as illustrated by Luykx and Paterson [START_REF] Luykx | Limits on Authenticated Encryption Use in TLS[END_REF] who derived concrete security limits from the proofs statements for various AE modes.

Sorting. There are multiple algorithms to find collisions but most of the time, as we gather values in a list, we require some sort of sorting as in Algorithm 3.1. It is well known that we can sort N values in O(N log N ) time and O(N ) memory. However, in our case, we can take advantage of the randomness of our values to reduce the time complexity to O(N ) using a radix sort or a hash table.

Algorithm 3.1 Collision in Lists

1: input: L 0 , L 1 ⊂ {0, 1} n . 2: output: (i, j) : L 0 [i] = L 1 [j] . 3: procedure Collision(L 0 , L 1 ) 4: Sort(L 0 )
Sort with any order.

5:

Sort(L 1 )

6:

(i, j) ← (0, 0) 7:

while i < |L 0 | and j < |L 1 | do 8: if L 0 [i] == L 1 [j] then 9:
return (i, j) Collision found.

10:

else if L 0 [i] < L 1 [j] then
Assuming ascending values.

11:

i ← i + 1 12: else if L 0 [i] > L 1 [j] then 13: j ← j + 1 14: return ∅ No Collision.

Algorithm 3.2 Collision in Functions

1: input: f 0 , f 1 : {0, 1} n → {0, 1} n . 2: output: (x 0 , x 1 ) ∈ X 0 × X 1 : f 0 (x 0 ) = f 1 (x 1 ) . 3: procedure CollisionFun(f 0 (•), f 1 (•), X 0 , X 1 ) 4: L 0 ← {(x, f 0 (x)) : x ∈ X 0 } 5: L 1 ← {(x, f 1 (x)) : x ∈ X 1 } 6:
Comparison on the second-hand value only.

7:

((x 0 , f (x 0 ), (x 1 , f (x 1 )) ← Collision(L 0 , L 1 ) 8: return (x 0 , x 1 )
Collision with lists. When the values are stored in sorted lists the complexity of looking for a collision is simply the complexity of going through the lists once. The complexity of Algorithm 3.1 is therefore the complexity of sorting, that is

O(|L 0 | + |L 1 |).
In the case where we need to find multiple collision, say c collisions, then the complexity becomes O(|L 0 | + |L 1 | + c). Algorithm 3.1 is describes a birthday bound matching distinguisher that makes d = O(2 n/2 ) queries and thus runs in time and memory O(2 n/2 ).

Memoryless Collision.

The collision problem with functions, Definitions 3.1 and 3.2, can be solved the same way by building one or two lists and looking for collision as in Algorithm 3.2. However, when using functions we are free to manage memory as we wish since we can recompute any value whenever we need it. Therefore, we can look for a collision using only a negligible amount of memory with ideas from Pollard's rho and Floyd's cycle detection algorithms. The idea of such techniques (Algorithm 3.3) is to exploit the iterating behavior of random functions and detect when it enters a cycle, see Figure 3.1. So let µ be the distance travelled before entering a cycle of length λ, we need to find the moment where the function enters the cycle as this is where lies the collision, that is after µ iterations.

• • • • • • • f (•) f (•) f (•) f (•) f (•) f (•) f (•)
The Algorithm 3.3 uses two pointers, one goes a twice the speed of the other such that the distance separating them is always equal to the distance travelled. After µ steps both pointers are in the cycle and after at most λ additional steps the faster pointer necessarily reach the slower one (the faster pointer loops twice while the slow one loops only once). Moreover, when both pointers collide it means they are necessarily separated by a distance that is a multiple of the cycle length λ thus the total travelled distance (total number of steps) is a multiple of λ. After the pointers collide once, one of them is sent back to the starting point, afterwards they both pursue forward one step at a time. Therefore, after µ steps one of the pointer has travelled a distance of exactly µ and the other has travelled a distance of µ plus a multiple of λ, and they will collide at the collision point we were looking for.

The number of steps in Algorithm 3.3 is at most 2µ+λ so its complexity depends on the expected values of µ and λ. An asymptotic analysis by Flajolet and Odlyzko [START_REF] Flajolet | Random Mapping Statistics[END_REF] shows that in expectation µ and λ are π 8 2 n/2 . This provides for an interesting trade-off as it still runs in time and query O(2 n/2 ) but can use a negligible amount of memory. Those techniques are Algorithm 3.3 Memoryless Collision with Pollard's Rho / Floyd's cycle detection.

1: input: f : {0, 1} n → {0, 1} n . 2: output: (x, y) : f (x) = f (y), x = y . 3: procedure Collision(f ) 4: a ← 0
Choose any arbitrary starting point.

5:

x ← f (a)

6:

y ← f (f (a)) 7:
while x = y do 8:

x ← f (x)

9: y ← f (f (y))
10:

x ← a 11:

while f (x) = f (y) do 12: x ← f (x) 13: y ← f (y) 14: return (x, y)
extensively used in cryptanalysis. In public key cryptography they can also be used for generically computing discrete logarithm. In symmetric key cryptography one can use them to find collisions in hash functions. There are a few variants of this strategy and notably a parallelizable version by van Oorschot and Wiener [vW99]. When applicable it is probably the best generic attack for finding collisions. However, this algorithm and its variants don't fit quite well in the context of modes of operation. Indeed, it assumes that we can forget and later query again previous values. Generally this is not something the security games allows, either because the IV is random or because we can't repeat nonces nor repeat messages, exception made for the prf security notion of some deterministic MAC.

Of course, it is possible if we record all queries, but we loose the memory efficient appeal of the technique. This is why Algorithm 3.1 is overall a better description of a birthday bound matching distinguisher for modes of operation.

On Complexity Trade-offs. For the same cryptanalysis, different techniques can provide a variety of trade-offs between the data, time and mem-ory complexities. There is no objective way to compare those trade-offs. Whether is it a chosen plaintext attack (CPA) or a known plaintext attack (KPA), a low data complexity will make the attack easier to set up as one would need to capture less ciphertext. A low time and memory complexity will make the attack run faster and/or require less hardware.

Even comparing time/memory trade-offs is tricky. One could be tempted to simply add the time and memory complexity, but you could also multiply them arguing that a memory cell could be replaced by a computing cell performing multiple operations. We won't provide a definitive answer but simply state that 2 • 2 n/2 time with small memory is certainly better than 2 n/2 time and memory which is certainly better than 2 n time with small memory. This question has some importance when comparing new attacks with the generic brute-force attack: it is usually easy to recover a κ-bit key with a handful of queries, 2 κ computations and negligible memory.

Cryptanalysis

Plaintext Recovery. We saw in Chapter 2 that many distinguishers were based on looking for a collision. In the case of CBC, CFB and OFB a collision can lead to a stronger attack, namely a plaintext recovery attack. These attacks usually assume that some secret information is encrypted among other known plaintext. The complexity of looking for such collisions is discussed in Section 3.1 along with Algorithm 3.1.

CBC mode encrypts data as

c i = E k (m i ⊕ c i-1
) so we'll look for a collision in the c i 's:

c i = c j , i = j E k (m i ⊕ c i-1 ) = E k (m j ⊕ c j-1 ) m i ⊕ c i-1 = m j ⊕ c j-1 m i ⊕ m j = c i-1 ⊕ c j-1
and we recover the XOR of two plaintext blocks. For instance when one of the block is known and the other is secret, we recover a full block of secret information. CFB mode encrypts data as

S i = S i-1 [0:(n-r)] c i-1 and c i = E k (S i
) r ⊕m i . Thus, we look for a collision in the S i 's. Since we know the IV and the ciphertext it is easy to reconstruct S i and to detect collisions.

S i = S j , i = j E k (S i ) r = E k (S j ) r m i ⊕ c i = m j ⊕ c j m i ⊕ m j = c i ⊕ c j
Again we recover the XOR of two plaintext blocks which is likely to leak secret information.

OFB mode encrypts data as

c i = E k (m i-i ⊕ c i-1 ) ⊕ m i so we'll look for collisions in m i ⊕ c i 's for known blocks m i . m i ⊕ c i = m j ⊕ c j , i = j E k (m i ⊕ c i ) = E k (m j ⊕ c j ) m i+1 ⊕ c i+1 = m j+1 ⊕ c j+1 m i+1 ⊕ m j+1 = c i+1 ⊕ c j+1
Thus we get the XOR of two plaintext blocks. Notice that in this case we can iterate the reasoning to deduce m i+2 ⊕ m j+2 = c i+2 ⊕ c j+2 , etc. This is to be expected from OFB that works like a stream cipher: once the internal state collides the key stream output will be identical going forward.

Collision Free modes.

As for the counter mode, looking for a collision works for a distinguisher, but it does not seem to leak any information of the plaintext as, by construction, there cannot be a collision on the key stream. This explains a folklore belief that the CTR mode does not leak anything useful about the plaintext even as we get to the birthday bound. However, we actually show in Chapter 4 a plaintext recovery attack running in data, time and memory complexity close to the birthday bound just like the other attack seen above.

To do that, we define the missing difference problem that is more suited to perform plaintext recovery on the CTR mode and devise efficient algorithms to solve it. The OFB mode processing one very long message also has the same property that collision won't happen, thus it can be attacked the very same way as CTR using the missing difference problem.

Length Extension Forgeries. In Section 2.2.2 we saw multiple variants of CBC-MAC all provably secure up to birthday bound. Here we explain a matching generic forgery attack on all those variants in O(2 n/2 ) queries that looks for a collision in the internal n-bit state of the CBC style chain.

In fact, Preneel and van Oorschot [START_REF] Preneel | MDx-MAC and Building Fast MACs from Hash Functions[END_REF] showed that this generic attack is not limited to CBC-MAC variants. It is generic to all iterated and deterministic authentication modes with an n-bit internal state.

Definition 3.4 (Collision Extension Property

). Given a mode for authentication MAC with internal state Σ. Let Σ(m) the internal state after having processed m. We define the collision extension property as:

Σ(m) = Σ(m ) ⇐⇒ Σ(m x) = Σ(m x)
for any messages m, m and x of arbitrary size.

The idea is that since Σ is the internal state we have Σ(m) = Σ(m ) implies MAC(m) = MAC(m ). Once we detect an internal state collision in Σ we can use the collision extension property (Definition 3.4) to forge a tag with any suffix message we want: simply ask one to get a forgery for the other.

The collision extension property applies for most of iterated MAC constructions. It assumes the messages are processed left to right (more of a notation convention than anything) and so a collision in the internal state will propagate as we feed in exact same blocks of message. However, the collision extension property is inapplicable in a notable case: prefixfree formatting. Indeed, in that case one cannot simply add more blocks without modifying the previous ones. Schemes like raw CBC-MAC rely on that property to guarantee security in the first place and usually does so by prepending a block encoding the length of the message. To get around that limitation we can use what I'd called the collision zero extension property (Definition 3.5) that is implied by the previous collision extension property.

Definition 3.5 (Collision Zero Extension Property

). Given a mode for authentication with internal state Σ. Let Σ(m) the internal state after having processed m. We define the collision zero extension property as:

Σ(m 0 |x| ) = Σ(m 0 |x| ) ⇐⇒ Σ(m x) = Σ(m x)
for any messages m, m of arbitrary size and x of fixed arbitrary size. Thus, for any deterministic iterated MAC, if there is an internal state collision after processing separately m and m , then it will have the collision zero extension property.

To detect that the internal state collide the obvious way is to look for a collision in the tag. However, if two tags collide, it does not necessarily mean that their internal states collided: the processing function can be random and the tag can be truncated. In that case we can again use the collision zero extension property to arbitrarily increase the chance of having an internal state collision. Simply look for collisions in MAC(m 0) MAC(m 1) MAC(m 2) ... for different m.

Therefore, this attack is truly generic to all iterated, deterministic n-bit internal state MAC functions, whether it uses a block cipher or not, and in particular apply to all CBC-MAC variants we've seen. A natural conclusion is that to achieve beyond-birthday-bound security one must either build a randomized mode, see Wegman-Carter of Section 2.2.3, or increase the internal state size, see double-block hash-then-sum of Chapter 5.

Generalized Birthday

Wagner [START_REF] Wagner | A Generalized Birthday Problem[END_REF] proposed a generalization of the birthday problem, see Definition 3.6. The collision or birthday problem can be seen as a 2-XOR problem. As we'll see, the efficient resolution of these problems can lead to new cryptanalysis for different modes of operation.

Definition 3.6 (k-XOR problem). Given k functions f 0 , f 1 , ..., f k-1 , find k inputs (x 0 , x 1 , ..., x k-1 ) such that f 0 (x 0 ) ⊕ f 1 (x 1 ) ⊕ ... ⊕ f k-1 (x k-1 ) = 0.
In the following section we consider the random k-XOR problem where all the functions output a random w-bit value on a fresh input.

Data Complexity. A lower-bound on the complexity of the random

k-XOR problem is given by the expected number of queries that must be made before a solution exists. Roughly speaking after d queries the number of k-tuples will grow like d k with each tuple having a 2 -w chance of being a solution. Thus, we need at least d = O(2 w/k ) queries to hope for a solution.

This corresponds to d = O(2 w/2 ) for the collision problem.

Definition 3.7 (k-XOR problem with lists). Given k lists

L 0 , L 1 , ..., L k-1 , find a k-tuple (e 0 , e 1 , ..., e k-1 ) ∈ L 0 × L 1 × ... × L k-1 such that e 0 ⊕ e 1 ⊕ ... ⊕ e k-1 = 0.
Simple Algorithm. A simple way to solve the k-XOR is to query only one value of every function except 2 of them, and solve the collision problem over those 2 functions. This approach runs in O(2 w/2 ) queries and time. We can solve using Algorithm 3.1 or Pollard's rho techniques. This approach may not be possible when given lists as in Definition 3.7. However, we can still decrease the number of lists by merging them until we get to the 2-XOR problem. To do this we build L 01 = {(e 0 ⊕ e 1 , (e 0 , e 1 )) : (e 0 , e 1 ) ∈ L 0 ×L 1 }, we'll note L 01 = L 0 L 1 . We record the couple (e 0 , e 1 ) only to reconstruct the solution at the end. Of course

|L 01 | = |L 0 | • |L 1 |.

Wagner's Algorithm

Generic Algorithm. In his work Wagner [START_REF] Wagner | A Generalized Birthday Problem[END_REF] proposed a generic algorithm to solve the k-XOR problem. We saw that it is simple to reduce the number of functions or lists to get to the 2-XOR problem either by merging or considering a single query. What Wagner proposed is to reduce the number of lists to the first power of 2. That is reducing the k-XOR to the 2 log(k) -XOR. Then, he proposed an algorithm for k that is a power of 2 running in time O(k • 2 w/(1+log k) ).

Algorithm 3.4 Wagner's Algorithm for k-XOR

1: input: L i ⊂ {0, 1} w , |L i | = 2 w/(1+log k) . 2: output: (0, (e 1 , e 2 , ..., e k ) ∈ L 1 × L 2 × ... × L k ) : e 1 ⊕ e 2 ⊕ ... ⊕ e k = 0 . 3: procedure kXORlist(L 1 , L 2 , ..., L k , n) 4: if k ? = 2 then 5: return Collision(L 0 , L 1 )
Collision on the first element. for i = 1 to k/2 do 9: Wagner's Algorithm. Let us explain the idea of Algorithm 3.4. The trick is to merge lists in a way so that they won't grow in size. To do this we have to keep only a portion of the merged values so the idea of Wagner [START_REF] Wagner | A Generalized Birthday Problem[END_REF] is to only keep values that starts with zeroes for lists of size 2 . Concretely we build L 01 = {(e 0 ⊕ e 1 , (e 0 , e 1 )) : (e 0 , e 1 ) ∈

L i,(i+k/2) ← L i L i+k/2 10: return kXORlist(L 1,k/2+1 , L 2,k/2+2 , ..., L k/2,k , w -) L 1 L 2 L 3 L 4 α L α 12 α L α 34 ∞ for α ∈ {0, 1} do L α 12 ← L 1 α L 2 L α 34 ← L 3 α L 4 L ← L α 12 ∞ L α 34 if L = ∅ then (0, (x, y), (z, t)) ← L[0] return (x, y, z, t) return ⊥
L 0 × L 1 , e 0 ⊕ e 1 = 0}, we note this as L 01 = L 0 L 1 . Indeed, the expected size of L 01 is |L 0 | • |L 1 |/2 = 2 . Notice that L 0
L 1 can be efficiently computed with Algorithm 3.1 looking for all collisions on bits.

We need to check that Algorithm 3.4 is consistent when it transforms a k-XOR instance into a k/2-XOR one. First, it is obvious to see that it produces k/2 lists with elements that are trivially mapped to {0, 1} w- since they all start by zeroes. Then, when replacing n by w -, the lists of the k/2 instance are required to be of size 2 (w-)/(1+log(k/2)) = 2 (w-w/(1+log k))/ log k = 2 w/(1+log k) which is consistent with the fact that the lists are expected to stay the same size. When k = 2, the lists are of size 2 w/2 so there will be a collision with good probability.

Therefore, this algorithm has a time and memory complexity of O(k • 2 n/(1+log k) ) or, when we fix k to a constant, simply O(2 w/(1+log k) ). This will reduce the complexity below the 2 w/2 birthday bound as k grows large, but the complexity decreases slowly. In particular, for all k the complexity is O(k • 2 w/(1+ log k ) ) so that we only see a change of complexity every power of 2.

Memory Efficient

L 0 α L 1 = {(e 0 ⊕ e 1
, (e 0 , e 1 )) : (e 0 , e 1 ) ∈ L 0 × L 1 , e 0 ⊕ e 1 = α}. This algorithm can find all solutions as it keeps running. Therefore, if we're looking for a single solution, we need just the minimal number of queries to ensure such a solution exists in the random 4-XOR which implies = w/4. The complexity becomes O(2 w/4 ) queries, O(2 w/4 ) memory and O(2 w/2 ) time.

In the general case where lists are of size and there are 2 p expected solutions (due to some structure), this algorithm finds a solution in time O(2 2 -p ) with O(2 ) queries and memory.

Definition 3.8 (k-XOR problem with unique function). Given a function

f , find k distinct inputs (x 0 , x 1 , ..., x k-1 ) such that f (x 0 ) ⊕ f (x 1 ) ⊕ ... ⊕ f (x k-1 ) = 0.
Exploiting Functions. Nikolic and Sasaki [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] showed that interesting trade-offs are achievable for a version of the 4-XOR with a unique function and distinct inputs as in Definition 3.8. They make a smart use of Hellman's tables to find a 4-XOR solution in O(2 t ) time and queries for O(2 w-2t ) memory for n/3 < t < n/2.

A particular point in this trade-off is when memory is O(2 w/4 ), as much as the memory efficient algorithm, then the time complexity is O(2 3w/8 ) that is lower than the birthday bound but with also O(2 3w/8 ) queries.

In Table 3.1 we show how the different approaches for 4-XOR compare.

A Hard Case: the 3-XOR Problem

The complexity of Wagner's algorithm for 3-XOR is the same as for collision, that is birthday bound. Wagner [START_REF] Wagner | A Generalized Birthday Problem[END_REF] left a better 3-XOR algorithm as an open question.

Since then, the best algorithms have had a hard time going below the birthday bound. The best ones achieve O(2 w/2 / √ w) time and memory.

There are two main techniques to achieve this, one based on multi-collision and the other on linear algebra. We present each of these techniques and discuss the combination of them.

Definition 3.9 (3-XOR problem with lists). Given three lists L 0 , L 1 , L 2 ⊂ {0, 1} w , find three elements (e 0 , e 1 , e 2 ) ∈ L 0 × L 1 × L 2 such that e 0 ⊕ e 1 ⊕ e 2 = 0.

Multi-collisions.

As a first way of solving the 3-XOR problem faster than Wagner's algorithm Nikolic and Sasaki [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] proposed a multicollision based approach. Their algorithm works in time and memory

O 2 w/2 / w/ ln(w) .
The algorithm is as follows. First, compute many outputs of f 0 and look for the most frequent w/2-bit prefix α appearing using any multicollision search algorithm. Store all the values with this fixed prefix in a list L 0 . Then, evaluate f 1 and f 2 with 2 w/2 / |L 0 | different inputs each, and store the results in lists L 1 and L 2 respectively. Look in L 1 and L 2 for all pairs with a difference α in the first w/2 bits (this is a simple collision problem). In expectation, there will be 2 w/2 /|L 0 | such pairs, and there is a high probability that one of them sums to a value in L 0 . According to their analysis, the optimal attack uses around 2 w/2 /w evaluations of f 0 , resulting in a multi-collision of size Θ(w/ ln(w)). Therefore, this algorithm solves the 3-XOR problem with complexity O 2 w/2 / w/ ln(w) . Linear Algebra. A second approach, introduced by Joux [Jou09], exploits linear algebra and reaches a slightly better complexity of O(2 w/2 / √ w). This attack uses just w/2 evaluations of f 0 stored in a list L 0 , and 2 w/2 / w/2 evaluations of f 1 and f 2 to build the lists L 1 and L 2 . The goal is again to get values with a common prefix, but the trick is to use Gaussian reduction to find a non-singular matrix M such that the elements of L 0 • M start with w/2 zeroes. 1 Then, we focus on a modified 3-XOR instance:

L 0 = L 0 • M L 1 = L 1 • M L 2 = L 2 • M.
1 For instance, we write L0 as a block matrix A B with two w/2×w/2 sub-matrices.

If B is non-singular, we can use M =

I 0 B -1 A B -1
The new instance has the same solutions (L 0

[h] ⊕ L 1 [i] ⊕ L 2 [j] = 0 ⇔ L 0 [h] ⊕ L 1 [i] ⊕ L 2 [j] = 0
), but the elements of L 0 start with w/2 zeroes. Therefore, as in the previous attack, we can efficiently find a solution by looking for a partial collision on w/2 bits in L 1 and L 2 . Bouillaguet, Delaplace and Fouque [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] later generalized this approach to deal with more balanced lists size: given three lists with

|L 0 | • |L 1 | • |L 2 | = 2 w , they solve the 3-XOR problem with complexity O(|L 0 | • (|L 1 | + |L 2 |)/w).
In particular, with three lists of size 2 w/3 this gives a time complexity of O(2 2w/3 /w).

In addition, this algorithm can be combined with the clamping trick of Bernstein to reduce the memory: the attacker first filters the outputs of the function f i to keep only values that start with w/4 zero bits, and solves a shorter 3-XOR instance on 3w/4 bits. If we filter and store 2 w/2 random outputs, the resulting lists still have 2 w/4 elements which is sufficient to expect a solution. This gives an algorithm with time O(2 w/2 ) and memory only O(2 w/3 ). Arguably, this is more practical than algorithms using O(2 w/2 /w) memory. BDP Algorithm. Even before these two approaches, an algorithm proposed by Baran, Demaine and Pǎtraşcu [START_REF] Baran | Subquadratic Algorithms for 3SUM[END_REF] for the 3-SUM problem (using modular additions instead of XORs) worked with the asymptotic complexity of O(2 w/2 • ln 2 (w)/w 2 ). This algorithm has been adapted to the 3-XOR problem by Bouillaguet et al. [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] with the same complexity. This is the best known asymptotic complexity for the 3-XOR problem.

Generally, the BDP algorithm has an asymptotic speed-up of w 2 ln 2 (w) compared to Wagner's algorithm which makes for an asymptotic time

complexity of O(|L 0 | • (|L 1 | + |L 2 |) • ln 2 (w)/w 2 )
. However, as it relies on heavy precomputations, the algorithm is highly impracticable for all realistic values of w.

Combining Approaches. Since the multi-collision and the linear algebra approaches seem to follow a similar strategy it is natural to wonder how one can combine them into a better algorithm. Bouillaguet et al. [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] write that It seems very hard to combine these two improvements in a new algorithm. We concurred with this analysis in [LS19]. However, the formulation may be a bit misleading: it is not hard to combine the two approaches but it may simply be useless. Indeed, both approach can be generalized by the following one:

1. Find a w/2-dimension affine subspace that contains |L 0 | outputs of f 0 and store them in L 0 .

2. Consider now the modified 3-XOR instance with modified coordinates: the first coordinates define the found w/2-dimension linear subspace and the rest simply span to the whole w dimensions. Notice that all elements of L 0 now end by w/2 bits set to 0 as they belong to the linear subspace.

3. Take f 1 and f 2 to look for a partial collision on w/2 bits and verify if it yields a solution.

Step 1 is the crucial step here. Then, the complexity will be led by Step 3 that is O(2 w/2 / |L 0 |). The multi-collision approach solves Step 1 by fixing a priori a linear subspace, and looking for a constant that corrects the w/2bit multi-collision to zero. On the other hand the linear algebra approach takes the first w/2 elements and directly deduce the corresponding w/2 dimension linear subspace (or w/2 + 1 elements in an affine subspace).

The question now is how big can be |L 0 |. First, we assume we make 2 w/2 queries as doing more queries would increase the total complexity. That is why the w/2-dimension affine subspace containing the most elements is unlikely to contain more than w elements. The intuition is that the number of element in a fixed w/2-dimension affine subspace is only 1 in expectation (each element is included with probability 2 -w/2 ) with a variance of 1-1/2 -w/2 . The multi-collision technique looks at 2 w/2 different subspaces and the maximum expected number of elements is Θ(w/ ln(w)). On the other hand, using linear algebra allows us to easily find a subspace containing w/2 elements. There probably are some heuristic approaches looking at about 2 w/2 different subspaces spanned by w/2 elements, but the maximum expected number of elements found is w/2 + Θ(w/ ln(w)), it only adds up. Notice that all interesting subspaces can be spanned by w/2 elements.

The point is that, even if we look at all spanned subspaces, the maximum expected L 0 is of order O(w). Therefore, the total complexity of the combined strategy is bound to be O(2 w/2 / √ w).

Introduction

A Folklore Belief. While the information theoretic security of the counter mode (CTR) is well understood, one can wonder about its practical security. As we saw in Section 2.1, the CTR allows for a distinguisher at the birthday bound as the blocks of key stream never repeat. However, the lack of collisions does not seem to leak any useful information when actually using the CTR mode to encrypt secret data. It may therefore be believed that the CTR mode doesn't really leak any information even at birthday bound.

In fact, we can find in the literature the folklore belief that the leakage of the CTR mode is not as bad as the leakage of the CBC mode. For instance, we can quote Ferguson, Schneier and Kohno [FSK11, Section 4.8.2] in the context of a 128-bit block cipher who wrote: CTR leaks very little data. [...] It would be reasonable to limit the cipher mode to 2 60 blocks, which allows you to encrypt 2 64 bytes but restricts the leakage to a small fraction of a bit. When using CBC mode, you should be a bit more restrictive. [...] We suggest limiting CBC encryption to 2 32 blocks or so.

Our contributions. As a first contribution of this thesis, we devise a plaintext recovery attack on the CTR mode beyond the simple distinguisher. We show a plaintext recovery attack in the Known-Suffix / Secret-Prefix model where a secret piece of information is repeatedly encrypted after 101 some known plaintext block. This situation is common with web cookies and is in line with other attacks against HTTPS [DR11; AlF+13; BL16]. Our cryptanalysis further assumes we can control the position of the secret data and this results in an efficient message recovery running in complexity O(2 n/2 ) in data, time and memory.

To do that we first follow the strategy of McGrew [START_REF] Mcgrew | Impossible plaintext cryptanalysis and probable-plaintext collision attacks of 64-bit block cipher modes[END_REF] and define the missing difference problem (Definition 4.1) upon the resolution of which plaintext recovery on CTR is possible. To efficiently solve this problem we give two new algorithms:

1. An algorithm with O(2 n/2 ) data and memory complexities and O(2 n/2 + 2 dim S ), time complexity where we look for a secret value in S that is (a subset of) a linear subspace of {0, 1} n . In particular, when S is a linear subspace of dimension n/2, we reach a time and query complexity of O(2 n/2 ), while the searching algorithm of McGrew has a time and query complexity of O(2 3n/4 ).

2. An algorithm with data, time and memory complexities O(2 2n/3 ) for any arbitrary S. In particular, for S = {0, 1} n , the best previous algorithm had a time complexity of O(2 n ).

While the first algorithm we proposed is fit to attack the CTR mode, the second algorithm allows us to do a partial key recovery attack of some Wegman-Carter-Shoup MAC schemes using polynomial hash like GMAC and Poly1305 running in time, query and memory O(2 2n/3 ). This is the first partial key recovery leading to a universal forgery on those schemes running in time less than O(2 n ).

The Algorithmic Challenge

From CTR to Missing Difference

The Counter Mode. The CTR mode for encryption (Figure 4.1) was proposed as early as 1979 by Diffie and Hellman [START_REF] Diffie | Privacy and authentication: An introduction to cryptography[END_REF]. Nowadays it is largely used notably in TLS via the popular AEAD mode GCM. We introduced the CTR mode and its matching distinguisher in Section 2.1.4.

In this Chapter, and to simplify the notations, we denote the i th block of key stream produced by a fresh nonce and the key k as a i . Thus, we have the relation c i = a i ⊕ m i . Notice that it is easy to recover the value a i when knowing the plaintext m i and the ciphertext c i .

N 0

E k a 0 m 0 c 0 m 1 c 1 E k a 1 N 1 m 2 c 2 E k a 2 N 2 m 3 c 3 • |m 3 | E k a 3 N 3
a i = E k (N i) and c i = a i ⊕ m i .
Plaintext Recovery Strategy. So we know the value a i for many i. Furthermore, we assume that a secret value S is repeatedly encrypted as b j = a j ⊕ S for many j. The distinguisher for CTR exploits the fact that the key stream never repeats which means that:

∀i = j : a i = a j ⇒ a i ⊕ a j ⊕ S = S ⇒ a i ⊕ b j = S.
Therefore, the strategy is to collect enough a i and b j , store them in lists and use the inequality a i ⊕ b j = S to recover S.

The Missing Difference Problem. Formally let us denote as A ⊆ {0, 1} n the set of observed key stream blocks a i , B ⊆ {0, 1} n the set of observed encryptions b j and S ⊆ {0, 1} n the set of possible values of the secret which models the a priori known information about S. The missing difference problem is then defined as: Definition 4.1 (Missing Difference Problem). Given two sets A and B, and a hint S, find the value S ∈ S such that:

∀(a, b) ∈ A × B, S = a ⊕ b .
Alternatively the attacker can be given access to the sets A and B though some functions f and g as in Definition 4.2. This variant allows the attacker to actively optimize the size of the sets in the same way as we defined the problem of collision with function in Section 3.1. Definition 4.2 (Missing Difference Problem with Functions). Given two functions f, g : X → {0, 1} n , and a hint S, find the value S ∈ S such that:

∀(x, y), S = f (x) ⊕ g(y) .
It is clear that solving this problem is sufficient to recover some secret data S which makes for a plaintext recovery attack. The Known-Suffix / Secret-Prefix model is adapted to collect values and build the set A and B but before we show the details of the attack we need efficient way of solving the missing difference problem.

Previous Works

Data Complexity Lower Bound. To recover the secret S, it must be completely determined by the fact that ∀(a, b) ∈ A × B, S = a ⊕ b. We can use the coupon collector's problem to estimate the number of such value we need. Concretely, the coupon collector's problem predicts that N out of N different coupons are found after N • H N N ln N uniformly random trials where H N is the N th harmonic number.

In our case there are |S| -1 values to eliminate, therefore we need to collect at least O(|S| ln |S|) differences that fall into the set S. Since we can reasonably assume that the differences a ⊕ b are uniformly distributed over {0, 1} n \S (we have to exclude S), they will fall in the set S with probability (|S| -1)/(2 n -1). Thus, the number of different a ⊕ b values |A × B| has to be in the order of Ω(2 n ln |S|).

Hence, one of the sets must be of size at least Ω(2 n/2 ln |S|) which is a lower bound on the data and time complexity for this strategy. Notice that this is quite efficient as the IND$-CPA proof of the CTR mode implies that the data complexity must be at least Ω(2 n/2 ) before a single bit of information can be leaked. [START_REF] Mcgrew | Impossible plaintext cryptanalysis and probable-plaintext collision attacks of 64-bit block cipher modes[END_REF], an obvious way to solve the missing difference problem is to compute and record all values a ⊕ b in a sieve until only one value is left. This value will thus have to be the secret S. We call it the simple sieving algorithm, Algorithm 4.1. It is efficient in terms of data with a complexity O(2 n/2 ln |S|) but takes time O(2 n ln |S|) and memory |S| to store the sieve. [START_REF] Mcgrew | Impossible plaintext cryptanalysis and probable-plaintext collision attacks of 64-bit block cipher modes[END_REF] noticed that the simple sieving is actually wasting a lot of computation by computing values that fall outside the search space S, especially when S is small.

Simple Sieving. As explained by McGrew

To solve this issue he proposed an algorithm that tests and eliminates values of S by directly looping over its values. This is the searching algorithm, Algorithm 4.2. The searching algorithm builds the set B for quick membership testing (like a hash table) and then loops over S and A values. In fact, for all s ∈ S it tests whether ∃a ∈ A such that s ⊕ a ∈ B. If it exists, then s is removed from the search space S, if it doesn't exist then s is a solution. Therefore, its time complexity is O(|B| + |A| • |S|).

In the case where the attacker freely chooses the size of the sets, like in Definition 4.2, then the time complexity is optimized when |B| = |A| • |S|. In addition, we know that |B| • |A| = Ω(2 n ln |S|) for the algorithm to be successful. Therefore, the total optimized time complexity is O(2 n/2 |S| ln(|S|)) which is also the data complexity.

This algorithm is designed to be efficient when S is small. Indeed, it is almost optimal for small |S| since its time and data complexities tend to the theoretical lower bound O(2 n/2 ).

The Known-Prefix Sieving

The Simple Sieving Algorithm 4.1 has a huge time complexity and the Searching Algorithm 4.2 is only efficient for very small S.

We present a first algorithm, the Known-Prefix Sieving, that remains optimal for relatively large searching space S given that it is included in an n/2 dimension affine space. The algorithm can easily be iterated over multiple affine subspaces to search for larger S increasing only the time but remaining optimal in data complexity. Store B so that operation ∈ is efficient.

The Algorithm

The Affine Searching Space. To apply the Known Prefix Sieving Algorithm the search space S needs to be in an affine subspace of dimension n/2 or less. Let's assume S is an nz dimension affine subspace for some n/2 ≤ z < n. Let φ be a bijective affine function mapping S unto

{0} z × {0, 1} n-z then for all n-bit values a, b: S = a ⊕ b ⇔ φ(S) = φ(a ⊕ b),
as φ is a bijection.

⇔ φ(S) = φ(a) ⊕ φ(b) ⊕ φ(0), as φ is affine
The missing difference problem is then rewritten with the transformed sets A , B , S as follows:

S := {0} z × {0, 1} n-z A := {φ(a) | a ∈ A} B := {φ(b) ⊕ φ(0) | b ∈ B}
which corresponds to the case where the secret S is known to start with z zeroes. The Known Prefix Sieving described in Algorithm 4.3 assumes that the secret S starts with z zeroes but it is indeed applicable to all affine search spaces after the above transformation.

Description. The known prefix sieving (Algorithm 4.3) solves the issue of useless computation (that is a ⊕ b falling outside S) by first looking a partial collision on z bits. Thus, the algorithm looks for all z-bit partial Algorithm 4.3 Known prefix sieving algorithm

1: input: A, B ⊂ {0, 1} n , z < n, S ⊆ {0} z × {0, 1} n-z . 2: output: {s ∈ S | ∀(a, b) ∈ A × B, a ⊕ b = s} . 3: procedure PrefixSieve(A, B, S) 4: h B ← Empty hash table. 5: for b in B do 6: h B [b [0...(z-1)] ] ∪ ← {b [z...(n-1)] } 7: 8: for a in A do 9: v a ← a [z...(n-1)] 10: for v b in h B [a [0...(z-1)] ] do 11: Remove 0 (v a ⊕ v b ) from S; 12:
return S collision between A and B and then removes the resulting XOR from the searching space. To do that it uses of a hash table indexed by the z first bits for quick access to all values that partially collide with a given element.

Notice that this gives another way of looking for collisions. Sorting the two lists and simultaneously going through them, like we saw with Algorithm 3.1, to find all partial collisions would also work with the same complexity.

Complexity Analysis

Data, Time and Memory. If there is a solution, then Algorithm 4.3 will find it.

The time complexity is the size of the lists, that is the data complexity, plus the number of collisions found. For a search space of size 2 n-z , we need about ln(2 n-z ) • 2 n-z = ln 2 • (nz) • 2 n-z collisions following the coupon collector analysis. Hence, the time complexity is

O(|A| + |B| + ln 2 • (n -z) • 2 n-z ).
Finally, the memory stores the lists of n-bit values and keeps track of the sieve so its complexity is

O(n • (|A| + |B|) + 2 n-z ).
When the sets A and B are balanced, the data complexity will be optimal and the overall complexities for S = {0} z × {0, 1} n-z are:

O √ n -z • 2 n/2 queries O 2 n-z + n √ n -z • 2 n/2 bits of memory (sieve & lists) O (n -z) • 2 n-z + √ n -z • 2 n/2 operations (collisions & lists)
as n/2 ≤ z all those complexities are O(2 n/2 ).

Iterating for larger search space. Notice that the complexity analysis given above also holds for larger S, in particular for z < n/2. However, this would lead to unnecessary use of memory. When S is larger and/or doesn't fit into an n/2 dimensional subspace the idea is to split S into multiple subspaces of smaller dimensions and look trough them with the known prefix sieving Algorithm 4.3. By doing so, the data complexity will remain optimum and the time complexity will be multiplied by the number of iterations. Concretely, for a large search space |S| = 2 s splittable into 2 s-n/2 linear subspaces of dimension n/2, the data, time and memory complexities are O( √ s2 n/2 ), O(n/2 • 2 s ) and O(n √ s2 n/2 ) respectively.

Comparisons. The known prefix algorithm thus works very well with

S in an n/2 dimensions subspace. With z = n/2 the complexities are O(2 n/2 ) while the searching Algorithm 4.2 requires O(2 3n/4 ) computations.

For small S, as small as |S| = 2, then the two algorithms perform similarly.

For large S though we mainly observe a gain in memory. In particular, when S = {0, 1} n (when we have no prior information on the secret), the known prefix sieving requires O(2 n ) time but O(2 n/2 ) data and memory while the simple sieving Algorithm 4.1 requires O(2 n ) memory for the sieve.

Lower Bound on Success Probability. In addition to this analysis in expectation we now derive a lower bound to the probability of success of the sieving when z = n/2, depending on the query complexity. So let the number of couples (a, b) be |A| • |B| =: α2 n for some α. In expectation, we should get α2 n /2 n/2 = α2 n/2 partial collisions. More precisely, the Chernoff bound gives us a lower bound for the probability of finding at least (1δ)α2 n/2 collisions:

Pr ≥ 1 - e -δ (1 -δ) (1-δ) α2 n/2
for any δ > 0.

Every partial collision is assimilated to a draw in the coupon collector problem. A formula in [START_REF] Rajeev | Randomized Algorithms[END_REF] for the tail of coupon collector problem probability distribution allows us to estimate the chance of success after obtaining β • 2 n/2 partial collisions:

Pr ≥ 1 -2 -β/ ln(2)+n/2 which is positive whenever β ≥ n/2 • ln(2).
Therefore, we bound the probability of success when collecting |A| • |B| = α2 n pairs as the probability of obtaining at least (1δ)α2 n/2 partial collisions multiplied by the probability of success after sieving (1δ)α2 n/2 values:

Pr ≥ 1 - e -δ (1 -δ) (1-δ) α2 n/2 • 1 -2 -(1-δ)•α/ ln(2)+n/2
In particular, with two lists of size n/2 • 2 n/2 (i.e. α = n/2), we get Pr ≥ 0.99 as long as n ≥ 32 (using δ = 2 -8 ). This theoretical lower bound is compared with actual simulations for n = 64 bits in Figure 4.2

Simulations

The Setting. Simulations have been run with a block size n = 64 bits, and a secret S of size n/2 = 32 bits. Encryption is done using the block cipher Tiny Encryption Algorithm (TEA [START_REF] Wheeler | TEA, a Tiny Encryption Algorithm[END_REF]) in CTR mode. We create many lists: multiple key stream outputs lists a i ∈ A, and single encryptions list b j = a j ⊕ (0 S) ∈ B. After computing and sorting a list B with 2 32 elements, we iteratively produce, sort and sieve several lists A containing 2 32 elements each, until the secret S is the only one remaining in the sieve.

Results. One simulation runs in around 20 minutes over 36 cores, as every step is trivially parallelizable: encryption, sorting and sieving. We Observed among 3700 simulations. ran 3700 simulations and tracked how many lists of 2 n/2 = 2 32 key stream outputs were needed before a single value was left in the sieve. The coupon collector problem predicts that one needs on average n/2•ln(2)•2 n/2 partial collisions which will be obtained after n/2 • ln(2) 22.18 < 23 rounds in expectation. And indeed, the simulations showed a 64.5% probability of success after 23 iterations. Figure 4.2 shows the convergence between the theoretical lower bound of Section 4.2.2 and the success probability of the simulations. We also noticed that the discrepancy in the number of rounds required is largely due to the last few candidates remaining in the sieve. If we decided that the attack is successful whenever we are left with less than 1000 potential candidates for the secret, then the algorithm would successfully finish after 16 rounds. In fact, after 16 rounds, the number of candidates left varies from 419 to 560 in all the simulations we have run.

The Fast-Convolution Sieving

In the case of arbitrary S and no prior information on S, all algorithms seen so far fail to solve the missing difference problem in time less than

O(2 n ).
In this section we show how to solve this particular case of the missing difference problem in time O(2 2n/3 ) with the fast-convolution sieving at the cost of a greater data complexity.

The Algorithm

Increasing the Data Complexity. At a high level, the idea of the algorithm is to increase the discrepancy between S and the other values. We do that by increasing the required number of draws a ⊕ b so that every value appears multiple times except for the secret S.

In fact, we only consider truncated values. Concretely, we look at the values a ⊕ b m and see which one appears the less. Hopefully the truncated values S m will appear fewer times than the other values since S is unreachable. This allows us to recover the truncated value of S, and we can recover the rest via the known prefix sieving.

Description. Concretely, for m < n bits we define a list of counters for a multi-set X as:

∀i ∈ {0, 1} m : C X [i] = x ∈ X : x m = i .
The fast-convolution sieving algorithm (Algorithm 4.6) starts by building lists of counters C A an C B for the corresponding sets A and B with t the number of truncated bits (that is m = nt). Then, the goal is to compute C A⊕B efficiently from C A and C B , where

A ⊕ B is the multi-set {a ⊕ b : (a, b) ∈ A × B}.
We observe that:

C A⊕B [i] = |{(a, b) ∈ A × B : a ⊕ b m = i}| = a∈A |{b ∈ B : a ⊕ b m = i}| = a∈A |{b ∈ B : b m = i ⊕ a m }| = a∈A C B [i ⊕ a m ] = j∈{0,1} n-t C A [j]C B [i ⊕ j]
This is a discrete convolution. In fact, this kind of convolution is efficiently computed with the Fast Walsh-Hadamard Transform (Algorithm 4.4) and this convolution is computed using in Algorithm 4.5 which works the same way we compute circular convolution using the Fast Fourier Transform.

The best guest for S m is the position of the smallest counter.

Optimisations. In order to increase the success rate of the algorithm, one can test several candidates for S m (using the lowest remaining counters), and use the known-prefix sieving to detect whether the candidate is correct.

Another option is to run multiple independent runs of the algorithm with different choices of the n/3 truncated bits. This would avoid some bad cases we have observed in simulations, where the right counter grows abnormally high and gets hidden in all the other counters.

Complexity Analysis

Data, Time and Memory. A balanced trade-off between the complexity and the success probability is achieved when m = 2n/3 (that is t = n/3). With this parameter the fast-convolution sieving requires:

O( √ n • 2 2n/3 ) queries O(n • 2 2n/3
) bits of memory (counters) O(n • 2 2n/3 ) computations (fast Walsh-Hadamard)

See the detailed proof below. Thus, each complexity is of order O(2 2n/3 ). Moreover, our simulations (Section 4.3.3) show that the constant hidden in the O notation is small: using lists of size √ n • 2 2n/3 , the lowest counter corresponds to S m in at least 70% of our experiments.

Proof of success probability. Consider, without loss of generality and for blocks of size n, that we possess |A| = |B| = α • 2 2n/3 blocks of key stream and the same number of blocks of encrypted secret S with α a function of n. So in this setting we have

|A|•|B| = α 2 •2 4n/3 different (a⊕b)
values possible between the two lists, that we consider as independent and uniformly distributed over {0, 1} n \S. Furthermore, we take t = n/3, that is, the fast-convolution algorithm considers the 2n/3 most significant bits. Using the fast convolution (Algorithm 4.5) we compute C A⊕B and we hope that the counter for S 2n/3 , the good counter, will be lower than for i = 0 to 2 m-d do 6:

for j = 0 to 2 d-1 do 7: C A [i • 2 d + j] ← C A [i • 2 d + j] + C A [i • 2 d + j + 2 d-1 ] 8: C A [i•2 d +j +2 d-1 ] ← C A [i•2 d +j]-2•C A [i•2 d +j +2 d-1 ] 9: return C A Algorithm 4.5 Fast convolution 1: input: |C A | = |C B | = 2 n-t . 2: output: C A⊕B . 3: procedure FastConvolution(C A , C B ) 4:
FWHT(C A ); FWHT(C B );

5:
for c = 0 to 2 n-t do 6:

C A⊕B [c] ← C A [c] • C B [c] 7:
FWHT(C A⊕B ); for a in A do 6:

Increment C A [ a n-t ] 7:
for b in B do 8:

Increment C B [ b n-t ] 9: C A⊕B ← FastConvolution(C A , C B ) 10: u ← argmin i C A⊕B [i] Success if S 0..(n-t-1) = u.
11:

return u ⊕ PrefixSieve(A, B ⊕ {u 0 t }, {0} n-t × {0, 1} t )
all the other counters, the bad counters. We want to find the value α such that the algorithm succeeds with probability Ω(1). Let X c i represents the fact that the i th value truncates to c, so that X c i follows a Bernoulli distribution and any counter can be written as

X c = α 2 2 4n/3 i=1 X c
i . Now we have to discriminate between the distributions of the good and bad counters:

(Good) c = S 2n/3 : Pr(X S 2n/3 i = 1) = (2 n/3 -1)/(2 n -1) =⇒ E[X S 2n/3 ] = (2 5n/3 α 2 -2 4n/3 α 2 )/(2 n -1) (Bad) c = S 2n/3 : Pr(X c i = 1) = (2 n/3 )/(2 n -1) =⇒ E[X c ] = (2 5n/3 α 2 )/(2 n -1)
Now we are interested in the probability that a bad counter gets a value above E[X S 2n/3 ] as a measure of how distinct the distributions are. Using Chernov Bound we get for all c = S 2n/3 that:

Pr(X c ≥ E[X S 2n/3 ]) = 1 -Pr(X c < E[X S 2n/3 ]) = 1 -Pr(X c < (1 -2 -n/3 )2 5n/3 α 2 /(2 n -1)) = 1 -Pr(X c < (1 -2 -n/3 )E[X c ]) ≥ 1 -e -((2 -n/3 ) 2 •2 5n/3 α 2 )/(2(2 n -1)) ≥ 1 -e -α 2 /2
And to compute the probability that no bad counter gets below E[X S 2n/3 ] we assume their independence, which is wrong, but we will come back later to discuss this assumption.

Pr(∀c = S 2n/3 : X c ≥ E[X S 2n/3 ]) = c = S 2n/3 1 -Pr(X c < E[X S 2n/3 ]) ≥ 1 -e -α 2 /2 2 2n/3 .
To conclude, we need to find an α = α(n) such that this probability remains greater than some positive value as n grows. This is clearly achieved with α = O( √ n) as for example taking α =

2 √ n √ 3•log 2 (e) 0.96 √ n
we get:

Pr(∀c = S 2n/3 : X c ≥ E[X S 2n/3 ]) ≥ (1 -e -α 2 /2 ) 2 2n/3 ≥ (1 -2 -2n/3 ) 2 2n/3 ≥ 0.25, ∀n ≥ 3/2
Therefore, we bound the probability of success by the events "X S 2n/3 < E[X S 2n/3 ]", probability 1/2, and "∀c = S 2n/3 : X c ≥ E[X S 2n/3 ]", probability at least 1/4. And we indeed have a probability of at least 1/8 of having a successful algorithm. Hence, when

|A × B| = O(n • 2 4n/3
) the algorithm has probability Ω(1) of succeeding.

Notice that when the list are balanced we have

|A| = |B| = O( √ n•2 2n/3 ) but the proof only requires that |A| • |B| = n • 2 4n/3
. This allows for a range of trade-offs for the lists size.

Regarding the independence of the counters, this is obviously wrong as they are bound by the relation c X c = α 2 2 4n/3 . However, this relation becomes looser and looser as n grows so the approximation obtained should still be correct asymptotically. Moreover, the covariances implied are negative meaning that knowing one draw is big makes the other draws smaller in expectation to compensate. Small negative covariances will make the distribution look more evenly distributed in the sense that we can't observe too many extreme events in a particular direction which is good for the success rate of the algorithm. So the assumption of independence may be a conservative one for this complexity analysis and the expected behavior closely matches the one observed in our simulations.

Simulations

Estimating Success Probability. We ran simulations for block sizes n = 12, 24, 32 and 48 bits, so that we can estimate the success probability for this algorithm. We first create two lists of same size, one of raw key stream outputs and the other of CTR encryptions of an n-bit secret S. Then, we run Algorithm 4.5 counting over m = 2n/3 bits (unless specified otherwise) to get a list of counters for each possible XOR output on those m bits. The expected behavior of the attack would be to look for a solution whose m first bits correspond to the position of the lowest counter and test this hypothesis with the known prefix sieving Algorithm 4.3. If it returns a unique value, this is S, and we are done. If it returns an empty set, we test with the position of the second lowest counter, etc. As we know the number of key candidates that would be required to recover S, we compute over many simulations an estimation of the probability of success after a given number of candidates.

Settings. For block sizes of 12 and 24 bits, we simulated a random permutation simply by shuffling a range into a list. For bigger sizes of 32 and 48 we used the lightweight cipher Simon designed by the NSA [START_REF] Beaulieu | SIMON and SPECK: Block Ciphers for the Internet of Things[END_REF] with a random key as that is one of the rare block ciphers that can act on 48-bit blocks. We could quickly gather 10 000 runs for each setting except for the heavier 48-bit blocks simulation where we gathered 756 runs. Indeed, for n = 48 bits, one simulation took us 40 minutes over 10 cores (each step is highly parallelizable), and 64 gibibytes of RAM for the counter lists.

Observations. In general, we observe in Figure 4.6 that the algorithm has a good chance of success with the first few candidates when using the suggested parameters. Moreover, the sensibility with respect to the data complexity (Figure 4.4) and to the number of bits counted over (Figure 4.5) is fairly high. These results back up our complexity analysis and are a good indication that no big constant is ignored by the O() notation.

On the speed at which the probability increases we realized that, despite the log scale on the x axis, the curves take a straight (Figure 4.3) or concave shape (Figure 4.5 4.6). That means that the probability of success with the next key candidate decreases very quickly with the number of key candidates already tested and proved wrong. For example, for n = 48 bits (Figure 4.6) over 756 trials, the right key candidate was in the 2048 lowest counters in 98.1% of the time, but the worst case found was at rank 1 313 576. These "very bad" cases push the mean rank of the right key candidate to 2287 and its sample variance to 2 336 937 008. This shows that the analysis made in Section 4.3.2 wouldn't be improved significantly if we defined the algorithm's success by the right counter being among the lowest instead of strictly the lowest one.

Application

With those new approaches to solving the missing difference problem we now describe two applications: a cryptanalysis of the CTR mode using the known prefix sieving in Section 4.4.1 and a cryptanalysis of some

Plaintext Recovery of the Counter Mode

Direct Application. There are many settings where unknown plaintext will naturally lie in some known affine subspace, and the known prefix sieving algorithm can be used directly. Chosen-Prefix Secret-Suffix. We saw in Section 2.4.2 the Beastly attack model which is a practical way to set up a plaintext recovery attack.

Concretely we show an attack on the CTR mode in the Chosen-Prefix Secret-Suffix model [START_REF] Viet | Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance[END_REF] where we can choose the length of a known head H and get the encryption of Enc(H S).

For the attack to work we need to control the way S is split among blocks. However, and unlike the direct application, we do not assume anything on S. It is fit to recover some authentication token with no apparent structure. This is truly a block splitting attack: the attacker starts with a header length so that a small chunk of the secret message is encrypted together with known information, and he recovers this secret chunk. Then, he changes the length of the header to recover a second chunk of the message, using the fact that the first chunk is now known. Eventually, the full secret is recovered iteratively.

In our case, the easiest choice is to recover chunks of n/2 bits of secret one by one, using the known-prefix sieving Algorithm 4.3 with z = n/2. We illustrate this attack in Figure 4.7, assuming a two-block secret S = S 1 S 2 S 3 S 4 , and a protocol that lets the adversary query an encryption of the secret with an arbitrary chosen prefix: 1. The attacker makes two kinds of queries

Queries Q 1 with half-block header H 1 S 1 S 2 S 3 S 4 Queries Q 2 with full-block header H 1 H 2 S 1 S 2 S 3 S 4 Reuse Q 1 with known S 1 , S 2 H 1 S 1 S 2 S 3 S 4 Reuse Q 2 with known S 1 , S 2 , S 3 H 1 H 2 S 1 S 2 S 3 S 4
• Q 1 with a known half-block header H 1 (Enc([H 1 S 1 ] [S 2 S 3 ] [S 4 ])); • Q 2 with a known full-block header H 1 H 2 (Enc([H 1 H 2 ] [S 1 S 2 ] [S 3 S 4 ])).
2. He first recovers S 1 using the known-prefix sieving with the first block of each type of query. More precisely, he uses A = {Enc(H 1 H 2 )} and B = {Enc(H 1 S 1 )}, so that the missing difference is 0 (S 1 ⊕ H 2 ).

3. When S 1 is known, he can again use known prefix sieving to recover S 2 , with the first and second blocks of Q 2 queries:

A = {Enc(H 1 H 2 )} and B = {Enc(S 1 S 2 )}, so that the missing dif- ference is (S 1 ⊕ H 1 ) (S 2 ⊕ H 2 ).
To improve the success rate of this step, he can also consider the first block of Q 1 queries as known key stream.

4. When S 2 is known, another round of known prefix sieving reveals

S 3 , for instance with A = {Enc(H 1 H 2 )} and B = {Enc(S 2 S 3 )}, the missing difference is (S 2 ⊕ H 1 ) (S 3 ⊕ H 2 ).
5. Finally, S 4 is recovered with a last round of known prefix sieving using A = {Enc(H 1 H 2 )} and B = {Enc(S 3 S 4 )}, with missing difference is (

S 3 ⊕ H 1 ) (S 4 ⊕ H 2 ).
This gives an algorithm with query complexity of O( √ n2 n/2 ) to recover repeated encryption of a secret over multiple blocks in the Chosen-Prefix Secret-Suffix model. In Section 4.2.3, we analyzed the constants in the O notation and run experiments with n = 64 using locally encrypted data.

In particular, we have a success probability higher than 80% using two lists of 5 × 2 32 queries with n = 64. Generally, we show that for n ≥ 32 the success probability of this attack is at least 99% with lists of size n/2•2 n/2 . With a one block secret, an optimal attack uses two lists of n/2 • 2 n/2 two-block queries: queries [H 1 S 1 ] [S 2 ] with a half-block header, and queries [H 1 H 2 ] [S 1 S 2 ] with a full-block header. This translates to a data complexity of 4 n/2 • 2 n/2 blocks. For comparison, an attack against the CBC mode requires on average 2 • 2 n/2 blocks of data in the ideal case. Smaller Splitting. Alternatively, an attacker could recover the secret bit by bit. This leads to a less realistic attack in practice, and we can show that the complexity is similar. For this variant, McGrew's searching algorithm could also be used instead of our known-prefix sieving algorithm (because in this scenario, we have |S| = 2). Overall, we find that the best strategy is still to split the secret and recover n/2 bits at a time: smaller chunks make the attack less practicable with no gain of complexity, while bigger ones would increase the time complexity.

Let us show the complexity of such an attack to recover a block of secret, taking into account the n steps necessary for this attack. For simplicity, we consider a setting where one query returns a block of key stream and the encryption of 0 s i with an unknown bit s i . We are interested in the query complexity for recovering n bits of secret one bit at a time; that is we need to know the first bit to ask for the second one, etc. Clearly this can be done in O(n • 2 n/2 ) queries by repeating n times the attack on one bit. However, we need fewer and fewer queries to uncover the next bit as we go forward and accumulate blocks of key stream.

Let:

U i ←The expected number of encryption of 0 s i to recover s i .

K i ←The expected number of raw key stream outputs to recover s i .

From the definition of a query, the above description and because each time we find a bit of secret we can deduce a range of key stream blocks for the next step we have the relations:

K 1 = U 1 (4.1) K i+1 = K i + U i + U i+1 for i ≥ 1 (4.2) K i • U i = 2 n (in expectation) (4.3)
We consider the following proposition:

P i : U i = 2 n/2 ( √ i - √ i -1),
and, using (4.2), when P k true for all k ≤ i we have:

K i = 2 i-1 k=1 U k + U i = 2 n/2 ( √ i + √ i -1).
Moreover, (4.1) and (4.3) imply K 1 = U 1 = 2 n/2 so P 1 is true. Now suppose P k true for all k ≤ i, let's prove it holds for P i+1 :

K i+1 • U i+1 = 2 n by (4.3) =⇒ U 2 i+1 + (K i + U i ) • U i+1 -2 n = 0 by (4.2) =⇒ U 2 i+1 + 2 n/2 • 2 √ i • U i+1 -2 n = 0 by P i =⇒ U i+1 = 2 n/2 ( √ i + 1 - √ i) as U i+1 ≥ 0 =⇒ P i+1 is true.
Now that we have a closed form for U i we can deduce the expected number of queries needed to recover n bits of secret by summing over as

n i=1 U i = 2 n/2 √ n.
Therefore, the query complexity is really O( √ n • 2 n/2 ) ignoring a constant depending on the length of a query. Notice that this complexity is the same as when sieving S as a whole showing that we don't increase the query complexity by more than a constant with this strategy.

About Rekeying. As for many modes of operation, the common wisdom to counter this kind of attacks asks for rekeying before the birthday bound, that is before 2 n/2 blocks. However, rekeying too close to the birthday bound may not be enough. For example let's consider an implementation of a CTR based mode of operation that rekeys every 2 n/2 blocks. Using the same model as previously for a one-block secret, an optimal attack uses queries [H 1 S 1 ] [S 2 ] with a half-block header, and queries [H 1 H 2 ] [S 1 S 2 ] with a full-block header, where rekeying occurs after 2 n/2-2 queries of each type. To recover S 1 , we use the known prefix sieving algorithm as previously, but we can only use relations between ciphertext blocks encrypted with the same key. In each session of 2 n/2 blocks, we consider 2 n-4 pairs of ciphertext blocks; on average there are 2 n/2-4 pairs with the correct prefix used for sieving. Since we need n/2 • 2 n/2 draws to reduce the sieve to a single element with high probability, we use 8n sessions, that is 8n • 2 n/2 blocks of data in total. The same data can be reused to recover S 2 when S 1 is known. This should be compared with the previous data complexity of 4 n/2 • 2 n/2 in the absence of rekeying. However, rekeying every 2 n/2-16 blocks makes the data complexity goes up to 2 35 n sessions or n • 2 19+n/2 blocks to recover the secret block. Notice that the security gain of rekeying is comparable with CBC where rekeying every 2 n/2-16 blocks forces an increase of the data complexity from 2 • 2 n/2 to 2 18 • 2 n/2 blocks.

The CTR Mode in Communication Protocols. The CTR mode is widely used in internet protocols, in particular as part of the GCM authenticated encryption mode [START_REF] Mcgrew | The Security and Performance of the Galois/Counter Mode (GCM) of Operation[END_REF], with the AES block cipher. For instance, Mozilla telemetry data show that more than 97% of HTTPS connections from Firefox nightly 92 use AES-GCM 2 . While attacks against modes with a 128-bit block cipher are not practical yet, it is important to limit the amount of data processed with a given key, in order to keep the probability of a successful attack negligible, following the guidelines of Luykx and Paterson [START_REF] Luykx | Limits on Authenticated Encryption Use in TLS[END_REF].

Surprisingly, there are also real protocols that use 64-bit block ciphers with the CTR mode (or variants of the CTR mode), as shown below. Attacks against those protocols would be (close to) practical, assuming a scenario where an attacker can generate the encryption of numerous messages with some fixed secret.

SSH.

Cipher-suites based on the CTR mode were added to SSHv2 in 2006 [START_REF] Bellare | The Secure Shell (SSH) Transport Layer Encryption Modes[END_REF]. In particular, 3DES-CTR is one of the recommended ciphers, but actual usage of 3DES-CTR seems to be rather low [START_REF] Albrecht | A Surfeit of SSH Cipher Suites[END_REF]. In practice, 3DES-CTR is optionally supported by the Dropbear server, but it is not implemented in OpenSSH. According to a scan of the full IPv4 space by Censys.io3 , around 7.15% of SSH servers support 3DES-CTR, but actual usage is hard to estimate because it depends on client configuration.

i E k 0 E k m i,0 c i,0 1 E k m i,1 c i,1 2 E k m i,2 c i,2
The SSH specification requires to rekey after 1 GB of data, but an attack is still possible, although the complexity increases.

3G telephony.

The main encryption algorithm in UMTS telephony is based on the 64-bit block cipher Kasumi. The mode of operation, denoted as f8, is represented in Figure 4.8. While this mode in not the CTR mode and was designed to avoid its weaknesses, our attack can be applied to the first block of ciphertext. Indeed, the first block of message i is encrypted as

c i,0 = m i,0 ⊕ E k (E k (i))
, where the value E k (E k (i)) is unique for all the messages encrypted with a given key.

There is a maximum of 2 32 messages encrypted with a given key in 3G, but this only has a small effect on the complexity of attacks.

Because of the low usage of 3DES-CTR in SSH, and the difficulty of mounting an attack against 3G telephony in practice, we did not attempt to demonstrate the attack in practice. However, the setting and complexity of our attacks are comparable to the Sweet32 attack on the CBC mode with 64-bit ciphers [START_REF] Bhargavan | On the Practical (In-)Security of 64-bit Block Ciphers: Collision Attacks on HTTP over TLS and OpenVPN[END_REF].

Partial Key Recovery of GMAC and Poly1305

Because the fast convolution algorithm requires no prior information on S, it can be adapted to other modes of operation based on CTR and particularly to Wegman-Carter-Shoup type of modes for authentication, see Section 2.2.3. Wegman-Carter-Shoup MACs use a keyed permutation E and a keyed universal hash function h, with k 1 and k 2 two private keys. The input is a message m and a nonce N , and the MAC is defined as:

MAC(N, m) = h k 1 (m) + E k 2 (N ) .
Again, the construction requires that all block cipher inputs are different. To apply our attack, we use two fixed messages m and m , and we capture many values MAC(N, m) in a list A and values MAC(N , m ) in a list B, all using unique nonces. Then, we solve the missing difference problem to recover

h k 1 (M )-h k 1 (M ) as we know that ∀N = N : E k 2 (N )-E k 2 (N ) = 0.
When the hash is a polynomial based AXU function, it is often sufficient to know this difference and the two messages m and m to recover the key k 1 . We give two examples with GMAC and Poly1305 algorithms. In addition, we show a simple forgery attack on Wegman-Carter-Shoup with a deterministic hash function applicable on the authentication part of the CWC mode of operation.

Galois/Counter Mode. GCM is an AEAD mode with associated data, combining the CTR mode for encryption and a Wegman-Carter MAC based on polynomial evaluation in a Galois field for authentication. When used with an empty message, GCM only performs authentication and it reduces to GMAC. In our attack, we use an empty message with one block of authenticated data a, so that the tag is computed as:

MAC(N, a) = a • H 2 ⊕ H ⊕ E k (N ),
with H = E k (0) the hash key and (•) the multiplication in a Galois Field defined by a public polynomial. So, for two different blocks of authenticated data a and a we collect O( √ n•2 2n/3 ) MACs and perform the fast convolution algorithm to recover a

•H 2 ⊕H ⊕a •H 2 ⊕H = (a⊕a )•H 2 .
We know a ⊕ a and the field is known, so we invert that value and recover H 2 then compute the square root and recover the hash key H.

In a concurrent work (published at the same venue) Luykx and Preneel [START_REF] Luykx | Optimal Forgeries Against Polynomial-Based MACs and GCM[END_REF] described a similar attack on GMAC in the information theoretic setting to match the best known proof [START_REF] Daniel | Stronger Security Bounds for Wegman-Carter-Shoup Authenticators[END_REF]. Their approach directly sieves out the wrong key candidates. That is for any known couple of 1-block messages m, m they solve the inequality MAC

(N, m) ⊕ MAC(N , m ) = m • H 2 ⊕ m • H 2 to eliminate a candidate of H.
The advantage of this version is that we don't need to manipulate the values to force the repetition of the authenticated messages. In particular, GCM authenticates the ciphertext which is known but isn't expected to be repeated.

On the other hand this cryptanalysis still requires O(2 n ) time and memory in the computational model making it hardly practical and it is unclear how to apply our ideas to efficiently sieve in this context. Moreover, it can't be applied to modes such as CWC unlike our approach based on the missing difference.

Comparison with other cryptanalysis of GMAC.

There are other known attacks against GCM and GMAC, but none of them seems to allow universal forgery with just 2 2n/3 blocks of data and 2 2n/3 computations. In particular, Handschuh and Preneel [START_REF] Handschuh | Key-Recovery Attacks on Universal Hash Function Based MAC Algorithms[END_REF] gave a weak-key attack, that can also be used to recover the hash key without weak key assumptions, using roughly 2 n/2 messages of 2 n/2 blocks. Later work extended these weak key properties [Saa12; PC15], but an attack still requires about 2 n blocks in total when no assumptions are made about the key. We also note that these attacks require access to a verification oracle, while our attack only uses a MAC oracle.

Other attacks use specific options of the GCM specifications to reach a lower complexity, but cannot be applied with standard-length IV, and tag: Ferguson [START_REF] Ferguson | Authentication weaknesses in GCM. Comment to NIST[END_REF] showed an attack when the tag is truncated, and Joux [START_REF] Joux | Authentication failures in NIST version of GCM[END_REF] gave an attack based on non-default IV lengths.

Poly1305. Poly1305

[Ber05b] is a MAC scheme following the Wegman-Carter-Shoup construction, using polynomial evaluation modulo the prime number 2 130 -5. It uses a keyed 128-bit permutation (usually AES), and the hash function key, r, has 106 secret bits (22 bits of the key are set to 0, including in particular the 4 most significant ones). The message blocks are first padded to 129-bit values c i . Then, the MAC of a q-block message m with nonce N is defined as: T (m, N ) = (((c 1 r q +c 2 r q-1 +...+c q r) mod 2 130 -5)+E k (N )) mod 2 128 .

With the same strategy as above, using two different messages m and m we recover the missing difference (((c 1c 1 )r q + (c 2c 2 )r q-1 + ... + (c qc q )r) mod 2 130 -5) mod 2 128 . Moreover, we chose m and m such that c ic i = 0 and c qc q = 1; since by design, r < 2 124 the value recovered is simply the hash key r.

Notice that Poly1305 doesn't use the XOR operation but a modular addition, and we have to adapt our algorithms to this case. Luckily, the fast convolution algorithm can easily be tweaked. First, we keep the 2n/3 least significant bits to avoid issues the carry, something the XOR operation doesn't have. Moreover, when the lists of counters are up, we need to compute their cyclic convolution, which is done with a fast convolution algorithm based on the fast Fourier transform (instead of fast Walsh-Hadamard). Finally, we verify the value suggested by the lowest counter by running the known prefix algorithm looking for collisions on the least significant bits and sieving the modular subtraction of the most significant bits. This adaptation has similar complexities and proofs than the one described earlier. Moreover, in the case of Poly1305, one can further adapt the algorithms to take into account the fact that 22 bits of the key r are fixed at 0 effectively reducing the dimensions of S.

Simple Forgery on CWC. The CWC mode was designed by Kohno, Viega and Whiting [START_REF] Kohno | CWC: A High-Performance Conventional Authenticated Encryption Mode[END_REF], shown in Figure 4.9. It follows the Wegman-Carter-Shoup construction with a twist: it encrypts the output of the hash function before masking it with a fresh nonce. This makes exploiting the property of the hash function to recover the key impossible. However, by solving the missing difference problem we can recover the value ∆ = E k (CWC-HASH H (a)) ⊕ E k (CWC-HASH H (a )) for fixed authenticated data a and a . This is enough to make a forgery; for a fresh nonce N get the tag MAC(N, a) then deduce the tag for a that is MAC(N, a ) = MAC(N, a) ⊕ ∆.

This attack works as soon as the hash function used is deterministic. Indeed, the forgery exploits the fact that the difference in the output of the hash remains unchanged across multiple nonces.

N 0

E k MAC E k CWC-HASH H c 2 c 1 a 2 a 1 E k N 1 m 1 E k N 2 m 2 Figure 4
.9: The CWC mode of operation for an 2-block message m 1 m 2 and authenticated data a 1 a 2 with a block cipher key k and an hash key

H = E k (11 0 * ).

Conclusion

Attacks Summary. We have given efficient algorithms for the missing difference problem in two practically relevant cases: with an arbitrary missing difference, and when the missing difference is known to be in some low-dimension vector space. These algorithms lead to a message-recovery attack against the CTR mode with complexity O(2 n/2 ), and a universal forgery attack against some Carter-Wegman MACs with complexity O(2 2n/3 ).

In particular, we show that plaintext recovery attacks against the CTR mode and the CBC mode can be mounted with roughly the same requirements and the same complexity. This goes against the folklore assumption that the security loss of the CTR mode with large amounts of data is slower than of the CBC mode.

Mitigation. Therefore, the CTR mode with 64-bit block ciphers should be considered unsafe (unless strict data limits are in place). As a countermeasure, we recommend to use larger block sizes, and to rekey well before 2 n/2 blocks of data. Concrete guidelines for 128-bit block ciphers have been given by Luykx and Paterson [START_REF] Luykx | Limits on Authenticated Encryption Use in TLS[END_REF]. Alternatively, if the use of small block is required, we suggest using a mode with provable security beyond the birthday bound, such as CENC [Iwa06; IMV16].

Introduction

In the quest for Beyond-Birthday-Bound Security many proposals for deterministic authentication schemes follow the Double-block Hash-then-Sum strategy explained in Section 5.1. They originally enjoyed a security proof up to O(2 2n/3 ) and there were no known theoretical attack faster than the generic 2 n brute-force.

Our contributions.

In this chapter we present a generic cryptanalysis for the Double-block Hash-then-Sum construction, Section 5.1.2. Then, we concretely show an attack on the authentication modes SUM-ECBC, GCM-SIV2, PMAC+, LightMAC+, 3kf9 and 1kPMAC+ in data complexity O(2 3n/4 ).

Although they were all originally shown secure up to O(2 2n/3 ) short queries, Kim, Lee and Lee [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] later proved that our cryptanalysis are actually optimal for modes SUM-ECBC, PMAC+, LightMAC+ and 3kf9 by providing a tight bound matching our attack in data complexity O(2 3n/4 ) for short queries.

Most of the attacks shown are information theoretic as they have a time complexity greater than 2 n , but we show a variant for SUM-ECBC and GCM-SIV2 that runs in data and time complexity O(2 6n/7 ).

We also show a birthday bound attack on 1kf9 [Dat+15] that was already withdrawn due to a flaw in its proof. This attack shows that the scheme actually doesn't offer beyond birthday bound security. Our generic attack also invalidates an improved proof for LightMAC+ by Naito [START_REF] Naito | Improved Security Bound of LightMAC_Plus and Its Single-Key Variant[END_REF]. 5.1: Summary of the security for studied modes and our main results. q is the number of queries, m is the maximum size of a query, σ is the total number of processed blocks. The expected lower bound and attack complexity is in number of constant length queries ( m = O(1)). We use "U" for universal forgeries, and "E" for existential forgeries.

-ECBC [Yas10] O q 4 m 3 2 3n [KLL20] Ω(2 3n/4 ) O(2 3n/4 ) O(2 3n/2 ) U O(2 6n/7 ) O(2 6n/7 ) U GCM-SIV2 [IM16] O q 3 m 2 2 2n Ω(2 2n/3 ) O(2 3n/4 ) O(2 3n/2 ) U O(2 6n/7 ) O(2 6n/7 ) U PMAC+ [Yas11] O q 4 m 2 2 3n + q m 2 2 n [KLL20] Ω(2 3n/4 ) O(2 3n/4 ) O(2 3n/2 ) E LightMAC+ [Nai17] O q 4 2 3n [KLL20] Ω(2 3n/4 ) O(2 3n/4 ) O(2 3n/2 ) E 1kPMAC+ [Dat+17] O σ 2 n + qσ 2 2 2n Ω(2 2n/3 ) O(2 3n/4 ) O(2 3n/2 ) E 3kf9 [Zha+12] O q 4 m 6 2 3n [KLL20] Ω(2 3n/4 ) O( 4 √ n • 2 3n/4 ) O(2 5n/4 ) U 1kf9 [Dat+15] O q m 2 2 n + q 3 m 4 2 2n + q 4 m 4 2 3n + q 4 m 6 2 4n Ω(2 2n/3 ) O(2 n/2 ) O(2 n/2 ) U Table

Double-block Hash-then-Sum MACs

The Challenge. We can distinguish three types of modes for authentication: deterministic, nonce-based and probabilistic. Nonce-based MACs, like Wegman-Carter MACs [START_REF] Wegman | New Hash Functions and Their Use in Authentication and Set Equality[END_REF], require to maintain a state to provide for a unique value, a nonce, and probabilistic MACs, like RMAC [START_REF] Jaulmes | On the Security of Randomized CBC-MAC Beyond the Birthday Paradox Limit: A New Construction[END_REF] and EHtM [START_REF] Minematsu | How to Thwart Birthday Attacks against MACs via Small Randomness[END_REF], require some entropy to provide for a random value, a salt. On the other hand, deterministic MACs, like CBC-MAC [FIPS113; BKR00] and its variants, are the easiest to use in practice which explains their popularity.

However, a deterministic MAC scheme with beyond-birthday-bound security is far from trivial to build. In fact, we saw in Section 3.1.2 a generic attack by Preneel and van Oorschot [START_REF] Preneel | MDx-MAC and Building Fast MACs from Hash Functions[END_REF] that works on all deterministic iterated MACs using internal state collisions. Therefore, a deterministic MAC with an n-bit state cannot reach beyond birthday-bound security.

All the proofs mentioned in this chapter deal with the prf security notion (Definition 1.3) meaning that all Double-block Hash-then-Sum MACs we introduce are secure as PRFs. Although our attacks are described as forgery attacks, they can also be seen as distinguishers in the prf security game.

Generic Design

Increasing the State Size. To bypass the limitation of iterated deterministic MACs, one has to increase the internal state size of the mode. Double-block Hash-then-Sum MACs double it from n to 2n so that the generic attack of [START_REF] Preneel | MDx-MAC and Building Fast MACs from Hash Functions[END_REF] runs in O(2 n ) complexity which is no better than a random guessing of the tag.

More precisely the internal state is divided into two n-bit parts that we denote Σ and Θ, and the final MAC is computed as:

MAC(M ) = E Σ(M ) ⊕ E Θ(M ) ,
where E and E denote a block cipher with potentially different keys. The functions Σ and Θ are typically two n-bit almost-xor universal (AXU, Definition 2.2) hash functions computed on the message, hence the name Double-block Hash-then-Sum MAC.

Yasuda [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF] was the first to propose and prove a construction following this design strategy with SUM-ECBC. The SUM-ECBC MAC came with a proof guaranteeing security up to O(2 2n/3 ) short queries which indeed is beyond the birthday bound.

A Prolific Research Topic. Following that there have been several works on the topic of building deterministic MACs secure beyond the birthday bound. Yasuda himself proposed PMAC+ [START_REF] Yasuda | A New Variant of PMAC: Beyond the Birthday Bound[END_REF] which is a BBB MAC achieving rate 1 meaning that it uses a single block cipher call per block of message while SUM-ECBC is only rate 1/2 (two block cipher calls per message block).

Later works proposed designs optimizing various aspects. We will study 3kf9 [START_REF] Zhang | 3kf9: Enhancing 3GPP-MAC beyond the Birthday Bound[END_REF] that removes the needs for Galois Field doubling, 1kPMAC+ [Dat+17] and 1kf9 [Dat+15] that only use a single secret key, LightMAC+ [Nai17] and the authentication part of GCM-SIV2 [START_REF] Iwata | Stronger Security Variants of GCM-SIV[END_REF]. All of them came with a proof of security up to O(2 2n/3 ) short queries.

Working on Better Proofs.

There has been work to unify and improve the initial proofs. Datta, Dutta, Nandi and Paul [START_REF] Datta | Double-block Hash-then-Sum: A Paradigm for Constructing BBB Secure PRF[END_REF] unified the design strategy under the Double-block Hash-then-Sum paradigm and proposed an improved proof mostly improving the security bound for long queries. In particular, the security bound for short queries was still at O(2 2n/3 ) until Kim, Lee and Lee [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] later proved that the Doubleblock Hash-then-Sum paradigm is secure up to O(2 3n/4 ) short queries. However, the bound of [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] does not always dominate the one of [START_REF] Datta | Double-block Hash-then-Sum: A Paradigm for Constructing BBB Secure PRF[END_REF] notably for long queries.

Nevertheless, the proofs are quite technical and require attention. For instance 1kf9 was withdrawn due to an issue with its proof, and we provide in Section 5.3.1 a birthday bound attack showing that the proof cannot be repaired. The original proof of 3kf9 was shown to be flawed and repaired by [START_REF] Datta | Double-block Hash-then-Sum: A Paradigm for Constructing BBB Secure PRF[END_REF]. Finally, an improved proof for LightMAC+ by Naito [START_REF] Naito | Improved Security Bound of LightMAC_Plus and Its Single-Key Variant[END_REF] showed an advantage upper-bound that should make any attack using O(2 3n/4 ) short queries and a single verification query impossible. Therefore, the existence of our attack contradicts the proof and, when contacted, the author recognized that there was a flaw in its proof.

Generic Attack

We present a generic strategy that leads to a cryptanalysis on all known Double-block Hash-then-Sum authentication modes in data complexity O(2 3n/4 ) given an iterated and deterministic construction of the hash functions.

4-way Relation.

Remember that a Double-block Hash-then-Sum MAC is composed of two n-bit AXU hash Σ(•) and Θ(•) and is computed as:

MAC(M ) = E Σ(M ) ⊕ E Θ(M ) .
Our generic strategy to mount forgery attacks consists in looking for a quadruple of messages (X, Y, Z, T ) such that pairs of values collide for one half of the state. More precisely, we look for quadruples satisfying a relation R(X, Y, Z, T ) defined as:

R(X, Y, Z, T ) :=              Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T ) Θ(T ) = Θ(X)
which directly implies that: R(X, Y, Z, T ) =⇒ MAC(X) ⊕ MAC(Y ) ⊕ MAC(Z) ⊕ MAC(T ) = 0.

(5.1) Constructing Messages. We build two-block messages using two different injection functions φ and ψ. The generic strategy consists in adding two distinct prefixes and letting the suffix free as for example:

φ(i) = 0 i ψ(i) = 1 i X = φ(x) = 0 x Y = ψ(y) = 1 y Z = φ(z) = 0 z T = ψ(t) = 1 t .
It is important to interleave the injection functions so that all pairs of messages that need to collide on a state part, that are (X, Y ), (Y, Z), (Z, T ) and (T, X) always involve both φ and ψ. Hence, a collision can occur in Σ or Θ when the second block cancels the difference induced by the first block.

Reducing the Linear System. What makes this attack possible is the fact that the messages X, Y, Z, T are constructed in such a way that the relation R is implied by a linear system of rank three. Concretely we design the attack such that:

Σ(X) = Σ(Y ) and Θ(Y ) = Θ(Z) and Σ(Z) = Σ(T ) ⇒ Θ(T ) = Θ(X).
Therefore, taken randomly, at least one quadruple out of 2 3n is expected to satisfy R Notice that 2 3n quadruples can be built with 4 • 2 3n/4 queries thus we can find a quadruple (X, Y, Z, T ) satisfying R with an O(2 3n/4 ) data complexity.

This part of the attack is the least generic in the sense that one has to look at the construction to verify that indeed good quadruples appear more often than expected. However, every MAC considered has this property.

Building a Forgery. In the very same way that the generic attack of Preneel and van Oorschot [Pv95] exploited the Collision Extension Property (Definition 3.4) we can define the 4-way Collision Extension Property as:

Definition 5.1 (4-way Collision Extension Property). We consider a MAC following the Double-block Hash-then-Sum paradigm. Let Σ(m) and Θ(m) be the two n-bit internal state after having processed m. We define the 4-way collision extension property as:

R(X, Y, Z, T ) =⇒ R(X s, Y s, Z s, T s)

for any messages X, Y, Z, T and any suffix s where:

R(X, Y, Z, T ) :=

             Σ(X) = Σ(Y ) Θ(Y ) = Θ(Z) Σ(Z) = Σ(T ) Θ(T ) = Θ(X)
Thus, with a proper quadruple (X, Y, Z, T ) satisfying R we deduce a related quadruple (X s, Y s, Z s, T s) also satisfying R. Hence, we predict that MAC(X s) = MAC(Y s) ⊕ MAC(Z s) ⊕ MAC(T s) so that asking for the tag of three of them allows us to forge a valid tag for the fourth one. This 4-way Collision Extension Property really applies when the two part Σ and Θ are independently built as deterministic iterated functions just like in the case of MACs. More precisely, when appending a block s, the value Σ(m s) (resp. Θ(m s)) must only depends on Σ(m) and s (resp. Θ(m) and s). For instance this is the case for MACs SUM-ECBC, GCM-SIV2 and PMAC+ but not for 3kf9. We thus adapt or improve our attack for every considered modes in their respective sections.

Detecting Quadruple. As we look for a good quadruple, the relation MAC(X)⊕MAC(Y )⊕MAC(Z)⊕MAC(T ) = 0 in itself is too weak because we expect one quadruple out of 2 n to satisfy it randomly. However, we can usually amplify the filtering using related quadruples that satisfy R simultaneously, for instance exploiting the 4-way collision extension, Definition 5.1. Amplifying to a 3n bit filter will be sufficient as, then, only a single quadruple is expected to satisfy it randomly.

Therefore, in most of our attacks, detecting a quadruple is done by solving an instance of the 4-XOR problem with word size w = 3n. In the optic of an information theoretic attack that matches the proof, the data complexity is the most important, if not the only important, parameter to optimize. We saw multiple algorithms for the 4-XOR problem in Section 3.2.1, but only the memory efficient algorithm [START_REF] Chose | Fast Correlation Attacks: An Algorithmic Point of View[END_REF] is suitable as it is also data efficient. Indeed, Wagner's algorithm [START_REF] Wagner | A Generalized Birthday Problem[END_REF] as well as Nikolic and Sasaki's algorithm [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] would need 2 w/3 queries or more which in our case makes for a 2 n data complexity, no better than random tag guessing. This is why our attack has a data, time and memory complexities of O(2 3n/4 ), O(2 3n/2 ) and O(2 3n/4 ) respectively. However, variants of our attack exploiting the actual structure of the MAC to get a time complexity below 2 n are possible at least for SUM-ECBC and GCM-SIV2 where we describe an attack using O(2 6n/7 ) data, time and memory.

Application to concrete MACs

In this section we go through authentication modes SUM-ECBC, GCM-SIV2, PMAC+, LightMAC+, 3kf9 and 1kPMAC+. We give details on how to apply our generic strategy of Section 5.1.2 to build a forgery attack.

m 1 E 1 m 1 E 3 m 2 E 1 m 2 E 3 m m-1 E 1 ... m m-1 E 3 ... m m E 1 m m E 3 E 2 E 4 MAC(m)

Attacking SUM-ECBC

SUM-ECBC was designed by Yasuda in 2010 [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF], inspired by MAC constructions summing two CBC-MACs in the ISO 9797-1 standard. The scheme uses a block cipher keyed with four independent keys, denoted as

E 1 , E 2 , E 3 , E 4 .
The message m is first padded with 10 * padding, and divided into n-bit blocks. In the following we ignore the padding and consider the padded message as the input: this makes our description easier, and any padded message whose last block is non-zero can be "unpadded" to generate a valid input message. The construction is defined as follows (see also Figure 5.1):

Σ(m) = σ m σ 0 = 0 σ i = E 1 (σ i-1 ⊕ m i ) Θ(m) = θ m θ 0 = 0 θ i = E 3 (θ i-1 ⊕ m i ) MAC(m) = E 2 (Σ(m)) ⊕ E 4 (Θ(m))
Mounting the Attack. Following the framework of Section 5.1.2, we consider quadruple of messages built with two message injection functions:

φ(i) = 0 i ψ(i) = 1 i
In particular, we have

MAC(φ(i)) = E 2 E 1 i ⊕ E 1 (0) Σ 0 (i) ⊕ E 4 E 3 i ⊕ E 3 (0) Θ 0 (i) MAC(ψ(i)) = E 2 E 1 i ⊕ E 1 (1) Σ 1 (i) ⊕ E 4 E 3 i ⊕ E 3 (1) Θ 1 (i)
Next, we build quadruples of messages X, Y, Z, T with

X = φ(x) Y = ψ(y) Z = φ(z) T = ψ(t),
and we look for a quadruple with partial state collisions for the underlying pairs, that is a quadruple following the relation:

R(x, y, z, t) :=              Σ 0 (x) = Σ 1 (y) Σ 0 (z) = Σ 1 (t) Θ 0 (z) = Θ 1 (y) Θ 0 (x) = Θ 1 (t). We have R(x, y, z, t) ⇔              x ⊕ E 1 (0) = y ⊕ E 1 (1) z ⊕ E 3 (0) = y ⊕ E 3 (1) z ⊕ E 1 (0) = t ⊕ E 1 (1) x ⊕ E 3 (0) = t ⊕ E 3 (1) ⇔        x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = E 1 (0) ⊕ E 1 (1) x ⊕ t = E 3 (0) ⊕ E 3 (1)
As promised in Section 5.1.2, R defines a 3n-bit relation. We can easily observe when x ⊕ y ⊕ z ⊕ t = 0, and we can also detect the relation on the sum of the MACs following Equation (5.1):

R(x, y, z, t) ⇒ MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0
Moreover, we observe that R(x, y, z, t) is satisfied if and only if R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) is satisfied for any constant c. We use this relation to build several related quadruples that satisfy R simultaneously:

R(x, y, z, t) ⇐⇒ ∀c, R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) (5.2)
This leads to an attack with O(2 3n/4 ) queries: we consider four sets X , Y, Z, T of 2 3n/4 values, and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T with:

       x ⊕ y ⊕ z ⊕ t = 0 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0 MAC(φ(x ⊕ 1)) ⊕ MAC(ψ(y ⊕ 1)) ⊕ MAC(φ(z ⊕ 1)) ⊕ MAC(ψ(t ⊕ 1)) = 0.
(5.3)

Because we need a fair distribution of values x ⊕ y and x ⊕ t to find the good quadruple, we build the sets as:

X = {x ∈ {0, 1} n : x [0:n/4] = 0} Y = {x ∈ {0, 1} n : x [n/4:n/2] = 0} Z = {x ∈ {0, 1} n : x [n/2:3n/4] = 0} T = {x ∈ {0, 1} n : x [3n/4:n] = 0}
With this construction, there is exactly one quadruple (x, y, z, t) ∈ X × Y × Z × T that satisfies R, given by:

x = v 1 |w 2 |u 3 |0 y = w 1 |v 2 |0|u 4 z = u 1 |0|v 3 |w 4 t = 0|u 2 |w 3 |v 4 ,
where:

E 1 (0) ⊕ E 1 (1) =: u 1 |u 2 |u 3 |u 4 E 3 (0) ⊕ E 3 (1) =: v 1 |v 2 |v 3 |v 4 E 1 (0) ⊕ E 1 (1) ⊕ E 3 (0) ⊕ E 3 (1) =: w 1 |w 2 |w 3 |w 4 .
We expect on average one random quadruple satisfying (5.3) (with 2 3n potential quadruples, and a 3n-bit filtering), in addition to the quadruple satisfying R. The correct quadruple can easily be checked with a few extra queries.

Concretely, we solve the generalized birthday algorithms with the memory efficient algorithm of Section 3.2.1 in order to optimize the query complexity of the attack. We consider four lists:

L 1 = {x MAC(φ(x)) MAC(φ(x ⊕ 1)) : x ∈ X } L 2 = {y MAC(ψ(y)) MAC(ψ(y ⊕ 1)) : y ∈ Y} L 3 = {z MAC(φ(z)) MAC(φ(z ⊕ 1)) : z ∈ Z} L 4 = { t MAC(ψ( t )) MAC(ψ( t ⊕ 1)) : t ∈ T }
Notice that we can build those lists with 5•2 3n/4 queries as, by construction, for any element i of Y, Z, T the element (i ⊕ 1) also belongs to Y, Z, T , respectively.

We solve the 4-XOR problem to find:

(x, y, z, t) ∈ X × Y × Z × T such that L 1 [x] ⊕ L 2 [y] ⊕ L 3 [z] ⊕ L 4 [t] = 0 with O(2 3n/2
) operations, using a memory of size O(2 3n/4 ). After finding a collision, we verify that it is not a false positive by testing the relation for another value c. As there are on average O(1) random quadruples, the attack is indeed using a total of 5 • 2 3n/4 + O(1) = O(2 3n/4 ) queries.

Universal Forgeries. This attack can be extended to a universal forgery. Indeed, the fixed prefix 0 and 1 can be replaced by v and v ⊕ 1 for any block v, and when we identify a right quadruple (x, y, z, t) we deduce the values

∆ 1 = E 1 (v) ⊕ E 1 (v ⊕ 1) and ∆ 3 = E 3 (v) ⊕ E 3 (v ⊕ 1)
. For the end of the message we can use the 4-way collision extension property (Definition 5.1) which implies that: if (x, y, z, t) is a right quadruple, then

MAC(v x s) ⊕ MAC(v ⊕ 1 y s) ⊕ MAC(v z s) ⊕ MAC(v ⊕ 1 t s) = 0 for any suffix s.
Therefore, if we want to forge a MAC for any message m of size m ≥ 2 blocks we parse it as m = v w s (where s has zero, one, or several blocks) and perform the attack to recover ∆ 1 and ∆ 3 . Then, we can forge using the previous relation, and Equation (5.2):

MAC(v w s) = MAC(v ⊕ 1 w ⊕ ∆ 1 s) ⊕ MAC(v w ⊕ ∆ 3 s) ⊕ MAC(v ⊕ 1 w ⊕ ∆ 1 ⊕ ∆ 3 s)
Optimizing the time complexity. Equation (5.2) can also be used to reduce the time complexity below 2 n , at the cost of more oracle queries. Indeed, if we consider a subset C of {0, 1} n , we have:

R(x, y, z, t) ⇔ ∀c ∈ C, R(x ⊕ c, y ⊕ c, z ⊕ c, t ⊕ c) ⇒ ∀c ∈ C, MAC(φ(x ⊕ c)) ⊕ MAC(ψ(y ⊕ c)) ⊕ MAC(φ(z ⊕ c)) ⊕ MAC(ψ(t ⊕ c)) = 0 ⇒ c∈C MAC(φ(x ⊕ c)) ⊕ c∈C MAC(ψ(y ⊕ c)) ⊕ c∈C MAC(φ(z ⊕ c)) ⊕ c∈C MAC(ψ(t ⊕ c)) = 0
(5.4)

If we select C as a linear subspace, the last expression does not depend on the full values (x, y, z, t) but only on their projection onto the space orthogonal to C. Concretely, we use C = {x : x [3n/7:n] = 0} = {x : x < 2 3n/7 }, so that the value c∈C MAC(φ(x ⊕ c)) is independent of bits 0 to 3n/7 -1 of x.

Therefore, we consider the rewritten MAC function

MAC (v w) = c∈C MAC(v w ⊕ c),
the following message injections, with a 4n/7-bit input

φ (i) = 0 i|0 ψ (i) = 1 i|0,
and a reduced relation over 4n/7-bit values:

R (x, y, z, t) :=              x ⊕ y = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] y ⊕ z = (E 3 (0) ⊕ E 3 (1)) [3n/7:n] z ⊕ t = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] t ⊕ x = (E 3 (0) ⊕ E 3 (1)) [3n/7:n] ⇔        x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = (E 1 (0) ⊕ E 1 (1)) [3n/7:n] x ⊕ t = (E 3 (0) ⊕ E 3 (1)) [3n/7:n]
Thanks to Equation 5.4, we still have:

R (x, y, z, t) =⇒ MAC (φ (x)) ⊕ MAC (ψ (y)) ⊕ MAC (φ (z)) ⊕ MAC (ψ (t)) = 0
Since the relation R is now only a 12n/7-bit condition, we can use shorter lists than before, with just 2 3n/7 elements. We can also increase the filtering using the same trick as previously, considering the following lists:

L 1 = {x MAC (φ (x)) MAC (φ (x ⊕ 1)) : x∈{0, 1} 4n/7 , x [0:n/7] = 0} L 2 = {y MAC (ψ (y)) MAC (ψ (y ⊕ 1)) : y∈{0, 1} 4n/7 , y [n/7:2n/7] = 0} L 3 = {z MAC (φ (z)) MAC (φ (z ⊕ 1)) : z∈{0, 1} 4n/7 , z [2n/7:3n/7] = 0} L 4 = { t MAC (ψ ( t )) MAC (ψ ( t ⊕ 1)) : t ∈{0, 1} 4n/7 , t [3n/7:4n/7] = 0}
Finally, using the memory efficient algorithm of Section 3.2.1 with = 3n/7 and p = 0, we can locate a right quadruple using O(2 6n/7 ) queries, O(2 6n/7 ) operations, and O(2 3n/7 ) memory. This recovers only 4n/7 bits of E 1 (0) ⊕ E 1 (1) and E 3 (0) ⊕ E 3 (1), but we can easily recover the remaining bits, either by brute force, or by repeating the attack with a different set C.

m 1 m 2 ... m m m N ... ... H 1 H 2 H 1 H 2 H 1 H 2 H 1 H 2 E 1 E 3 E 2 E 4 Σ Θ MAC 1 (m) MAC 2 (m)
Figure 5.2: Diagram for authentication in GCM-SIV2 using GHASH with a m -block message, a nonce N , hash keys H 1 and H 2 .

Attacking GCM-SIV2

GCM-SIV2 is an authenticated encryption mode designed by Iwata and Minematsu [START_REF] Iwata | Stronger Security Variants of GCM-SIV[END_REF] as a double-block hash-then-sum version of GCM-SIV (in the following, we consider GCM-SIV2 with the Galois hash, GHASH, as the underlying universal hash function). For simplicity, we focus on the authentication part of GCM-SIV2, using inputs with a non-empty associated data, and an empty message. In this case, GCM-SIV2 becomes a noncebased MAC with a 2n-bit output. The message m (considered as associated data for the mode) is zero-padded, divided into n-bit blocks, and the length is appended in an extra block. Then, the construction is defined as follows, with multiplication done in a finite field (see also Figure 5.2):

Σ(N, m) = N ⊕ m • H 1 ⊕ m i=1 m i • H m+2-i 1 Θ(N, m) = N ⊕ m • H 2 ⊕ m i=1 m i • H m+2-i 2 MAC(N, m) = E 1 (Σ(m)) ⊕ E 2 (Θ(m)) E 3 (Σ(m)) ⊕ E 4 (Θ(m))
Mounting the Attack. The structure of the authentication part of GCM-SIV2 is essentially the same as the structure of SUM-ECBC, where the block cipher calls E 1 and E 3 are replaced by multiplication by H 1 and H 2 .

The finalization function has a 2n-bit output MAC 1 , MAC 2 , but quadruples following R will collide on both outputs. Thus, we can essentially repeat the SUM-ECBC attack, but there is an important difference: GCM-SIV2 is a nonce-based MAC, rather than a deterministic one. Therefore, all queries must include a nonce N , and we should not query two different messages with the same nonce. We adapt the previous attack using message injection functions that output both a nonce and a message, so that we use two fixed messages, 0 and 1, with variable nonces:

φ(i) = (i, 0) ψ(i) = (i, 1) MAC(φ(i)) = MAC(i, 0) = E 1 i ⊕ H 1 Σ 0 (i) ⊕ E 2 i ⊕ H 2 Θ 0 (i) E 3 Σ 0 (i) ⊕ E 4 Θ 0 (i) MAC(ψ(i)) = MAC(i, 1) = E 1 i ⊕ H 1 ⊕ H 2 1 Σ 1 (i) ⊕ E 2 i ⊕ H 2 ⊕ H 2 2 Θ 1 (i) E 3 Σ 1 (i) ⊕ E 4 Θ 1 (i) .
We consider quadruples of nonce/messages X, Y, Z, T with

X = φ(x) Y = ψ(y) Z = φ(z) T = ψ(t)
, and we have the same kind of relations as in the previous attack:

R(x, y, z, t) :=

             Σ 0 (x) = Σ 1 (y) Σ 0 (z) = Σ 1 (t) Θ 0 (z) = Θ 1 (y) Θ 0 (x) = Θ 1 (t). ⇔        x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = H 2 1 x ⊕ t = H 2 2 =⇒ MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0 .
Since the MAC output is 2n-bit long, we can directly build an attack with O(2 3n/4 ) queries: we consider four distinct sets X , Y, Z, T of 2 3n/4 values, and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T , such that

x ⊕ y ⊕ z ⊕ t = 0 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0
(5.5)

we expect to find one good quadruple that respects R along with O(1) quadruples that randomly satisfy the observable filter (5.5). This leads to an attack with O(2 3n/4 ) queries and time O(2 3n/2 ). Since we recover H 1 and H 2 (from H 2 1 = x ⊕ y and H 2 2 = x ⊕ t), we can do universal forgeries. In addition, we can also easily adapt the attack with O(2 6n/7 ) queries and time O(2 6n/7 ).

m 1 2 • ∆ 0 2 2 • ∆ 1 E 1 E 1 0 0 2 m-1 m 2 2 2 • ∆ 0 2 4 • ∆ 1 E 1 E 2 2 m-2 ... ... ... m m 2 m • ∆ 0 2 2 m • ∆ 1 E 1 E m 2 0 E 2 E 3 Σ Θ MAC(m)

Attacking PMAC+

PMAC+ was designed by Yasuda in 2011 [START_REF] Yasuda | A New Variant of PMAC: Beyond the Birthday Bound[END_REF] based on PMAC [START_REF] Black | A Block-Cipher Mode of Operation for Parallelizable Message Authentication[END_REF] but with a larger internal state. The scheme internally uses a tweakable block cipher construction inspired by the XE construction [START_REF] Rogaway | Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC[END_REF], that we denote as E i . The attack works independently of the construction, meaning that it works even if E i is a true tweakable block cipher. The message m is first padded with 10 * padding, and divided into n-bit blocks, but for simplicity we ignore the padding in our description. The construction is shown in Figure 5.3 1 :

Σ(m) = m i=1 E i (m i ) E i (x) = E 1 (x ⊕ 2 i ∆ 0 ⊕ 2 2i ∆ 1 ) Θ(m) = m i=1 2 m-i E i (m i ) ∆ 0 = E 1 (0) ∆ 1 = E 1 (1) MAC(M ) = E 2 (Σ(m)) ⊕ E 3 (Θ(m))
1 The algorithm and the figure given in [START_REF] Yasuda | A New Variant of PMAC: Beyond the Birthday Bound[END_REF] differ in the coefficients used to compute Θ. We use the algorithmic description because it matches later PMAC+ variants, but the attack can easily be adapted to the other case.

Mounting the Attack. As in the previous attack, we use message injection functions with two different prefixes, but we include an extra block u to define related quadruples:

φ u (i) = u 0 i ψ u (i) = u 1 i MAC(φ u (i)) = MAC(u 0 i) = E 2 E 1 (u) ⊕ E 2 (0) ⊕ E 3 (i) Σ u,0 (i) ⊕ E 3 4 E 1 (u) ⊕ 2 E 2 (0) ⊕ E 3 (i) Θ u,0 (i) MAC(ψ u (i)) = MAC(u 1 i) = E 2 E 1 (u) ⊕ E 2 (1) ⊕ E 3 (i) Σ u,1 (i) ⊕ E 3 4 E 1 (u) ⊕ 2 E 2 (1) ⊕ E 3 (i) Θ u,1 (i)
.

Next, we build quadruples of messages X, Y, Z, T with

X = φ u (x) Y = ψ u (y) Z = φ u (z) T = ψ u (t),
and we look for a quadruple with partial state collisions for the underlying pairs, that is a quadruple following the relation:

R(x, y, z, t) :=              Σ u,0 (x) = Σ u,1 (y) Σ u,0 (z) = Σ u,1 (t) Θ u,0 (z) = Θ u,1 (y) Θ u,0 (x) = Θ u,1 (t). We have R(x, y, z, t) ⇔              E 3 (x) ⊕ E 2 (0) = E 3 (y) ⊕ E 2 (1) E 3 (z) ⊕ E 2 (0) = E 3 (t) ⊕ E 2 (1) E 3 (y) ⊕ 2 E 2 (1) = E 3 (z) ⊕ 2 E 2 (0) E 3 (t) ⊕ 2 E 2 (1) = E 3 (x) ⊕ 2 E 2 (0) ⇔        E 3 (x) ⊕ E 3 (y) ⊕ E 3 (z) ⊕ E 3 (t) = 0 E 3 (x) ⊕ E 3 (y) = E 2 (0) ⊕ E 2 (1) E 3 (t) ⊕ E 3 (x) = 2 E 2 (0) ⊕ 2 E 2 (1)
Again, R defines a 3n-bit relation, and we can detect it through the sum of the MACs following Equation (5.1): R(x, y, z, t) ⇒ MAC(φ u (x))⊕MAC(ψ u (y))⊕MAC(φ u (z))⊕MAC(ψ u (t)) = 0

In addition, the relation R is independent of the value u, so that we can easily build several quadruples that satisfy R simultaneously. This leads to an attack with O(2 3n/4 ) queries: we consider four sets X , Y, Z, T of 2 3n/4 random values, and we look for a quadruple (x, y, z, t) ∈ X × Y × Z × T , such that

∀u ∈ {0, 1, 2}, MAC(φ u (x)) ⊕ MAC(ψ u (y)) ⊕ MAC(φ u (z)) ⊕ MAC(ψ u (t)) = 0 .
We expect on average one random quadruple (with 2 3n potential quadruples, and a 3n-bit filtering), and one quadruple satisfying R (also a 3n-bit condition). The correct quadruple can easily be checked with a few extra queries.

In practice, we use the memory efficient algorithm of Section 3.2.1 in order to optimize the complexity of the attack. We consider four lists:

L 1 = {MAC(φ 0 (x)) MAC(φ 1 (x)) MAC(φ 2 (x)) : x ∈ X } L 2 = {MAC(ψ 0 (y)) MAC(ψ 1 (y)) MAC(ψ 2 (y)) : y ∈ Y} L 3 = {MAC(φ 0 (z)) MAC(φ 1 (z)) MAC(φ 2 (z)) : z ∈ Z} L 4 = {MAC(ψ 0 ( t )) MAC(ψ 1 ( t )) MAC(ψ 2 ( t )) : t ∈ T }
and we look for a quadruple (x, y, z, t)

∈ X × Y × Z × T such that L 1 [x] ⊕ L 2 [y]⊕L 3 [z]⊕L 4 [t] = 0.
This can be done with O(2 3n/2 ) operations, using a memory of size O(2 3n/4 ). Finally, once a quadruple (x, y, z, t) satisfying R(x, y, z, t) has been detected, it can be used to generate forgeries. Indeed, we can predict the MAC of a new message by making three new queries using Equation (5.1):

∀u, MAC(φ u (x)) = MAC(ψ u (y)) ⊕ MAC(ψ u (z)) ⊕ MAC(φ u (t))
Time-Query Trade-offs. As opposed to the SUM-ECBC attack, we don't have an analogue to Equation (5.2) that can be used to reduce the time complexity. However, the time complexity of the algorithm can be slightly reduced when using more than O(2 3n/4 ) queries. If we consider sets X , Y, Z, T of size 2 with 3n/4 < < n, the resulting 4-XOR is slightly easier, because there are 2 4t-3n expected solutions. Using the memory efficient algorithm, this can be solved in time O(2 3n-2 ), using a memory of size O(2 ).

1 (1) z |0 E 1 0 0 2 m-1 E 1 0|m 2 (2) z |0 E 1 2 m-2 E 2 ... ... ... 0|m m ( m ) z |0 E 1 E m E 2 E 3 Σ Θ MAC(m)

Attacking LightMAC+

LightMAC+ was designed by Naito [START_REF] Naito | Blockcipher-Based MACs: Beyond the Birthday Bound Without Message Length[END_REF] using ideas from PMAC+ and LightMAC. If we consider LightMAC+ as based on a tweakable block cipher E, it follows the same structure as PMAC+ (see Figure 5.4), but E takes a message block smaller than n bits:

Σ(m) = m i=1 E i (m i ) E i (x) = E 1 (i|x) Θ(m) = m i=1 2 m-i E i (m i ) MAC(m) = E 2 (Σ(m)) ⊕ E 3 (Θ(m))
Mounting the Attack. Since our attack on PMAC+ is independent of the way the tweakable block cipher is built, the same attack will be applicable to LightMAC+. The only difference from our point of view is that the message blocks are shorter than the block-size. As long as one message block is big enough to fit 2 3n/4 different values, our attack will succeed. This attack violates an improved security proof by Naito [START_REF] Naito | Improved Security Bound of LightMAC_Plus and Its Single-Key Variant[END_REF], with a security bound of O(q 2 t q v /2 2n ) (with q t MAC queries and q v verification queries). Indeed, our attack reaches a constant success probability with q t = O(2 3n/4 ) and q v = 1. We have shared our attack with the author of the proof, and he agreed that his proof was flawed.

m 1 E 1 m 2 E 1 m m-1 E 1 ... ... m m E 1 E 3 E 2 Σ Θ MAC(m)

Attacking 3kf9

Our third attack is applicable to 3kf9 [Zha+12] and similar constructions. We have a universal forgery attack with O(2 3n/4 ) queries and O(2 5n/4 ) operations using memory O(2 n ), with a possible time-memory trade-off.

3kf9 [START_REF] Zhang | 3kf9: Enhancing 3GPP-MAC beyond the Birthday Bound[END_REF], designed by Xhang, Wu, Sui and Wang, is a three-key variant of the f9 mode used in 3G telephony. While the original f9 does not have security beyond the birthday bound [START_REF] Lars | Analysis of 3gpp-MAC and two-key 3gpp-MAC[END_REF], 3kf9 is secure up to 2 3n/4 queries [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF]. We describe 3kf9 in Figure 5.5:

Σ(m) = σ m σ 0 = 0 σ i = E 1 (σ i-1 ⊕ m i ) Θ(m) = m i=1 σ i MAC(m) = E 2 (Σ(m)) ⊕ E 3 (Θ(m))
Mounting the Attack. Our attack follows the same structure as the previous attacks. We start with messages of the form:

φ(i) = 0 i ψ(i) = 1 i,
and the corresponding MACs:

MAC(φ(i)) = E 2 E 1 x ⊕ E 1 (0) Σ 0 (x) ⊕ E 3 E 1 x ⊕ E 1 (0) ⊕ E 1 0 Θ 0 (x) MAC(ψ(i)) = E 2 E 1 x ⊕ E 1 (1) Σ 1 (x) ⊕ E 3 E 1 x ⊕ E 1 (1) ⊕ E 1 1 Θ 1 (x)
.

We use quadruples of messages X, Y, Z, T with

X = φ(x) Y = ψ(y) Z = φ(z) T = ψ(t),
and we look for a quadruple with partial state collisions for the underlying pairs, that is a quadruple following the relation:

R(x, y, z, t) :=              Σ 0 (x) = Σ 1 (y) Σ 0 (z) = Σ 1 (t) Θ 0 (z) = Θ 1 (y) Θ 0 (x) = Θ 1 (t). ⇔              x ⊕ E 1 (0) = y ⊕ E 1 (1) z ⊕ E 1 (0) = t ⊕ E 1 (1) E 1 (z ⊕ E 1 (0)) ⊕ E 1 (0) = E 1 (y ⊕ E 1 (1)) ⊕ E 1 (1) E 1 (x ⊕ E 1 (0)) ⊕ E 1 (0) = E 1 (t ⊕ E 1 (1)) ⊕ E 1 (1) ⇔        x ⊕ y ⊕ z ⊕ t = 0 x ⊕ y = E 1 (0) ⊕ E 1 (1) E 1 (x ⊕ E 1 (0)) ⊕ E 1 (t ⊕ E 1 (1)) = E 1 (0) ⊕ E 1 (1) =⇒ MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0.
As in the previous attacks, R defines a 3n-bit relation. Moreover, we can easily observe when x⊕y ⊕z ⊕t = 0, and the relation x⊕y = E 1 (0)⊕E 1 (1) can be verified across several quadruples. We don't have related quadruples satisfying R simultaneously as in the previous attacks, but we can use those properties to detect right quadruples. This leads to an attack with O(2 3n/4 ) queries: we consider four sets X , Y, Z, T of 4

√ n × 2 3n/4 random values, and we look for quadruples (x, y, z, t) ∈ X × Y × Z × T , such that:

x ⊕ y ⊕ z ⊕ t = 0 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0. (5.6)
Since this is a 2n-bit condition, we expect on average n • 2 n quadruples (x, y, z, t) satisfying (5.6). In order to filter out the right ones, we look at the value x ⊕ y for all these quadruples. While the wrong quadruples should have a random x ⊕ y, the right ones have x ⊕ y = E 1 (0) ⊕ E 1 (1). Therefore, with high probability, the most frequent value for x ⊕ y is equal to E 1 (0) ⊕ E 1 (1), and quadruples satisfying this extra relation are right quadruples with probability 1 /2. More precisely, we expect on average n wrong quadruples for each value of x ⊕ y, and n right quadruples with

x ⊕ y = E 1 (0) ⊕ E 1 (1).
Success Probability. We want to prove the claim that one will need O(n • 2 n ) quadruples in order to find a right quadruple for 3kf9. We say the attack finishes when we recover the target value T = E(0) ⊕ E(1).

Assuming each quadruple found respects R with probability 1/2 n , we fill a list of counters with every suspected values of T ; a random quadruples gives two random values and a right one gives one value equal to T and one random value. Therefore, we sum up the distribution of an observable value v as:

v    $ ←-{0, 1} n with probability 1 -1/2 n+1 ←-T with probability 1/2 n+1
Let N be the number of observed values, and X c i represents the indicator that the i th value equals c (following a Bernoulli distribution), so that the counter corresponding to c is X c = N i=1 X c i . Now we have to discriminate between the distributions of X c with c = T , and the distribution of X T :

Pr(X T i = 1) = Pr(x = T ) = (1 -1/2 n+1 )/2 n + 1/2 n+1 = (3/2 -1/2 n+1 )/2 n =⇒ E[X T ] = N (3/2 -1/2 n+1 )/2 n Pr(X c i = 1) = Pr(x = c) = (1 -1/2 n+1 )/2 n =⇒ E[X c ] = N (1 -1/2 n+1 )/2 n =⇒ E[X T ] ≥ 3/2 • E[X c ]
We use the Chernoff bound to get a lower bound on the probability that a given counter is higher than the average value of X T :

Pr(X c ≥ E[X T ]) ≤ P r(X c ≥ 3/2 • E[X c ]) ≤ e -N (1-1/2 n+1 )/2 n+1
and assuming the counters are independent:

P r(X c < E[X T ]) ≥ 1 -e -N (1-1/2 n+1 )/2 n+1 P r(∀c = T : X c < E[X T ]) ≥ (1 -e -N (1-1/2 n+1 )/2 n+1 ) 2 n
This expression will asymptotically converge to a strictly positive constant when e -N (1-1/2 n+1 )/2 n+1 = Θ2 -n . Therefore, we use

N n ln(2) • 2 n+1 (1 -1/2 n+1 ) = O(n • 2 n ).
Since we observe 2 values per quadruples, this makes O(n • 2 n ) quadruples. Moreover, the event 'X T ≥ E[X T ]' has a probability close to 0.5, therefore after O(n • 2 n ) quadruples, we indeed have a Ω(1) probability that X T is greater than all the other counters, which allows to recover the value T . Performing the attack with probability Ω(1) thus requires O(n • 2 n ) quadruples.

To get to this result some assumptions have been made, like the independence of the counters, but they all tend to be either conservative or asymptotically true.

Optimizing the time complexity. While the memory efficient algorithm of Section 3.2.1 would take time O(2 3n/2 ) with O(2 3n/4 ) queries, we can reduce the time complexity using sets X , Y, Z, T with some structure. More precisely, we use:

X = Z = x ∈ {0, 1} n : x [0:n/4] = 0 Y = T = x ∈ {0, 1} n : x [n/4:n/2] = 0
so that quadruples can be written as

x =: x 3 |x 2 |x 1 |0 ∈ X y =: y 3 |y 2 |0|y 0 ∈ Y z =: z 3 |z 2 |z 1 |0 ∈ Z t =: t 3 |t 2 |0|t 0 ∈ T .
In particular, right quadruples satisfy x ⊕ y ⊕ z ⊕ t = 0, therefore x 1 = z 1 , y 0 = t 0 , and x 3 |x 2 ⊕ z 3 |z 2 = y 3 |y 2 ⊕ t 3 |t 2 . We use these properties to adapt the 4-XOR algorithm and locate the quadruples efficiently. First, we guess the n/2-bit value α 3 |α 2 := x 3 |x 2 ⊕ z 3 |z 2 = y 3 |y 2 ⊕ t 3 t 3 . Then, for each

x = x 3 |x 2 |x 1 |0, there is a single candidate z = (x 3 ⊕ α 3 )|(x 2 ⊕ α 2 )|x 1 |0
that could be part of a right quadruple. Similarly, every y = y 3 |y 2 |0|y 0 can be paired with a single t = (y 3 ⊕ α 3 )|(y 2 ⊕ α 2 )|0|y 0 . Therefore, we consider the two following lists:

L 1 := {MAC(φ(x 3 |x 2 |x 1 |0)) ⊕ MAC((x 3 ⊕ α 3 )|(x 2 ⊕ α 2 )|x 1 |0) : x 3 |x 2 |x 1 |0 ∈ X } L 2 := {MAC(φ(y 3 |y 2 |0|y 0 )) ⊕ MAC((y 3 ⊕ α 3 )|(y 2 ⊕ α 2 )|0|y 0 ) : y 3 |y 2 |0|y 0 ∈ Y}
After sorting the lists, we look for matches, and the corresponding quadruples x, y, z, t are exactly the quadruples satisfying

       x ⊕ y ⊕ z ⊕ t = 0 (x ⊕ z) [n/2:n] = α 3 |α 2 MAC(φ(x)) ⊕ MAC(ψ(y)) ⊕ MAC(φ(z)) ⊕ MAC(ψ(t)) = 0.
(5.7)

More precisely, a match

L 1 [x] = L 2 [y] suggests z = x ⊕ α 3 |α 2 |0|0 and t = y ⊕ α 3 |α 2 |0|0
, but there are four corresponding quadruples: (x, y, z, t), (z, y, x, t), (x, t, z, y), (z, t, x, y), and two candidate values for E 1 (0)⊕E 1 (1):

x ⊕ y and x ⊕ y ⊕ α 3 |α 2 |0|0. We need O(2 3n/4 ) operations to generate those quadruples. We repeat this 2 n/2 times to exhaust all n/2-bit values α 3 |α 2 and generate all quadruples satisfying (5.6). Finally, we use an array to count the number of occurrences of each possible value of x ⊕ y. Each counter receives on average two values, but the counter corresponding to E 1 (0) ⊕ E 1 (1) will receive three values on average. After repeating all the operations O(n) times, with some arbitrary constants in place of the zero bits, the highest counter corresponds to E 1 (0) ⊕ E 1 (1) with high probability, as we'll detail later. This gives an attack with O(2 3n/4 ) queries, O(2 5n/4 ) operations, and O(2 n ) memory 2 . Time-Memory Trade-offs. We can reduce the memory usage if we store only a subset of the counters, and repeat the whole algorithm until the whole set has been covered. Concretely, we store only the counters with a fixed value for bits [0 : n/8] and [n/4 : 3n/8] of x ⊕ y. Because of the way the lists L 1 and L 2 are constructed, we have actually fixed n/8 bits of y 0 and x 1 , and we can reduce the lists to size 2 5n/8 . Therefore, we evaluate 2 3n/4 counters in time O(2 n/2 • 2 5n/8 ), using only O(2 3n/4 ) memory. We repeat iteratively over the full counter set, so we need time

O(2 n/4 • 2 n/2 • 2 5n/8 ) = O(2 11n/8
). Generally, we have a time-memory trade-off with time O(2 5n/4+t/2 ) and memory O(2 n-t ) for 0 < t < n/4.

Forgeries. Once we found a quadruple (x, y, z, t) that respects the relation R(x, y, z, t), we know that after processing the messages φ(x) = 0 x and ψ(t) = 1 t there is no difference in the Θ part of the states (Θ 0 (x) = Θ 1 (t)). Moreover, we have

Θ 0 (x) = Σ 0 (x) ⊕ E 1 (0) and Θ 1 (t) = Σ 1 (x) ⊕ E 1 (1); this implies that there is a difference E 1 (0) ⊕ E 1 (1) = x ⊕ y
in the Σ part of the state. Therefore, we can build a full state collision with message 0 x 0 and 1 t x ⊕ y. In particular, the following relation can be used to create forgeries with an arbitrary message m (of any length):

MAC(0 x 0 m) = MAC(1 t x ⊕ y m).
Universal Forgeries. We can even forge the tag of an arbitrary message of length at least (2n + 2) blocks with complexity only n + 1 times the complexity of the simple forgery attack. The technique is more advanced and inspired by the multi-collision attack described by Joux [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF] (see Section 7.2.1). For ease of notation we'll show how to forge the signature for a message starting with 2n + 2 blocks of zero, but this can be trivially adapted for any message.

First, we find a quadruple (x 1 , y 1 , z 1 , t 1 ) as before. Then, we consider messages 0 0 and 1 x 1 ⊕ y 1 . Since x 1 ⊕ y 1 = E 1 (0) ⊕ E 1 (1), we have Σ(0 0) = Σ(1 x 1 ⊕ y 1 ), as the Σ part of the state collides. Moreover, we know the difference in the Θ part:

Θ(0 0) ⊕ Θ(1 x 1 ⊕ y 1 ) = x 1 ⊕ y 1 .
Generally, at step i we use message injection functions to look for a quadruple of messages

φ i (x) = 0 0 . . . 0 ×2(i-1) 0 x ψ i (x) = 0 0 . . . 0 ×2(i-1) 1 x, 0 E m 1 E m m-1 E ... ... m m E Σ Θ 2 fix 0 fix 1 E E MAC (
X i = φ i (x i ) Y i = ψ i (y i ) Z i = φ i (z i ) T i = ψ i (t i ).
When a right quadruple (x i , y i , z i , t i ) has been identified, we can deduce that the MACs for 0 0 . . . 0 0 0 and 0 0 . . . 0 1 x i ⊕ y i will match on the Σ branch and differ by x i ⊕ y i in their Θ branch.

After several iterations, we have actually built a multi-collision: all the messages h 1 h 2 . . . h n h n+1 with h i ∈ {(1 x i ⊕ y i ), (0 0)} collide on the Σ branch. In addition, we also know the difference in the Θ branch for those messages: it is equal to {i : h i =0 0} (x i ⊕ y i ).

After at most n + 1 steps, we can find a nonempty subset I ⊆ [1 : n + 1] such that i∈I (x i ⊕y i ) = 0 by simple linear algebra3 . This gives a collision on the full state, using messages m 0 = 0 0 . . . 0 (with 2(n + 1) blocks) and h = h 1 h 2 . . . h n h n+1 with h i = 1 x i ⊕ y i if i ∈ I, h i = 0 0 otherwise. Since the full state collides, we have for any message m (of any length):

MAC(h m) = MAC(m 0 m).

Attacking and Breaking 1kf9

1kf9 is a tentative to build a single keyed version of 3kf9. It uses fix b function that fixes the least significant bit to b and leave the rest untouched.

This ensures domain separation, that is for all message m we have Σ(m) = Θ(m). We describe 1kf9 in Figure 5.6:

Σ(m) = fix 0 (2 • σ m ) σ 0 = E(0) σ i = E(σ i-1 ⊕ m i ) Θ(m) = fix 1 (2 • m i=0 σ i ) MAC(m) = E(Σ(m)) ⊕ E(Θ(m))
However, 1kf9 was withdrawn to do a mistake in the proof leaving its true security as an open question. The attack on 3kf9 we describe in Section 5.2.5 is applicable but one can do better here. In fact, we answer the open question of 3kf9 security by showing a birthday-bound attack. This mode thus fails to guarantee security beyond the birthday bound despite its double-block hash-then-sum approach.

Attack on 1kf9. In order to mount a birthday bound attack on 1kf9, we use pairs of messages instead of quadruples. More precisely, instead of looking for a quadruple with pairwise collisions in Σ and Θ, we look for a pair of message X, Y colliding on Σ , and with a difference in Θ that will be absorbed by the fix 1 function. Therefore, we define the relation R as:

R(X, Y ) := Σ (X) = Σ (Y ) 2Θ (X) = 2Θ (Y ) ⊕ 1
⇒ MAC(X) = MAC(Y ). We build the messages with different postfixes, parametrized by u:

X = φ u (x) = x u Y = ψ u (y) = y u ⊕ d,
where d is the inverse of 2 in the finite field. With this construction, we have

Σ (φ u (x)) = E u ⊕ E(x ⊕ E(0)) Θ (φ u (x)) = E u ⊕ E(x ⊕ E(0)) ⊕ E x ⊕ E(0) ⊕ E 0 Σ (ψ u (y)) = E u ⊕ d ⊕ E(y ⊕ E(0)) Θ (ψ u (y)) = E u ⊕ d ⊕ E(y ⊕ E(0)) ⊕ E y ⊕ E(0) ⊕ E 0
In particular, we observe

E(x ⊕ E(0)) ⊕ E(y ⊕ E(0)) = d ⇔ Σ (φ u (x)) = Σ (ψ u (y)) ⇒ Θ (φ u (x)) ⊕ Θ (ψ u (y)) = d ⇒ MAC(φ u (x)) = MAC(ψ u (y)). (5.8)
From this observation, we construct a birthday attack against 1kf9. We build two lists:

L 0 = MAC(φ 0 (x)) : x < 2 n/2 L 1 = MAC(ψ 0 (y)) : y < 2 n/2 ,
and we look for a match between the lists. We expect on average one pair to match randomly, and one pair to match because of (5.8). Moreover, when we have a collision candidate

L 0 [x], L 1 [y],
we can verify whether it is a right pair by comparing MAC(x 1) and MAC(y d ⊕ 1). Therefore, we find a pair satisfying R(X, Y ) with complexity 2 n/2 , and this leads to simple forgeries using (5.8). This contradicts the security proof of 1kf9 given in [START_REF] Datta | Building Single-Key Beyond Birthday Bound Message Authentication Code[END_REF]. Note that this attack is still valid if we use different multiplications for the two branches in the finalization function.

Attacking 1kPMAC+

The 1kPMAC+ mode also uses the fix b function that fixes the least significant bit to b and leave the rest untouched. 1kPMAC+ is essentially a single-key variant of PMAC+, as shown in Figure 5.7.

Σ (m) = m i=1 E i (m i ) Σ(m) = fix 0 (Σ (m)) Θ (m) = m i=1 2 m+1-i E i (m i ) Θ(m) = fix 1 (Θ (m)) MAC(m) = E(Σ(m)) ⊕ E(Θ(m))
Mounting the Attack. Since the fix functions used in the finalization have collisions, we can build a variant of the attacks from Section 5.2.3 using differences in Σ and/or Θ that are absorbed by the fix functions. More precisely, we use the following relation R on quadruple of messages: We can find quadruple of messages satisfying R using a single message injection function:

R(X, Y, Z, T ) :=              Σ (X) = Σ(Y ) ⊕ 1 Θ (Y ) = Θ(Z) ⊕ 1 Σ (Z) = Σ(T ) ⊕ 1 Θ (T ) = Θ(X) ⊕ 1 ⇒ MAC(X) ⊕ MAC(Y ) ⊕ MAC(Z) ⊕ MAC(T ) = 0. m 1 ∆ 1 ∆ 2 E E 1 0 0 2 m m 2 2 • ∆ 1 2 2 • ∆ 2 E E 2 2 m-1 ... ... ... m m 2 m-1 • ∆ 1 2 2 m-2 • ∆ 2 E E m 2 fix 0 fix 1 E E Σ Θ Σ Θ MAC(m)
φ u (i) = u i X = φ u (x) = u x Y = φ u (y) = u y Z = φ u (z) = u z T = φ u (t) = u t Indeed, we have MAC(φ u (i)) = E fix0 E 1 (u) ⊕ E 2 (x) Σ u (i) ⊕ E fix1 4 E 1 (u) ⊕ 2 E 2 (x) Θ u (i)
We observe that:

R(x, y, z, t) ⇔              E 2 (x) = E 2 (y) ⊕ 1 E 2 (z) = E 2 (t) ⊕ 1 2 E 2 (x) = 2 E 2 (z) ⊕ 1 2 E 2 (y) = 2 E 2 (t) ⊕ 1 ⇔        E 2 (x) ⊕ E 2 (y) ⊕ E 2 (z) ⊕ E 2 (t) = 0 E 2 (x) = E 2 (y) ⊕ 1 E 2 (x) = E 2 (z) ⊕ d
Therefore, R defines a 3n-bit relation that is independent of the value u. This can be used for attacks in the same way as in the previous sections, using a single list

L = MAC(φ 0 (x)) MAC(φ 1 (x)) MAC(φ 2 (x)) : x < 2 3n/4
We can find a quadruple of four distinct values (x, y, z, t)

such that L[x] ⊕ L[y] ⊕ L[z] ⊕ L[t] = 0 with O(2 3n/2
) operations, using a memory of size O(2 3n/4 ), and this easily leads to forgeries.

Conclusion

Proof is hard

Flawed proof. We saw that the recent proof of [START_REF] Naito | Improved Security Bound of LightMAC_Plus and Its Single-Key Variant[END_REF] for LightMAC+ was directly invalidated by our attack.

Here we show how the security of withdrawn mode 1kf9 (Figure 5.6) is actually capped at O(2 n/2 ) by giving a birthday bound attack. The proof was already known to be wrong, but this cryptanalysis shows that it is not possible to fix in order to get beyond-birthday-bound security.

Open Questions

Cryptanalysis and Proofs. The cryptanalysis techniques introduced in this chapter show how to attack Double-block Hash-then-Sum MACs in O(2 3n/4 ) short queries. In particular, we show that this attack applies to SUM-ECBC, the authentication part of GCM-SIV2, PMAC+, LightMAC+, 1kPMAC+ and 3kf9.

After the publication of this result, new proofs [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] for the Doubleblock Hash-then-Sum construction showed that the attack is actually optimal in terms of short queries for SUM-ECBC, PMAC+, LightMAC+ and 3kf9. This is a great example of why we need to work on both better proofs and better cryptanalysis to better understand the security of certain modes of operation.

This leaves a gap for modes GCM-SIV2 and 1kPMAC+. For instance the proof cannot be directly applied to 1kPMAC+ due to the relation between the two parts of the internal state. For GCM-SIV2 the issue is the relation between the two n-bit parts of the MAC, but we note that the proof of [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] at least applies to both n-bit parts taken independently.

Other Attacks. Information theoretically, our attack shows that the bound of [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] is optimal in terms of the number of queries. However, in the proof, the length of the queries is also an important parameter. An open question is to ask whether there are attacks exploiting long queries to further reduce the total number of queries and, by doing so, eventually match the best bound implied by the proof either given by [START_REF] Datta | Double-block Hash-then-Sum: A Paradigm for Constructing BBB Secure PRF[END_REF] or [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF].

We also reduce the time complexity in the cases of SUM-ECBC and GCM-SIV2. However, there remain modes where we don't have an attack with a time complexity below 2 n . Further optimizing the attacks in terms of time and memory complexities while keeping a data complexity below 2 n is left as an open question.

Introduction

A secure authenticated encryption mode of operation is expected to provide both authenticity and confidentiality of the message which corresponds to the EUF (Section 2.2.1) and IND$-CPA (Section 2.1.1) security notions respectively. In Section 2.4.3 we've argued that there are subtle differences between achieving these notions in the random IV, nonce and deterministic model. Indeed, all are somehow equivalent as long as one respects the requirements of the model, but the fewer requirements the easiest it is to implement correctly and, thus, we say the mode is more robust. There are also advanced security notions aiming for a better robustness, and we've introduced the security under release of unverified plaintext or RUP security.

In this Chapter we'll show how the deterministic authenticated encryption mode SUNDAE [START_REF] Banik | SUNDAE: Small Universal Deterministic Authenticated Encryption for the Internet of Things[END_REF] can be made more robust with only a slight, inexpensive modification. We'll see that the new construction MONDAE achieves authenticity and confidentiality in the RUP setting (INT-RUP and PA1 respectively). To do that, we introduce the AERUP security notion that is equivalent to the combination AE, PA1 and INT-RUP. Much like AE is equivalent to EUF-AE and IND$-CPA-AE combined, the AERUP notion will allow us to prove both conventional and RUP security within a single proof.

In fact, we prove the AERUP security of a generic mode ANYDAE and give two instantiations: MONDAE, that is SUNDAE with a twist, and TUESDAE, that optimizes the rate. The AERUP security of MONDAE and TUESDAE are directly implied by the one of ANYDAE.

RUP (In)Security of SUNDAE

RUP Security Notions

We've touched briefly on security under release of unverified plaintext in Section 2.4.3. Here we formally define the PA and the INT-RUP security notions first introduced by Andreeva et al. [And+14].

The concept applies to the context of authenticated encryption and it introduces a leakage function acting as a decryption oracle, Dec k , in addition to the usual encryption oracle AEnc k and verification oracle V k . Informally, the function Dec k outputs the decryption of the ciphertext without checking its validity (so it never outputs ⊥). Therefore, it has the same interface as V k even though the associated data or the tag may be ignored depending on the mode. Plaintext Awareness. To prove security under plaintext awareness we define a distinguishing game between the real and ideal worlds with two oracles. In the real world, the attacker has access to the authenticated encryption AEnc k (•) which takes a message as input and to the decryption oracle Dec k (•, •) which takes a tag and ciphertext as inputs and outputs the resulting plaintext regardless of the validity of the tag. In the ideal world, the attacker has still access to AEnc k (•) and the decryption oracle is replaced by a simulator Sim(•, •). The mode is said to be PA secure if there exists a simulator that is undistinguishable from the decryption oracle. This simulator cannot query AEnc k (•) nor does he know the key. In other words the simulator could have been run by the adversary himself (with an independent source of randomness). This effectively captures the fact that future encryptions are not impacted by the adversary having access to a decryption oracle.

Concretely, the advantage of an adversary A for PA security of an authenticated encryption mode is defined as:

Adv PA • (A) = Pr(A AEnc k (•),Dec k (•,•) → 1) -Pr(A AEnc k (•),Sim(•,•) → 1) (6.1)
with randomness of k, Sim and A. Then, the PA security is the maximum advantage over all A using the best efficient simulator that is

Adv PA • = min Sim max A Adv PA • (A) .
In particular, the description of the simulator is left to the prover so that if he can upper-bound the advantage with a particular simulator, then this upper-bound is valid for the best efficient simulator. Depending on the power of the simulator there are two distinct PA notions. If the simulator can record the attacker queries to AEnc(•) and their outputs, we call this PA1; if it can't, we call this PA2. In this work we will mostly use the PA1 notion.

Authenticity under RUP. Similarly, having access to a decryption oracle shouldn't compromise the authenticity of the messages. The INT-RUP security notion is similar to the existential unforgeability (EUF) notion but with a stronger adversary that can decrypt any ciphertext.

In the INT-RUP security game the adversary must do a forgery while having access to AEnc k , Dec k and the usual verification oracle V k :

Adv INT-RUP • (A) = Pr(A AEnc k (•),Dec k (•,•),V k (•,•) forges) (6.2)
with the randomness of k and A. The definition of forgery remains the same: V k has to output for a (c, T ) pairs that was not the result of an earlier query to AEnc k (•) (in the presence of associated data, it means that there is no m such that (c, T ) was the result of an earlier (a, m) query).

RUP Attack on SUNDAE

SUNDAE (Figure 6.1) is a lightweight authenticated encryption mode of operation proposed by Banik et al. [START_REF] Banik | SUNDAE: Small Universal Deterministic Authenticated Encryption for the Internet of Things[END_REF] with provable and tight birthday bound security.

It is a combination of a variant of CBC-MAC, close to mode GCBC1 [Nan09], for the authentication and the OFB mode for the encryption. SUNDAE combines them in a synthetic IV manner meaning that the tag produced is also used as an IV for encryption with the OFB mode. Hence, it is a deterministic AE mode secure up to O(2 n/2 ) processed data which is tight since both the authentication and the encryption parts allow for an attack at birthday bound.

It has multiple good features making it fit for lightweight encryption. Indeed, SUNDAE is deterministic (no stateful counter nor source of randomness needed), it has an n-bit internal state and only uses a single secret key, and it computes the block cipher in the forward direction exclusively. Galois Field multiplications are limited to doubling which is fast. In the case of static associated data, SUNDAE doesn't necessarily reprocess them every time: one can remember the internal state value after processing the associated data and directly start from that point for future messages. A diagram and a formal algorithmic description of SUNDAE are given in Figure 6.1 and Algorithm 6.1 respectively where the padding function pad n (•) is an optional 10 * padding to n-bit as:

pad n (X) = X 10 n-|X|-1 , if |X| < n X , otherwise
Although this mode is quite recent, it has been chosen as an AEAD mode for multiple submissions to the NIST Lightweight Cryptography Standardization Process including SIV-Rijndael256 [START_REF] Bao | SIV-Rijndael256 Authenticated Encryption and Hash Family. Submission to NIST Lightweight Cryptography Standardization Process[END_REF], SIV-TEM-PHOTON [START_REF] Bao | SIV-TEM-PHOTON Authenticated Encryption and Hash Family. Submission to NIST Lightweight Cryptography Standardization Process[END_REF], ESTATE [Cha+19a], SUNDAE-GIFT [START_REF] Banik | SUNDAE-GIFT v1.0. Submission to NIST Lightweight Cryptography Standardization Process[END_REF], and TRIFLE [START_REF] Datta | Submission to NIST Lightweight Cryptography Standardization Process[END_REF].

On the other hand, the authors of SUNDAE [START_REF] Banik | SUNDAE: Small Universal Deterministic Authenticated Encryption for the Internet of Things[END_REF] claim that the mode "provides maximal robustness to a lack of proper randomness or secure state" while at the same time warning that "unverified plaintext from the decryption algorithm should not be released". This is somewhat contradictory as RUP security notions actually deal with robustness to a lack of secure state. Moreover, the synthetic IV construction of SUNDAE clearly forces the receiver to decrypt the message before verifying the validity of the tag as shown in Algorithm 6.1. This is what motivates our analysis of its security under release of unverified plaintext, especially in the context of lightweight cryptography. Algorithm MAC(a, m) Adv INT-RUP SUNDAE (A) = 1 where A makes 1 encryption query, 3 decryption queries and 1 verification query. The proof is simply the description of the attack.

110 n-2 E k a 1 E k a 2 pad |a 2 | < n ? 2 : 4 E k m 1 E k m 2 pad |m 2 | < n ? 2 : 4 E k MAC E k c 1 m 1 E k • |m 2
1. b 1 ← |a| > 0 ? 1 : 0 2. b 2 ← |m| > 0 ? 1 : 0 3. T ← E k (b 1 b 2 0 n-2 ) 4. if |a| > 0 then 5. a 1 a 2 . . . a a n ← --a 6. for i = 1 to a -1 7. T ← E k (T ⊕ a i ) 8. X ← |a a | < n ? 2 : 4 9. T ← E k X • T ⊕ pad n (a a ) 10. if |m| > 0 then 11. m 1 m 2 . . . m m n ← --m 12. for i = 1 to m -1 13. T ← E k (T ⊕ m i ) 14. X ← |m m | < n ? 2 : 4 15. T ← E k X • T ⊕ pad n (m m ) 16. return T AEnc k (a, m): 1. T ← MAC(a, m) 2. c ← OFB(T, m) 3. return (T, c) Dec k (a, c, T ): 1. m ← OFB(T, c) 2. return m V k (a, c, T ): 1. m ← OFB(T, c) 2. T ← MAC(a, m) 3. return T ? = T ? : ⊥ Algorithm OFB(T, m) 1. m 1 m 2 . . . m m n ← --m 2. Z 0 ← T 3. for i = 1 to m 4. Z i ← E k (Z i-1 ) 5. c i ← Z i |m i | ⊕ m i 6.
Proof. We show a simple universal forgery attack for arbitrary associated data a = a 1 a 2 . . . a a and message m = m 1 m 2 . . . m m with a ≥ 2 and m ≥ 1 where ε is the empty string:

1. Dec k (ε, T 1 , c 1 1 ) with T 1 = 110 n-2 . Get m 1 1 ; 2. Dec k (ε, T 2 , c 2 1 ) with T 2 = m 1 1 ⊕ c 1 1 ⊕ a 1 . Get m 2 1 ; 3. Dec k (ε, T 3 , c 3 1 ) with T 3 = m 1 1 ⊕ c 1 1 ⊕ a 1 for some a 1 = a 1 . Get m 3 1 ; 4. Let ∆ := m 2 1 ⊕ c 2 1 ⊕ m 3 1 ⊕ c 3 1 ; 5. AEnc k (a 1 a 2 ⊕ ∆ a 3 • • • a a , m).
Get the tag T and ciphertext c; 6. V k (a, c, T ) is a valid forgery for the data a and message m.

In the attack, c 1 1 , c 2 1 , and c 3 1 may take any n-bit value. This attack exploits the fact that a Dec k query is a direct query to the underlying block cipher E k . The tag generation process of SUNDAE can be reconstructed step by step by an attacker. In the first step we recover the value

E k (110 n-2 ) = m 1 1 ⊕ c 1 1 .
The second and third queries are necessary to compute ∆ which is the internal state difference after the second block cipher call between processing a 1 and a 1 . Therefore, processing a 1 a 2 ⊕ ∆ or processing a 1 a 2 will result in the same internal state meaning that this is a full internal state collision. Hence, the following states and outputs will be the same whenever the rest of the processed data and message are equal leading to an easy forgery.

The strategy is easily adapted when the target a or m is empty: simply adapt to the proper starting value b 1 b 2 0 n-2 instead of 110 n-2 and perform the same trick with the first two processed blocks. The case of a single block of data or message is also trivial: fully simulate the tag generation process with only 2 Dec k queries. This universal forgery attack is not in contradiction with the security claims of SUNDAE but the lack of security under the release of unverified plaintext is something to be aware of especially when using it in constrained environment.

RUP Security of ANYDAE

We showed in Section 6.1.2 that SUNDAE is not INT-RUP secure. In this section we show the condition that actually makes the mode more robust. The resulting generic mode is called ANYDAE. This preserves the lightweightness as well as the integrity and confidentiality security guarantees. We first introduce the AERUP security notion that ANYDAE satisfies. Then, we detail the generically defined ANYDAE mode of operation and two of its variants: MONDAE that only marginally differs from SUNDAE and TUESDAE that optimizes the rate of the mode. The proof of ANYDAE is done using a security game for the new notion of AERUP security that we define as: Definition 6.1 (AERUP advantage). Let Sim be a simulator. The AERUP security of an authenticated encryption scheme against an adversary A is third oracle), and an IND$-CPA-AE adversary A 3 with the same query complexity that is capable of simulating the simulator (as the simulator is efficient) and the ⊥ oracle. Then:

AERUP Generalized Notion of Security

A AEnc k (•) Dec k (•, •) V k (•, •) A $(•) Sim(•, •) ⊥(•, •) Real World Ideal World
Adv PA1 • (A 1 ) =Pr(A AEnc k (•),Dec k (•,•) 1 → 1) -Pr(A AEnc k (•),Sim(•,•) 1 → 1) = Pr(A AEnc k (•),Dec k (•,•),V k (•,•) 2 → 1) -Pr(A AEnc k (•),Sim(•,•),⊥(•,•) 2 → 1) = Pr(A AEnc k (•),Dec k (•,•),V k (•,•) 2 → 1) -Pr(A $(•),Sim(•,•),⊥(•,•) 2 → 1) + Pr(A $(•),Sim(•,•),⊥(•,•) 2 → 1) -Pr(A AEnc k (•),Sim(•,•),⊥(•,•) 2 → 1) = Adv AERUP • (A 2 ) + Pr(A $(•) 3 → 1) -Pr(A AEnc k (•) 3 → 1) Adv PA1 • (A 1 ) =Adv AERUP • (A 2 ) + Adv IND$-CPA-AE • (A 3 ) Notice that Adv IND$-CPA-AE • ≤ Adv AE • ≤ Adv AERUP • therefore we've indeed proven that Adv PA1 • ≤ 2Adv AERUP •
meaning that breaking PA1 breaks AERUP with a significant advantage up to a factor 2.

Here we show that breaking INT-RUP breaks AERUP or, equivalently:

Adv INT-RUP • ≤ Adv AERUP •
Indeed, for any INT-RUP adversary A 1 there exists an AERUP adversary A 2 with the same complexity such that Adv INT-RUP

• (A 1 ) = Adv AERUP • (A 2 ).
A 2 runs A 1 answering all its queries with its corresponding oracles as both games have the same interface. If the verification oracle answers something else than ⊥ then A 1 has forged and A 2 answers 1; otherwise it answers 0. The probability of A 1 forging is thus the probability of A 2 outputting 1. In the ideal world, both probability are thus 0. In the real world, both probability are the INT-RUP advantage of A 1 . Therefore, we have Adv INT

-RUP • (A 1 ) = Adv AERUP • (A 2 ).
Finally we show that breaking AERUP breaks either INT-RUP, PA1 or AE or, equivalently:

Adv AERUP • ≤ Adv INT-RUP • + Adv PA1 • + Adv AE • In fact, we show that Adv AERUP • ≤ Adv INT-RUP • +Adv PA1 • +Adv IND$ -CPA-AE •
which implies what we wish to prove as

Adv IND$ -CPA-AE • ≤ Adv AE
• . Indeed, for any AERUP adversary A 1 with some efficient simulator Sim we define an INT-RUP adversary A 2 with the same query complexity that runs A 1 and forwards its queries with its corresponding oracles hoping to forge that way. Moreover, we define a PA1 adversary A 3 that runs A 1 and forwards its queries to its first and second oracle while simulating the third oracle as a ⊥ oracle; then it also forwards the output. Finally, we have an IND$-CPA-AE adversary A 4 that runs A 1 and forwards its queries to its first oracle while simulating the second and third oracles as the efficient simulator Sim and the ⊥ oracle respectively; then it also forwards the output. Following this, we have:

Adv AERUP • (A 1 ) =Pr(A AEnc k (•),Dec k (•,•),V k (•,•) 1 → 1) -Pr(A $(•),Sim(•,•),⊥(•,•) 1 → 1) Adv AERUP • (A 1 ) =Pr(A AEnc k (•),Dec k (•,•),V k 1 → 1) -Pr(A AEnc k (•),Dec k (•,•),⊥(•,•) 1 → 1) + Pr(A AEnc k (•),Dec k (•,•),⊥(•,•) 1 → 1) -Pr(A AEnc k (•),Sim(•,•),⊥(•,•) 1 → 1) + Pr(A AEnc k (•),Sim(•,•),⊥(•,•) 1 → 1) -Pr(A $(•),Sim(•,•),⊥(•,•) 1 → 1) Adv AERUP • (A 1 ) ≤Pr(A AEnc k (•),Dec k (•,•),V k (•,•) 2 forges) + Pr(A AEnc k (•),Dec k (•,•) 3 → 1) -Pr(A AEnc k (•),Sim(•,•) 3 → 1) + Pr(A AEnc k (•) 4 → 1) -Pr(A $(•) 4 → 1) Adv AERUP • (A 1 ) ≤Adv INT-RUP • (A 2 ) + Adv PA1 • (A 3 ) + Adv IND$ -CPA-AE • (A 4 )
Comparison with other security notions. We've just seen that the AERUP security notion is equivalent to the combination of INT-RUP, PA1 and AE security. In the literature there has been a few other notions summarizing a robust security definition.

For instance, Hoang et al. [START_REF] Viet | Robust Authenticated-Encryption AEZ and the Problem That It Solves[END_REF] introduced the notion of robust authenticated encryption, RAE security. RAE deals with the nonce misuse case by introducing a parameter limiting the number of nonce reuse allowed. It also generalizes the authenticity goal of an authenticated encryption scheme with a ciphertext expansion parameter λ instead of a separate tag. Moreover, they also considered security under decryption leakage with the RAE sim security notion. The simulator for RAE sim has no access to the query history of the attacker therefore it is stronger than the PA1 notion. AERUP can be seen as a variant of RAE sim where the simulator records the interactions with the encryption oracle. In particular, RAE sim security implies AERUP security but is not equivalent.

Another example is the alternative notion of RUP security, RUPAE, by Ashur et al. [START_REF] Ashur | Boosting Authenticated Encryption Robustness with Minimal Modifications[END_REF]. RUPAE combines the PA1 and INT-RUP notions for nonce-based schemes and imposes that the ideal model decryption oracle is simply a random function. For comparison, AERUP is not relying on a nonce, but the simulator cannot be reduced to a random function.

RAE sim and RUPAE are therefore stronger notions than AERUP. However, the goal of the AERUP security notion is not to describe a more robust security notion. Indeed, we showed that it is equivalent to the combination of already known security notions and thus cannot be stronger. On the other hand, the AERUP security game will allow us to prove the security of ANYDAE in a single go while stronger security notions wouldn't be a fit. Ultimately, concise and short proofs increase the trust we have in them.

ANYDAE Mode of Operation

Remember that the INT-RUP attack on SUNDAE (Section 6.1.2) directly query the block cipher through the decryption oracle to reconstruct the internal state in the authentication part. There are various solutions to counter this problem by adjusting the way the tag T is generated or the way T is used to generate the key stream.

Solutions like masking or transforming T through a block cipher are undesirable: it would increase the state size (for the mask) or implementation size (to make use of the block cipher inverse). So we rather focus on the way the tag is used to generate the key stream. ANYDAE is a generalized construction solving this issue and just concrete enough to allow for an AERUP security proof to be made. Specification. ANYDAE is, just like SUNDAE, an AEAD scheme built on top of a block cipher E and parametrized by a single key k. In addition, it uses a formatting function Fmt to parse the data and mixing functions ρ 1 , ρ 2 , ρ 3 to process the state. Concretely, let T be a (possibly empty) finite set. Then Fmt : {0, 1} * → ({0, 1} n ) × T -1 for any > 0 is a formatting function that takes an arbitrarily long bit string and generates a sequence of n-bit blocks along with a sequence of elements of T of the same length minus one. Furthermore, the domain of the three state processing functions are:

E k ρ 1 δ 1 b 2 b 1 E k ρ 1 δ 2 b 3 E k ρ 1 δ 3 ... b E k T T ρ 2 E k m 1 c 1 ρ 3 E k m 2 c 2 ... ρ 3 E k • |m m | m m c m
ρ 1 : {0, 1} n × T → {0, 1} n , ρ 2 : {0, 1} n → {0, 1} n , ρ 3 : {0, 1} n → {0, 1} n .
ANYDAE is defined as in the diagram of Figure 6.3 and its oracles are formally described in Algorithm 6.2. By construction, it has many similarities with SUNDAE namely it has an n-bit state, is length preserving and only requires a single key.

Before we state the security of ANYDAE, we remind the definition of almost XOR-universal (AXU) and almost uniform functions: Definition 6.2. Let > 0, n ∈ N and a function ρ : {0, 1} n × T → {0, 1} n for a non-empty set T .

• ρ(X, t) is said to be -almost uniform if for any t ∈ T and any

Y ∈ {0, 1} n , Pr X $ ← --{0, 1} n : ρ(X, t) = Y ≤ .
Algorithm 6.2 Authenticated Encryption, Decryption and Verification algorithms for ANYDAE oracles.

Algorithm MAC(a, m)

1. b 1 . . . b , δ 1 . . . δ -1 ← Fmt(a, m) 2. X 1 ← b 1 3. for i = 1 to -1 4. Y i ← E k (X i ) 5. X i+1 ← ρ 1 (Y i , δ i ) ⊕ b i+1 6. T ← E k (X ) 7. return T AEnc k (a, m) 1. T ← MAC(a, m) 2. c ← OFB(T, m) 3. return (T, c) Algorithm OFB(T, m) 1. m 1 . . . m m n ← --m 2. U 1 ← ρ 2 (T ) 3. for i = 1 to m 4. V i ← E k (U i ) 5. c i ← V i |m i | ⊕ m i 6. U i+1 ← ρ 3 (V i ) 7. return c 1 . . . c m Dec k (a, c, T ) 1. m ← OFB(T, c) 2. return m V k (a, c, T ) 1. m ← OFB(T, c) 2. T ← MAC(a, m) 3. return T ? = T ? : ⊥ • ρ(X,
← --{0, 1} n × {0, 1} n : ρ(X, t) ⊕ ρ(X , t ) = Y ) ≤ .
Then, the AERUP security of ANYDAE is stated in Theorem 6.1: 2. ρ 1 is 1 -AXU and γ 1 -uniform;

Theorem
3. ρ 2 is γ 2 -uniform; 4. ρ 3 is γ 3 -uniform; 5. |F 1 ∩ Im(ρ 2 )| = 0 and |F 1 ∩ Im(ρ 3 )| = Ω, then Adv AERUP ANYDAE (σ, q v , t) ≤ Adv PRP E (σ, t ) + σ 2 1 2 n + max{ 1 , γ 1 , γ 2 , γ 3 } + Ωσ • γ 3 + q v 2 n ,
against adversaries limited to σ total block cipher calls, q v verification queries and running in time t and t ≈ t respectively.

The proof details are given in Section 6.3.

1 For Fmt, prefix-freeness means that for any two elements

MONDAE and TUESDAE Mode of Operation

By choosing the parameters of ANYDAE, we propose two AERUP secure modes: MONDAE and TUESDAE.

The MONDAE Robust Authenticated Encryption. With MONDAE we propose a minimal fix of SUNDAE to achieve AERUP security. The formatting function and processing functions ρ 1 and ρ 3 are kept as in SUNDAE, the only difference is to introduce the fix 1 as ρ 2 . Concretely, in MONDAE ρ 2 fixes the least significant bit to 1 and leave the rest untouched. This ensures that one cannot reconstruct the internal state of the authentication part as the starting value is always set to 0 (control bits are the most significant ones). Furthermore, MONDAE is a specific instantiation of ANYDAE with:

ρ 1 (S, X) = X • S , ρ 2 (S) = fix 1 (S) = S n-1 1 , ρ 3 (S) = S ,
and the formatting function of SUNDAE described in Algorithm 6.3. The AERUP security of MONDAE is a direct corollary of the security statement of ANYDAE, Theorem 6.1. We simply have to note that 1 = γ 1 = γ 3 = 1/2 n , γ 2 = 2/2 n , and Ω = 4 (since F 1 = {0 n , 10 n-1 , 010 n-2 , 110 n-2 } and Im(ρ 3 ) = {0, 1} n ). Hence: Corollary 6.2 (AERUP security of MONDAE). Let be the authenticated encryption scheme MONDAE based on a block cipher E. Then

Adv AERUP MONDAE (σ, q v , t) ≤ Adv PRP E (σ, t ) + 1.5σ 2 2 n + 2.5σ 2 n + q v 2 n ,
against adversaries limited to σ total block cipher calls, q v verification queries and running in time t and t ≈ t respectively.

The TUESDAE Mode of Operation. The goal of TUESDAE is to optimize the functions of ANYDAE so that the number of block cipher calls becomes optimal for most inputs. Indeed, for a blocks of associated data and m block of message with a + m > 1 then one encryption using TUESDAE use exactly a + 2 m block cipher calls. Moreover, when ( a , m ) is (1, 0) or (0, 1) and the total length is less than n -4 bits then TUESDAE requires a single block cipher call for authentication (and another to encrypt in the latter case). Notice that, as we need to distinguish between the cases of associated data and message, and between full and partial block, it is Function Fmt(a, m)

110 n-2 E k a 1 E k a 2 pad |a 2 | < n ? 2 : 4 E k m 1 E k m 2 pad |m 2 | < n ? 2 : 4 E k MAC fix 1 E k c 1 m 1 E k • |m 2
1. r 1 ← |a| > 0 ? 1 : 0 2. r 2 ← |m| > 0 ? 1 : 0 3. ← a + m + 1 4. b 1 ← r 1 r 2 0 n-2 5. for i = 2 to a 6. δ i-1 ← 1 7. b i ← a i-1 8. δ a ← |a a | < n ? 2 : 4 9. b a+1 ← δ a • pad n (a a ) 10. for i = 2 to m 11. δ a+i-1 ← 1 12. b a+i ← m i-1 13. δ -1 ← |m m | < n ? 2 : 4 14. b ← δ -1 • pad n (m m ) 15. return b 1 . . . b , δ 1 . . . δ -1
impossible for any ANYDAE instantiation to have a single block cipher call for a single full data block. Also, the choice of ρ 1 requires that n -1 be a prime number therefore it is most well suited to be built on n = 128-bit block cipher.

TUESDAE is an instantiation of ANYDAE with the formatting function Fmt of Algorithm 6.4 and:

ρ 1 (S, X) = S 1 ( S n-1 ≫ X) , ρ 2 (S) = fix 10 (S) , ρ 3 (S) = fix 10 (S) ,
where X ∈ {0, 1} 5 , ≫ is the circular shift function and fix 10 is the fix function that puts the two least significant bits to 10 and leaves the rest untouched.

It is easy to verify that TUESDAE's Fmt is prefix-free: the three rightmost bits of b 1 are 000 in case A, 100 in case B, and * * 1 in cases C, D, and E. For the last three cases, difference is in δ 1 : it equals * 011 * for case C, either of {00 * 0 * , 01 * * * , 100 * * } for case D, and either of {1010 * , 110 * * , 111 * * , 0001 * } for case E. Here, for case E, distinction is made using

empty i final D[i+1] full D[i+1] .
Moreover, in every case b 1 2 = 10 which directly implies that F 1 ∩ Im(ρ 3 )| = 0, and the almost XOR-universal property of ρ 1 was shown by Contini and Yin [START_REF] Contini | On Differential Properties of Data-Dependent Rotations and Their Use in MARch and RC[END_REF] who proved that if |S| is prime and t ≤ |S|, S ≫ t is (2 |S|-1 ) -1 -AXU. Therefore, the security of TUESDAE is a corollary of the security of ANYDAE (Theorem 6.1) with 1 = γ 2 = γ 3 = 4/2 n whenever n -1 is prime, γ 1 = 1/2 n , and Ω = 0. Corollary 6.3 (AERUP security of TUESDAE). Let be the authenticated encryption scheme TUESDAE based on an n-bit block cipher E with n -1 prime. Then

Adv AERUP TUESDAE (σ, q v , t) ≤ Adv PRP E (σ, t ) + 2.5σ 2 2 n + q v 2 n ,
against adversaries limited to σ total block cipher calls, q v verification queries and running in time t and t ≈ t respectively.

This result only applies when n -1 is prime, but the choice of ρ 1 is not absolute; any good almost XOR-universal function will suit. In particular, Corollary 6.3 holds for popular n = 128-bit block ciphers such as the AES. Notice that using a smaller block cipher is not recommended anyway due to the inherent birthday-bound security of the ANYDAE construction. Algorithm 6.4 The formatting function Fmt of TUESDAE where δ i ∈ {0, 1} 5 with control bits type, that indicates whether the current block is associated data (type = 0) or message (type = 1), full, that indicates whether X is n-bit (full X = 1) or less (full X = 0), and final, that indicates whether X is the last of its type (final X = 1) or not (final X = 0). bin( ) i is the binary encoding of the integer on i bits. pad n is an optional 10 * padding.

Function Fmt(a, m)

1. D n ← --a m 2. if a = m = 0 then 3. b 1 ← 0 n 4. return b 1 Case A 5. if a + m = 1 and |D| ≤ n -5 then 6. b 1 ← pad n-4 (D 1 ) type 100 7. return b 1 Case B 8. b 1 ← fix 1 (pad n (D 1 )) 9. r ← pad n (D 1 ) 1 10. if a + m = 1 and |D| ≥ n -4 then 11. δ 1 ← full D1 011 r 12. b 2 ← 0 * type 010 13. return (b 1 b 2 , δ 1 ) Case C 14. if a + m = 2 then 15. δ 1 ← bin( a ) 2 full m m full a a r 16. b 2 ← pad n (D 2 ) 17. return (b 1 b 2 , δ 1 ) Case D 18. if a + m > 2 then 19. if a < 3 then 20. δ 1 ← bin( a + 5) 3 full a a r 21. else 22. δ 1 ← 0001 b 23. ← a + m 24. for i = 2 to 25. b i ← pad n (D i ) 26. for i = 2 to -1 27. δ[i] ← 00 empty i final D i+1 full D i+1 28. return (b 1 . . . b , δ 1 . . . δ -1 )

Case E

Proving AERUP Security of ANYDAE

In this Section we take up the task of proving Theorem 6.1. Thanks to the generalized AERUP security notion, this will only require a single proof.

H-Coefficient Technique and Proof Strategy

The broad idea of this proof follows a widely used strategy: we first replace the block cipher by a random function and use Patarin's H-Coefficient Technique to bound the adversary advantage in the information theoretic setting.

Patarin's H-Coefficient Technique. Consider a computationally unbounded deterministic adaptive adversary A for a distinguishing game between a real and an ideal world. As usual, A must output a decision bit at the end of its interaction with its oracles. We call τ the transcript all queries-responses made by A to its oracles. The transcript may also contain additional information revealed to A at the end of its interactions but before its decision. Indeed, additional information can only give more distinguishing power to the attacker and thus the derived advantage upper-bound will stand.

Let X re and X id be random variables denoting the transcript in the real and ideal worlds respectively. Therefore, Pr(X re = τ ) is the probability that the transcript τ is realized in the real world and Pr(X id = τ ) the probability that the transcript τ is realized in the ideal world. We say a transcript τ is attainable if Pr(X id = τ ) = 0. The set of attainable transcript is noted Θ and the main theorem of the H-coefficient technique [Pat09; CS14] is as follows.

Theorem 6.2 (H-coefficient technique).

Let A be a fixed computationally unbounded deterministic adversary that has access to either the real world oracle O re or the ideal world oracle O id . Let Θ = Θ g Θ b be some partition of the set of all attainable transcripts into good and bad transcripts. Suppose there exists ratio ≥ 0 such that for any τ ∈ Θ g ,

Pr(X re = τ ) Pr(X id = τ ) ≥ 1 -ratio ,
and there exists bad ≥ 0 such that Pr(X id ∈ Θ b ) ≤ bad . Then, Pr(A Ore → 1) -Pr(A O id → 1) ≤ ratio + bad . (6.4)

Notice that the best strategy (or one of the best) of a computationally unbounded adversary is necessarily deterministic so the upper-bound on the advantage of deterministic adversaries given by the H-Coefficient technique also applies to probabilistic adversaries. Security Game. We consider any adversary A in the AERUP security game, Definition 6.1. As it is common in security proofs of birthdaybound secure schemes we first use the PRP/PRF switch (Lemma 1.1) and consider the ANYDAE construction instantiated by a random function instead of a block cipher.

Concretely, we have:

Adv AERUP ANYDAE-E (A) ≤ Adv PRP E (B) + σ(σ -1) 2 n+1 + Adv AERUP ANYDAE-f (A)
where f is an n to n bit random function and σ is the number of block cipher calls (which depends on the query complexity, the queries length and the Fmt specification). To upper-bound Adv AERUP ANYDAE-f (A) we use the Hcoefficient technique for any adversary A making q e , q d and q v encryption, decryptions and verification queries respectively.

Oracles Definition for AERUP Security

First, a few notations: Let (a i+ , m i+ ) be the ith encryption query (1 ≤ i ≤ q e ) where the associated data a i+ and the message m i+ are of block lengths i+ a and i+ m respectively. Let (a i-, c i-, T i-) be the ith decryption query (1 ≤ i ≤ q d ) where the associated data a i-and the ciphertext c i-are of block lengths i- a and ic respectively. Let (a i , c i , T i ) be the ith verification query (1 ≤ i ≤ q v ) where the associated data a i and the ciphertext c i are of block lengths i a and i c respectively. We assume a non-trivial, non-repeating A so that all queries are distinct and no (a i , c i , T i ) is an answer of an earlier encryption query.

Let (i, * ) be the ith message of type * ∈ {+, -, }, we note (j, ) ≺ (i, * ) the fact that the jth message of type was queried before the ith message of type * .

Let B i * = (b i * 1 ... b i * i * b , δ i * 1 ... δ i * i * b -1 ) ← Fmt(a i * , m i * ) for * ∈ {+, } as
the formatting function is not used in decryption queries. We say B i * and B j have a common prefix of size p if and only if

(b i * 1 ... b i * p , δ i * 1 ... δ i * p-1 ) = (b j 1 ... b j p , δ j 1 ... δ j p-1
). We assume that A is non repeating and Fmt is prefix-free so having B i * = B j is impossible except for some (i, ) ≺ (j, +) (a verification followed by an encryption query of the same message). We call Q the set of all such ((i, ), (j, +)). Otherwise, as Fmt is a public function, the values of B i * can be considered as under the control of the adversary but for two different queries (i, * ) = (j, ) with ((i, * ), (j, )) / ∈ Q we necessarily have p < min( i * b , j b ). Now let us define the oracles for both the real and ideal worlds. In particular, we are free to define any simulator Sim we like to get a proper upper-bound as long as it only accesses the query history and do not directly query the other oracles.

Real World Oracles. At the start of the game the real world oracles draw a random n to n bits function f . The encryption, decryption and verification oracles are AEnc(•, •), Dec(•, •, •) and V (•, •, •) as described for ANYDAE in Algorithm 6.2 where E k is replaced by f . At the end of the interaction, the real world oracles reveals all intermediate values to the attacker as supplementary information to be included in the transcript. In Algorithm 6.2 those values are noted Y i and X i in the authentication part (MAC), and V i and U i in the encryption part (OFB). They correspond to all inputs/outputs of f . Ideal World Oracles. Following the AERUP security game, the ideal world consists of three oracles ($(•,

•), Sim(•, •, •), ⊥(•, •, •)). ⊥(•, •, •) simply returns ⊥ on all (a i , c i , T i ) inputs.
As the simulator has access to the query history to the $ oracle, we denote an initially empty table L that the simulator will use to store (U, V )-tuples.

The encryption oracle $(•, •) is a random function that answers any query by a random ciphertext of corresponding length and a random tag. As we consider non repeating attacker, the $ oracle randomly samples new values (T i+ , c i+ ) for every query (a i+ , m i+ ) as:

c i+ = c i+ 1 . . . c i+ i+ m $ ← --{0, 1} |m i+ | , T i+ $ ← --{0, 1} n .
Then, as the simulator observes the query (a i+ , m i+ ) and its response (T i+ , c i+ ) it stores in table L new (U i+ , V i+ ) tuples as:

U i+ k , V i+ k ← ρ 2 (T i+ ) , m i+ 1 ⊕ c i+ 1 , for k = 1 , ρ 3 (V i+ k-1 ) , m i+ k ⊕ c i+ k , for k = 2, . . . , i+ m .
In case of a collision where U i+ k ∈ L, the simulator will override the old V i+ k value. This event anyway provokes a bad transcript, and so we bound its probability in Section 6.3.3.

Finally, the ideal world decryption oracle is a simulator

Sim(•, •, •) which takes (a i-, c i-, T i-) = (a i- 1 . . . , a i- a i-, c i- 1 . . . , c i- i- c
, T i-) as queries and answers with

m i-= m i- 1 . . . m i- i- c computed by: 1. k ← 1 2. U i- 1 ← ρ 2 (T i-) 3. while U i- k ∈ L do 4. V i- k ← L(U i- k ) 5. m i- k ← V i- k ⊕ c i- k 6. U i- k ← ρ 3 (V i- k ) 7. k ← k + 1 8. for j = k to i- c 9. m i- j $ ← --{0, 1} n 10. V i- j ← m i- j ⊕ c i- j 11. U i- j ← ρ 3 (V i- j-1 ) 12. add (U i- j , V i- j ) to L 13. return m i- 1 . . . m i- i- c
Once the adversary finishes its interactions with the oracles, additional information is revealed to him before the decision. Just like in the real world, he will be given internal values (X, Y ) and (U, V ). For encryption and decryption queries, the (U, V ) values have already been defined as stored in the table L. For verification queries (a i , c i , T i ), the corresponding (U, V ) values are defined in the same way the simulator does for decryption queries (a i-, c i-, T i-) and so does the underlying message

m i .
Notice that the (X, Y ) values only exist for encryption and verification queries as the tag is not verified in decryption queries. To sample those (X, Y ) values we first compute B i * ← Fmt(a i * , m i * ) for * ∈ {+, }. For encryption queries, we first set Y i+ i+ b = T i+ . Then, we go in reverse chronological order for all queries (i, * ) ( * ∈ {+, }) and look for the later query (j, ) ( ∈ {+, }) with (i, * ) ≺ (j, ) such that B i * has the longest common prefix with B j . If (i, * ) is a verification query such that ((i, ), (j, +)) ∈ Q (the longest common prefix query is necessarily be the corresponding (j, +)), we set

Y i k = Y j+ k for all 1 ≤ k ≤ i b . Otherwise, let p < i *
b the length of the longest common prefix between B i * and B j . We set

Y i * k = Y j k for 1 ≤ k ≤ p and randomly sample Y i * k $ ← --{0, 1} n for p + 1 ≤ k ≤ i
b for verification queries and for p + 1 ≤ k ≤ i+ b -1 for encryption queries where we additionally set Y i+

i+ b = T i+ . Finally, the corresponding X values are computed as X i * 1 ← b i * 1 and X i * k ← ρ 1 (Y i * k-1 , δ i * k-1 ) ⊕ b i * k for 2 ≤ k ≤ i * b .
Attainable Transcripts. We've defined all values that are either exchanged during the interactions or revealed afterward. A transcript of the attack τ = (τ e , τ d , τ v ) is thus written as:

τ e = {(a i+ , m i+ , c i+ , T i+ , X i+ , Y i+ , U i+ , V i+ ) : 1 ≤ i ≤ q e } , τ d = {(a i-, m i-, c i-, T i-, U i-, V i-) : 1 ≤ i ≤ q d } , τ v = {(a i , m i , c i , T i , X i , Y i , U i , V i , /⊥) : 1 ≤ i ≤ q v } .
A transcript is said to be attainable (with respect to A) if the probability to realize this transcript in the ideal world is not zero. For instance, the verification queries in the ideal world only answers ⊥ so the last value of all elements of τ v must be ⊥ whenever τ = (τ e , τ d , τ v )is attainable.

Following the H-coefficient technique (Theorem 6.2), we call Θ the set of all attainable transcripts and X re and X id the random variables following the probability distributions of the transcript τ induced by the real and ideal worlds respectively.

Analysis of Bad Transcripts

Definition of Bad Transcripts. A bad transcript happens when a bad event occurs so let us define what a bad event is. We distinguish four types of bad events: Coll XX , Coll XU , Coll UU and Forge defined as:

Coll XX : ∃(j, ) (i, * ), k, k with k = k or B i * and B j do not have a common prefix of size k such that X i * k = X j k , Coll XU : ∃(j, ), (i, * ), k, k such that U i * k = X j k , Coll UU : ∃(j, ) (i, * ), k, k with * = + or U i * 1 = U j k-k +1 such that U i * k = U j k , Forge : ∃i such that Y i i b = T i .
In other words, Coll XX denotes an accidental collision between two inputs to f in the authentication part excluding trivial collisions due to common prefix. Coll XU denotes an accidental collision between an input to f in the authentication part and one in the encryption part. Coll UU denotes an accidental collision between two inputs to f in the encryption part excluding trivial collisions due to a decryption or verification query starting with a previously known value. And Forge corresponds to the event that the last output of f in the authentication part of a verification query actually corresponds to the given tag value.

Again following the H-coefficient technique (Theorem 6.2), we note Θ b the set of all bad attainable transcripts.

Probability of Bad Transcripts. In order to bound the probability of a bad transcript Pr(X id ∈ Θ b ), we bound the probability of every bad events to occur in the ideal world and prove Lemma 6.1: Lemma 6.1. Let X id and Θ b be as defined as above. Then,

Pr(X id ∈ Θ b ) ≤ σ 2 • max{ 1 , γ 1 , γ 2 , γ 3 } + Ωσ • γ 3 + q v 2 n .
Let us bound the probability of Coll XX . Remember that

X i * 1 = b i * 1 and X i * k = ρ 1 (Y i * k -1 , δ i * k -1 ) ⊕ b i * k for k = 1
and for Y values randomly sampled after the adversary interactions. We consider the following cases:

(i) k = k = 1.
The event is a contradiction as we require b i * 1 = b j 1 . The event is set with probability 0;

(ii) k = 1, k = 1. The event implies that ρ 1 (Y i * k -1 , δ i * k -1 ) = b j 1 ⊕ b i * k . As ρ 1 is γ 1 -uniform, the probability of this event is at most γ 1 ; (iii) k = 1, k = 1. The event implies that ρ 1 (Y j k-1 , δ j k-1 ) = b i * 1 ⊕ b j k . As ρ 1 is γ 1 -uniform, the probability of this event is at most γ 1 ; (iv) k = 1, k = 1. The event implies that ρ 1 (Y i * k -1 , δ i * k -1 ) ⊕ ρ 1 (Y j k-1 , δ j k-1 ) = b i * k ⊕ b j k .
To bound the above event, we split it into two different subcases:

Case (a): When k = k and B i * and B j have a common prefix of size k -1 (but not k). This implies that Y i * k-1 = Y j k-1 . Now there are two different subcases. If δ i * k-1 = δ j k-1 , then b i * k = b j
k and the probability of the above event is zero. Otherwise, the above event boils down to

ρ 1 (Y i * k-1 , δ i * k-1 ) ⊕ ρ 1 (Y j k-1 , δ j k-1 ) = b i * k ⊕ b j k .
This event is bounded by the 1 -AXU property of ρ 1 , where the probability is calculated over the random sampling of Y j * k-1 as (j, ) ≺ (i, * ).

Case (b): Otherwise, Y i *

k-1 and Y j k-1 are independent and the above event is bounded by the uniform probability γ 1 of the ρ 1 function that directly follows from Corollary 6.1.

Combining all the four cases, we obtain

Pr(Coll XX occurs) ≤ #X 2 • max{ 1 , γ 1 } .
where #X is the number of X values in the transcript.

Let us bound the probability of Coll XU . We consider the following cases:

(i) k = k = 1. We have |F 1 ∩ Im(ρ 2 )| = 0,
and hence, the probability of Coll XU occurring is 0;

(ii) k = 1, k = 1. The event implies that ρ 3 (c i * k ⊕ m i * k ) = b j 1 where b j
1 can be adaptively chosen. Thus, we suppose that it happens whenever

ρ 3 (c i * k ⊕ m i * k ) ∈ F 1 . As |F 1 ∩ Im(ρ 3 )| = Ω,
and as ρ 3 is γ 3 -uniform, the probability of this event is at most Ω#U • γ 3 , where we have already summed over all possible query choices;

(iii) k = 1, k = 1. The event implies that ρ 1 (Y j k-1 , δ j k-1 ) = U i * 1 ⊕ b j k . As ρ 1 is γ 1 -uniform, the probability of this event is at most γ 1 ; (iv) k = 1, k = 1. The event implies ρ 3 (c i * k ⊕ m i * k ) = ρ 1 (Y j k-1 , δ j k-1 ) ⊕ b j k . If (j, ) ≺ (i, * )
, we bound this event by γ 3 due to the random sampling of c i * k or m i * k and ρ 3 being γ 3 -uniform. Otherwise, we bound the event by γ 1 as ρ 1 is γ 1 -uniform.

For the third case, we have already summed over all possible occurrences of the case. The second and fourth case together occur at most #X • #U times. We therefore obtain

Pr(Coll XU occurs) ≤ (#X • #U ) • max{γ 1 , γ 3 } + Ω#U • γ 3 .
where #U is the number of U values in the transcript.

Let us bound the probability of Coll UU . We consider the following cases:

(i) k = 1. a) * = +.
The event is a contradiction as we require U i * 1 = U j k . The event is set with probability 0; b) * = +. The event implies ρ 2 (T i+ ) = U j k for some previous request (j, ) and some k. Since T i+ is always sampled uniformly at random and ρ 2 is γ 2 -uniform, the probability of this event is at most γ 2 ;

(ii) k = 1. a) * = +. The event implies U i * 1 = U j k-k +1 .
This implies that there is an index h ≤ k where the sequence merges, that is

U i * k -h-1 = U j k-h-1 and U i * k -h = U j k-h . If U i * k -h-1 ∈ L,
the event already happened before and this was already a bad transcript. Else, if

U i * k -h-1 / ∈ L, the event occurs when ρ 3 (V i * k -h-1 ) = U j k-h
with V i * k -h-1 sampled uniformly at random. As ρ 3 is γ 3 -uniform, the probability of this event is at most γ 3 ; b) * = +. The event implies ρ 3 (V i+ k -1 ) = U j k for some previous request (j, ) and some k. Since c i+ k -1 is always sampled uniformly at random, so is V i+ k -1 . As ρ 3 is γ 3 -uniform, the probability of this event is at most γ 3 .

We obtain

Pr(Coll UU ) ≤ #U 2 • max{γ 2 , γ 3 } .
As for the probability of the event Forge, it is trivially bounded by 2 -n for every verification query as the value T i is always chosen before the sampling of

Y i i c . Indeed, Y i i c
is either uniformly sampled after interactions with the oracles or, if there is a (j, +) such that ((i, ), (j, +)) ∈ Q, it is set to T j+ sampled at a later query (i, ) ≺ (j, +). Thus, we obtain

Pr(Forge) ≤ q v 2 n .
Summing over everything we get:

PrX id ∈ Θ b ≤ #X 2 + (#X • #U ) + #U 2 •max{ 1 , γ 1 , γ 2 , γ 3 }+Ω#U •γ 3 + q v 2 n .
The real world equivalent of #X is the number of inputs to f in the authentication part and #U the number of inputs to f in the encryption part, so we let #X + #U = σ the total number of calls to f . Moreover, we have

#X 2 + (#X • #U ) + #U 2 = #X + #U 2 = σ 2 ,
and we use #U ≤ σ to get to the formula of Lemma 6.1.

Analysis of Good Transcripts

Since we've defined the set of bad transcript Θ b we define the set of good transcript as Θ g = Θ\Θ b . We show that for any good transcript τ ∈ Θ g the probability of it happening is the same in the real and ideal worlds as stated in Lemma 6.2: Lemma 6.2. Let X re , X id , and Θ g be as defined as above. For any good

transcript τ = (τ e , τ v , τ d ) ∈ Θ g , Pr(X re = τ ) Pr(X id = τ ) = 1 .
Probability in the Ideal World. Let τ = (τ e , τ v , τ d ) be a good transcript. We note s e the number of distinct X values among {X 1+ , . . . , X qe+ } and s v the number of distinct X values among {X 1 , . . . , X qv }. Thus, there are s e + s v values Y sampled after interaction.

For the encryption part, let C e the number of ciphertext blocks randomly sampled during encryption queries, M d the number of message blocks randomly sampled by the simulator during interaction and M v for the ones sampled by the verification oracle after interaction. So we have:

Pr(X id = τ ) = 1 2 n Ce • 1 2 n se+sv • 1 2 n M d +Mv
.

Probability in the Real World. In the real world, the equivalent of a random sampling is to compute the random function f on a fresh input to get a uniformly distributed output. Therefore, all unique X values and U values are a unique input to the function f and thus also incurs a 1/2 n probability of observing the corresponding output.

For instance the fact that all {U 1+ , . . . , U qe+ } are unique also means that all C e block of ciphertext are uniformly distributed. Moreover, it is clear that the decryption and verification oracles will compute f on M d + M v fresh inputs to reconstruct the plaintext. Finally, since there are s e + s v distinct X values in the transcript the corresponding Y values will also be uniformly distributed, so we have:

Pr(X re = τ ) = 1 2 n Ce • 1 2 n se+sv • 1 2 n M d +Mv
.

Therefore, we can directly conclude that the two probabilities are equals which prove Lemma 6.2.

AERUP Security of ANYDAE

We apply the H-coefficient technique (Theorem 6.2) with ratio = 0 following Lemma 6.2 and bad as the bound in Lemma 6.1 to get the bound:

Adv AERUP ANYDAE-f (A) ≤ Pr(X id ∈ Θ b ) ≤ σ 2 •max{ 1 , γ 1 , γ 2 , γ 3 }+Ωσ•γ 3 + q v 2 n .
Putting it together with the bound obtained with the PRP/PRF switch (Lemma 1.1), that is:

Adv AERUP ANYDAE-E (A) ≤ Adv PRP E (B) + σ 2 • 1 2 n + Adv AERUP ANYDAE-f (A)
and taking the maximum over all adversaries A and B making queries with at most σ calls to the underlying block cipher, q v verification queries (for A) and running in time t and t ≈ t respectively, we obtain the AERUP security bound of Theorem 6.1.

Conclusion.

We've thus proved the robustness of ANYDAE in the AERUP security model. With a single proof we showed that the deterministic AEAD mode ANYDAE is AE, PA1 and INT-RUP secure. Moreover, ANYDAE is described quite generically following the requirement of the proof. There are multiple possible instances of ANYDAE whose security is directly implied by its proof, and we've shown two of them: MONDAE that only slightly modifies SUNDAE to achieve AERUP security and TUESDAE that aim at being optimal in the number of block cipher queries for most inputs.

Introduction to Idealized Designs

Idealized designs introduced in this chapter build new primitives upon existing primitives. Just like modes of operation, they rely on the security of an underlying cryptographic primitive. Therefore, the techniques we've seen for modes such as security games, proofs and even cryptanalysis will remain relevant when talking about idealized designs.

Idealizing existing constructions are introduced to provide a formal analysis of pre-existing designs strategy. For instance the DES block cipher follows the older Feistel Network strategy and, later, this strategy was idealized and formally studied by Luby and Rackoff [LR88] (Section 7.1.1). The FX construction (Section 7.1.3) was introduced by [START_REF] Kilian | How to Protect DES Against Exhaustive Key Search[END_REF] to formally analyze DESX, the iterated Even-Mansour construction (Section 7.1.2) allowed [START_REF] Bogdanov | Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations -(Extended Abstract)[END_REF] to formally analyze key-alternating ciphers that is the design strategy of the AES and tweakable block ciphers (Section 2.3.4) were formalized by [START_REF] Liskov | Tweakable Block Ciphers[END_REF] with the goal of simplifying the analysis of the OCB mode.

Building Block Ciphers

Feistel Network

A Feistel network builds a block cipher using a family of pseudo-random functions. Let F k i (•) be a family of n to n bits functions indexed by a key and k = k 1 . . . k r . The 2n-bit input message is first split into two n bit half to initialize the internal state s 0

L s 0 R = m L m R . A round is defined as s i L s i R = s i-1 R s i-1 L ⊕ F k i (s i-1 R ) and the output after r rounds is E k (m) = c L c R = s r L s r R .
195

m L m R c L c R s 1 L s 1 R s 2 L s 2 R F k 1 F k 2 F k 3 Figure 7.1: A 3-round Feistel network with input m = m L m R and output c = c L c R .
As it is always invertible regardless of the underlying functions, a Feistel network define a family of a 2n-bit permutations which is, indeed, a block cipher. To see this, we simply need to write the inverse round function:

s i-1 L s i-1 R = s i R ⊕ F k i (s i L ) s i L .
Provable Security. This construction was first studied by Luby and Rackoff [START_REF] Luby | How to construct pseudorandom permutations from pseudorandom functions[END_REF] as an idealization of the design strategy of the DES block cipher [START_REF]Data Encryption Standard[END_REF]. When all F k i functions are replaced by independent and random functions, they showed that 3 rounds (Figure 7.1) are sufficient to be prp secure (Definition 1.1) and 4 rounds to be sprp secure (Definition 1.2) both up to 2 n/2 queries. That bound can be interpreted as a birthday bound on the F k i functions and there are matching distinguishers for 3 and 4 rounds of the respective types exploiting collisions. Let us show a prp distinguisher on 3 rounds of Feistel:

1. For a fixed m L , query E k (m) to find a collision m R ⊕ c L = m R ⊕ c L ; 2. Take m L = m L and query c L c R = E k (m L m R ) and c • L c • R = E k (m L m R ); 3. Check that the collision still holds: if m R ⊕ c L ? = m R ⊕ c • L return 1 else 0;
The first step is the most costly one as it looks for an n-bit collision. Its data and time complexity are thus the birthday bound O(2 n/2 ). The idea of the attack is to look for a collision in

s 1 R = m L ⊕F k 1 (m R ) (see Figure 7.1). Indeed, we have c L = m R ⊕ F k 2 (m L ⊕ F k 1 (m R )
) so whenever there are two inputs m R and m R such that we have a collision

F k 1 (m R ) = F k 1 (m R ), we will observe, for a fixed m L , that c L ⊕ m R = c L ⊕ m R . This relation is independent of the value m L so it should still hold with a different one. Notice that it is also possible to observe c L ⊕ m R = c L ⊕ m R because of a collision in F k 2 for two different values of s 1
R ; in which case Step 3 will fail. However, the probability of success is already constant Ω(1) and can be arbitrarily improved by repeating the attack. As we only queried the construction in the forward direction, it is indeed a birthday bound distinguisher on the prp security of the 3 rounds construction.

Interestingly, the security of the 3 rounds Feistel breaks when we allow the adversary to query in the inverse direction. This makes it very easy to provoke a collision in the s 1 R internal state value. Let us describe the sprp distinguisher given in [START_REF] Luby | How to construct pseudorandom permutations from pseudorandom functions[END_REF] using only 3 queries:

1. Query E k (m) for some m = m R m L . Get c = c L c R ; 2. Query E k (m L ⊕ δ m R ) for some δ = 0. Get c = c L c R ; 3. Query the inverse E -1 k (c L c R ⊕ δ). Get m = m L m R ; 4. If m R ⊕ c L ? = m R ⊕ c L return 1 else 0;
Indeed, with a 3-round Feistel network we observe that m R ⊕c L = m R ⊕c L which is unlikely to happen with a truly random permutation. The attack exploits the fact that, for a given m R , any difference in m L propagates to s 1 R and, in the inverse direction, for a given c R any difference to c L also propagates backward to s 1 R . In the first query E k (m), the internal state value s 1 R is unknown, but in the second and third queries we know that it will become s 1 R = s 1 R ⊕ δ and, hence, be equal. We observe that this indeed happens as

m R ⊕ c L = F k 2 (s 1 R ) = m R ⊕ c L .

Even-Mansour Construction

Even and Mansour [START_REF] Even | A Construction of a Cipher From a Single Pseudorandom Permutation[END_REF] proposed an idealized design that builds a block cipher using a public permutation as E k (x) = P (x ⊕ k 1 ) ⊕ k 2 parametrized by a 2n-bit key k = k 1 k 2 . They proved its security and it later became known as the Even-Mansour construction. Their security analysis is equivalent to the sprp notion and thus satisfies the sPRP security game (Definition 1.2) but with a random permutation. Concretely, consider the Even-Mansour construction E k (x) = P 0 (x ⊕ k 1 ) ⊕ k 2 with a public permutation P 0 . The sprp advantage of E k (•) is:

Adv sprp E (A) = Pr(A E k (•),E -1 k (•),P (•),P -1 (•) → 1)
-Pr(A p(•),p -1 (•),P (•),P -1 (•) → 1) .

where P 0 (•) is replaced by

P (•) in E k (•), k $ ← --{0, 1} 2n
, P and p independently and uniformly drawn among all n to n bits permutations.

Real World

Ideal World Notice that the public permutation P 0 does not appear in the game and is replaced by a truly random permutation. As discussed in Section 2.3.4, this is impossible to formally define the security notion for a public permutation. Nevertheless, a low sprp advantage is a good indicator that the construction is secure given a "good enough" public permutation. In other words, this formalization captures the advantage of all attacker A that don't exploit any particular property of P 0 . So, let D be the number of query to the keyed construction and Q be the number of query to the public permutation, then the main result of [START_REF] Even | A Construction of a Cipher From a Single Pseudorandom Permutation[END_REF]

A E k (•) E -1 k (•) A p(•) p -1 (•) P (•) P -1 (•)
is that Adv sprp E (A) ≤ O(D • Q/2 n ).
In particular, any attack with an Ω(1) success probability requires D • Q ≥ Ω(2 n ). As P is public, query to its oracle are actually offline computations while query to E k are online data. Therefore, the result is often stated as D • T ≥ Ω(2 n ) with T the time complexity. This is also birthday-bound security as D = T = 2 n/2 is enough to have D • T = 2 n and there are matching attacks within those parameters.

A single-key version of the Even-Mansour construction (Figure 7.3) has also been proposed by Dunkelman, Keller and Shamir [START_REF] Orr Dunkelman | Minimalism in Cryptography: The Even-Mansour Scheme Revisited[END_REF], defined as

E k (x) = P (x ⊕ k) ⊕ k.
They showed that the security remained the same even with this simplification. The single-key Even-Mansour construction is probably the simplest way to securely build a block cipher from a public permutation.

Cryptanalysis. There are multiple matching cryptanalyses of the Even-Mansour scheme in chosen plaintext [START_REF] Daemen | Limitations of the Even-Mansour Construction (Rump Session)[END_REF] and known plaintext [START_REF] Orr Dunkelman | Slidex Attacks on the Even-Mansour Encryption Scheme[END_REF] that work for both the single key and the original versions. The main idea of those attacks is to exploit the fact that a difference ∆ in the input of the construction will propagate to the input of the permutation. Concretely, by construction we have for any n-bit values x, y, ∆:

x ⊕ y = k 1 =⇒ E k (x) ⊕ E k (x ⊕ ∆) = P (y) ⊕ P (y ⊕ ∆) (7.1)
and the converse holds true with good probability. Therefore, if we randomly find x, y and ∆ such that E k (x) ⊕ E k (x ⊕ ∆) = P (y) ⊕ P (y ⊕ ∆), it is most likely the case that x ⊕ y = k 1 and E k (x) ⊕ P (y) = k 2 .

The slide attack of Daemen [START_REF] Daemen | Limitations of the Even-Mansour Construction (Rump Session)[END_REF] works by fixing a value for ∆ and looking for a collision satisfying (7.1). See Algorithm 7.1. Algorithm 7.1 Slide attack [START_REF] Daemen | Limitations of the Even-Mansour Construction (Rump Session)[END_REF] on Even-Mansour.

1: input: E(x) = k 2 ⊕ P (k 1 ⊕ x) . 2: output: (k 1 , k 2 ) . 3: procedure SlideAttack(E(•), P (•)) 4: ∆ ← δ
For any δ = 0.

5:

f (x) ← E(x) ⊕ E(x ⊕ ∆) 6:
g(y) ← P (y) ⊕ P (y ⊕ ∆)

7:

Let X and Y such that {x ⊕ y : (x, y) ∈ X × Y} = {0, 1} n 8:

(x, y) ← CollisionFun(f (•), g(•), X , Y) 9:
return (x ⊕ y, E(x) ⊕ P (y))

The Step 8 of Algorithm 7.1 is about finding a collision and thus works in data and time complexity O(2 n/2 ). More precisely, this attack works as soon as there exists x, y such that x ⊕ y = k 1 to provoke Equation (7.1) which how we define the sets X and Y in Step 7. Therefore, after querying D = |X | different values x (it is easy to choose X such that ∀x ∈ X : x ⊕ ∆ ∈ X ), the attack requires |Y| = Q/2 = 2 n /D different values y. Hence, we indeed have D • Q = 2 n+1 for a sure success and, if D ≤ Q, D • T = 2 n+1 as well. Notice that while we don't need to choose x, we need to query x ⊕ ∆ for a fixed ∆ so this is indeed a chosen plaintext attack.

The slidex attack [START_REF] Orr Dunkelman | Slidex Attacks on the Even-Mansour Encryption Scheme[END_REF], however, works with known plaintexts and the same trade-off complexity. The trick is to rewrite ∆ as k 1 ⊕ ∆ since it is an arbitrary value and Equation (7.1) becomes:

x ⊕ y = k 1 =⇒ E k (x) ⊕ P (x ⊕ ∆) = E k (y ⊕ ∆) ⊕ P (y) (7.2)
The slidex attack is shown in Algorithm 7.2. It is a known plaintext attack where the set X is known but imposed. The data complexity is simply D = |X |. The attack builds Γ lists of size D so the total number of queries to the permutation done in Step 3.

1 is Q = D • Γ. The expected number of collisions is Γ • D(D-1) 2 n+1 = Q(D-1)
2 n+1 so we have a good probability of success with

D • Q = 2 n+1 and, when D ≤ Q, D • T = 2 n+1 .
In [START_REF] Orr Dunkelman | Slidex Attacks on the Even-Mansour Encryption Scheme[END_REF] they notice that for a fixed ∆ in Equation (7.2) we can look for a collision in f (x) = E k (x) ⊕ P (x ⊕ ∆) using Algorithm 3.3 for memoryless collision search. The slide attack can also be done in Algorithm 7.2 Slidex attack [START_REF] Orr Dunkelman | Slidex Attacks on the Even-Mansour Encryption Scheme[END_REF] on Even-Mansour.

1: input: E(x) = k 2 ⊕ P (k 1 ⊕ x) . 2: output: (k 1 , k 2 ) . 3: procedure SlidexAttack(E(•), P (•)) 4: L ← {(x, E(x)) : x ∈ X }
For an obersvable set X of size D.

5:

for all ∆ ∈ {∆ 1 , ..., ∆ Γ } do Arbitrary values ∆ = 0.

6:

(x, y) ← Collision({E(x) ⊕ P (x ⊕ ∆) : x ∈ X }) 7: if (x, y) = ∅ then 8: return (x ⊕ y ⊕ ∆, E k (x) ⊕ P (y ⊕ ∆)) 9: return ∅ x P 1 P 2 E k (x) k k k Figure 7
.4: Single key two-round Even-Mansour scheme (2EM) with two independent permutations

E k (x) = k ⊕ P 1 (k ⊕ P 2 (k ⊕ x)).
a memoryless manner to look for a collision. The complexity is still in O(2 n/2 ) and this shows that the memory cannot be lower bounded in the way the time complexity is bounded by Q. These memoryless versions of the cryptanalysis are adaptively chosen plaintext attacks as not only do we need to choose the values of the queries, but they depend on the previous query.

Iterating Even-Mansour. Bogdanov et al. [START_REF] Bogdanov | Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations -(Extended Abstract)[END_REF] proposed to generalize the simple Even-Mansour scheme by iterating it over multiple rounds. An r-round Even-Mansour scheme is based on r public permutations. First, a key is directly added to the input s 0 = x ⊕ k 0 and a round is defined as s i = P i (s i-1 ) ⊕ k i , the output after r rounds is s r . This is an idealization of the design strategy of key alternating ciphers which interleaves key additions with known (and, in practice, simple) permutations. This design strategy is notably used in the AES [AES].

The iterated construction was first proven to be secure beyond the birthday bound and up to O(2 2n/3 ) queries for r ≥ 2 [START_REF] Bogdanov | Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations -(Extended Abstract)[END_REF], and later improved to O(2 nr/(r+1) ) queries [LPS12; CS14] or, more generally,

D • Q r ≥ O(2 rn
). The proof holds even when a single key is reused at every rounds like illustrated in Figure 7.4.

There is also a known information theoretic key recovery by Bogdanov et al. [START_REF] Bogdanov | Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations -(Extended Abstract)[END_REF] that matches the best provable bound for all r. Algorithm 7.3 describes the attack on r-round Even

L ← {(x, E(x)) : x ∈ X }
For an obersvable set X of size D.

5:

for i = 1 to r do 6:

L i = {(x, P i (x)) : x ∈ X i } For a random set X i of size Q. 7:
for all k ∈ {0, 1} (r+1)n do 8:

k 1 . . . k r+1 ← k 9:
b ← False Control whether we could reconstruct a path. return ∅ guessing the key and reconstructing the internal state part (the value s in Algorithm 7.3) in order to test whether it is consistent with the queries made to the keyed construction. All the wrong key guesses will thus be discarded given that we have enough data to build a few paths for all guesses. To build a path we start from D possible values and proceed to keep values that belong to a set of size Q after a key addition. We iterate

x E k y k 1 k 2 Figure 7.5: The FX construction E k (x) = k 2 ⊕ E k (k 1 ⊕ x) with a 2n + κ-bit key k = k k 1 k 2 .
this for every round, and, in expectation, we can build D • Q r /2 rn paths. Therefore, we need a data-query complexity trade-off of D • Q r = Ω(2 rn ).

The balanced case requires D = Q = Ω(2 nr/(r+1) ) matching the proof of [LPS12; CS14]. However, this attack requires a much larger number of computations than Q. For two and three rounds the best attacks run in T = 2 n /n and for r ≥ 4 there's no known attack with less that 2 n computations even in the single key variant. The gap between the information theoretic complexity and the computational complexity is arguably the largest for r = 2 rounds. Indeed, for two rounds an attack is possible with D = Q = 2 2n/3 but the best attack uses T = 2 n /n computations. In Chapter 8 we devise new attacks on the 2-round Even-Mansour with a single key (Figure 7.4) by linking it to the 3-XOR problem (Section 3.2.2). Our approach optimizes both the data D and the memory while keeping T = 2 n /n. The link to the 3-XOR problem might give some insight on why such a gap exists. In particular, reducing the time complexity of solving the 3-XOR problem would reduce the time complexity of our two rounds Even-Mansour cryptanalysis.

FX Construction

The FX construction (Figure 7.5) builds a block cipher E with a 2n+κ-bit key based on another secure block cipher E with a κ-bit key as

E k (x) = k 2 ⊕ E k (k 1 ⊕ x).
It has been first studied Killian and Rogaway [START_REF] Kilian | How to Protect DES Against Exhaustive Key Search[END_REF] to analyze the DESX construction, a suggested solution by Rivest (according to [START_REF] Kilian | How to Protect DES Against Exhaustive Key Search[END_REF]) that aimed at increasing the security of the DES [START_REF]Data Encryption Standard[END_REF] block cipher against brute-force attacks. Indeed, a generic brute-force key recovery attack requires T = O(2 κ ) computations and [START_REF] Kilian | How to Protect DES Against Exhaustive Key Search[END_REF] proved that the FX construction increases the complexity of the generic cryptanalysis to T = O(2 κ+n /D) when the attacker has access to D input/output pairs. In the case of DES, it has κ = 56 and n = 64 so this makes a substantial difference. The FX construction has since be notably used in PRINCE [START_REF] Borghoff | PRINCE -A Low-Latency Block Cipher for Pervasive Computing Applications -Extended Abstract[END_REF] and PRIDE [START_REF] Albrecht | Block Ciphers -Focus on the Linear Layer (feat. PRIDE)[END_REF].

To prove such a security result, we need to use a stronger assumption than the sprp security of the underlying block cipher E. Indeed, Adv prp E (t) necessarily tends to 1 as t tends to 2 κ since this is the complexity of an exhaustive key search. The assumption used here is called the ideal cipher model. In the ideal cipher model, the actual block cipher is replaced by a family of independently and uniformly drawn random permutations. In particular, the actual block cipher is implicitly required to resist cryptanalysis such as related key attacks where a relation between two keys implies a relation between the two induced permutations. On the other hand, the lack of randomness makes it impossible to formally define such a security notion within a distinguishing game hence the actual block cipher is altogether ignored for the proof. Notice that we couldn't formally define the security of a public permutation for the same subtle reasons.

Algorithm 7.4 Key recovery on FX construction.

1: input: E (x) = k 2 ⊕ E k (k 1 ⊕ x) . 2: output: (k, k 1 , k 2 ) . 3: procedure AttackFX(E (•), E • (•)) 4: L ← {(x, E(x)) : x ∈ X }
For an obersvable set X of size D.

5:

for all k ∈ {0, 1} κ do 6:

(k 1 , k 2 ) ← SlidexAttack(E (•), E k (•))
Provide the set L.

7: if (k 1 , k 2 ) = ∅ then 8: return (k, k 1 , k 2 ) 9: return ∅ Cryptanalysis.
There is a simple matching key recovery working with known plaintexts given in Algorithm 7.4. The attack exploits the fact that once the right key k is guessed, the FX construction is reduced to an Even-Mansour scheme as shown in Section 7.1.2. Step 6 will always reuse the initially observed values and, in addition, will require Q = O(2 n /D) computations to perform the slidex attack for each guess of k. Therefore, the total time complexity is indeed L ← {(x, E(x)) : x ∈ {0, 1} n } Query the whole codebook.

T = O(2 κ • Q) = O(2 κ+n /D)

5:

for all i ∈ {0, 1} κ do 6:

L i ← {(x, E i (x)) : x ∈ X i } For a random set X i of size Q/2 κ . 7:
for all k ∈ {0, 1} rκ do 8:

k 1 k 2 . . . k r ← k 9: k ← AttackrEM(E (•), E k 1 (•), . . . , E k r (•))
Provide the sets L, L k 1 , . . . , L k r .

10:

if k = ∅ then 11: return (k, k ) 12:
return ∅ Iterating FX. We can iterate r rounds of the FX construction to build a block cipher with a (r + 1)n + rκ-bit key upon a κ-bit block cipher (or r different block ciphers which is equivalent in the ideal cipher model). The best information theoretic key recovery on r-round iterated FX construction is due to Gaži [START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF] and makes Q = O(2 r-1 r n+κ ) queries. Algorithm 7.5 gives the attack on an r-round iterated FX E k (x) interleaving k 1 , k 2 , ..., k r+1 n-bit keys with E k 1 , E k 2 , ..., E k r block ciphers. All the queries are done beforehand so that Step 9 does not make any additional query. To optimize the complexity the attack queries the construction for all possible inputs so D = 2 n . Algorithm 7.5 succeeds if the sets L i are sufficiently big so that Algorithm 7.3 succeeds for the right guess of k . The required trade-off is thus D

• (Q/2 κ ) r = O(2 rn ). Since we have D = 2 n , this implies a query complexity of Q = O(2 r-1 r n+κ ).

Other Designs

Block ciphers are not the only idealized designs that are provable schemes. In this section we'll show how one can build hash functions and tweakable block ciphers based on standard block ciphers or public permutations.

Building Hash Function

Ideally, a hash function is a public function that produces a random looking output (of fixed or arbitrary length) from an arbitrary long input. However, a hash is not a PRF since it is a keyless construction. In practice, the security requirement of a hash depends on the usage. One typical usage is to guarantee the integrity of large volume of data by only comparing a relatively short hash value, for that we need our hash function to be collision resistant.

Merkle-Damgård construction.

A collision resistant hash function can be built by iterating a compression function f with fixed sized input and output α and β respectively with α > β. This is the Merkle-Damgård construction as shown in Figure 7.6 that outputs a β-bit hash value. Given a padding scheme that appends the bit length of the input, Merkle and Damgård [START_REF] Merkle | Secrecy, Authentication, and public key system[END_REF][START_REF] Damgård | A Design Principle for Hash Functions[END_REF] independently proved that finding a collision on the hash construction H(m) is as hard as finding a collision on the underlying compression function f (x 1 , x 2 ). In other word, the Merkle-Damgård construction is collision resistant as long as f is collision resistant. Interestingly, Joux [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF] showed that finding a multi-collision (finding multiple inputs matching the same output) on the Merkle-Damgård construction is much easier than in the generic case independently of the compression function f . Indeed, [Jou04] exhibits a 2 u multi-collision attack on Merkle-Damgård for the complexity of looking for u collisions in f . We explicitly describe the attack in Algorithm 7.6. For instance, a generic 4-collision algorithm on a β-bit output requires at least Ω(2 3β/4 ) data, but on Merkle-Damgård it can always be done in Ω(2 β/2 ) data that is the cost of looking for 2 collisions. Nevertheless, it is a widely spread construction notably used in the hash functions MD5, SHA-1 and SHA-2. Algorithm 7.6 Multi-collision attack on Merkle-Damgård [START_REF] Joux | Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions[END_REF].

for i = 1 to do 7: s ← f (s, p i )
Internal state after processing p.

8:

for i = 1 to u do 9:

(m i 0 , m i 1 ) ← Collision(f (s, •)) 10: s ← f (s, m i 0 ) 11: return {m 1 b 1 m 2 b 2 . . . m u bu : (b 1 , b 2 , . . . , b u ) ∈ {0, 1} u } x 1 E • x 2 f (x 1 , x 2 ) Figure 7.7: Davies-Meyer compression function f (x 1 , x 2 ) = E x 2 (x 1 )⊕x 1 .
Davies-Meyer. With the Merkle-Damgård construction, the problem of building a collision resistant hash function is reduced to building a collision resistant compression function. It turns out that one can build such a function with a block cipher as f (x 1 , x 2 ) = E x 2 (x 1 ) ⊕ x 1 . This is the Davies-Meyer compression function. Winternitz [Win83] proposed this construction while attributing the idea to Davies who denied it and attributed the idea to Meyer (According to [START_REF] Preneel | Hash Functions Based on Block Ciphers: A Synthetic Approach[END_REF]). Later, Winternitz himself proved the construction secure as a collision resistant one-way compression function under the ideal cipher model [START_REF] Winternitz | A Secure One-Way Hash Function Built from DES[END_REF]. The provable security is optimum meaning that if the cipher is an ideal cipher, then there is no collision attack on the Davies-Meyer construction faster than the generic birthday bound attack. Note that there are other secure compression functions based on block ciphers that are notably discussed in [START_REF] Preneel | Hash Functions Based on Block Ciphers: A Synthetic Approach[END_REF], but the Davies-Meyer construction is the most popular one. A block cipher can thus serve as a basis to build a collision resistant hash function in addition to authenticated encryption modes. This is especially interesting in restricted environments: one only needs to implement a good block cipher to have access to many cryptographically secure constructions. On the downside, the Davies-Meyer construction requires to remember the input value in order to XOR it with the output which increases the internal state size.

P P P P m 1 m 2 m 3 0 0 ○ P P P H 1 H 2 H 3 ○ H 4
m 3 ) = H 1 H 2 H 3 H 4 .
Sponge construction. We've shown in Section 2.3.4 how to build an authenticated encryption schemes out of a public permutation with the SpongeWrap mode. In fact, the security of such a mode is implied by the security of the sponge construction for a hash function as shown in Figure 7.8 (each r-bit block of key stream is seen as the output of a different hash from a random permutation). One particular aspect of a sponge based hash function is that the output is also of arbitrary length: it is easy to keep unrolling the construction to output as many bits as we want. The construction is based on an n to n bit permutation P separated into an α-bit rate (or outer-part) and a β-bit capacity (or inner-part). Bertoni, Daemen, Peeters and Van Assche [START_REF] Guido | Cryptographic sponge functions[END_REF] proved that a sponge construction instantiated with a random permutation is behaving like a random function as long as there is no collision in the capacity part. This means that there are no better attack than generic attacks up to O(2 β/2 ) computations of P that is not exploiting some property of P . Indeed, the proof replaces P by a random permutation.

The sponge construction therefore offers another way of building a variety of provably secure cryptographic functions from a single secure primitive. At the time of this writing, the sponge construction is mainly used for hashing as the SHA-3 standard [START_REF] Dworkin | SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions[END_REF] is a sponge using a Keccak-f permutation. However, we've lately seen many proposals for authenticated encryption schemes relying on the sponge construction, notably as part of the NIST lightweight competition and the CAESAR competition.

Building Tweakable Block Ciphers

Tweakable block ciphers have been formalized by Liskov, Rivest and Wagner [START_REF] Liskov | Tweakable Block Ciphers[END_REF] as a family of permutation indexed by both a secret key and a public tweak that is an application E : {0, 1} κ × {0, 1} τ × {0, 1} n → {0, 1} n . Since it is a keyed construction, its security notion can be made into a distinguishing game. We define the prp and sprp security advantage for a tweakable block cipher E k (t, x) in an analogous way to the prp and sprp notions for block ciphers, that is:

Adv prp E (A) = Pr(A E k (•,•) → 1) -Pr(A p(•,•) → 1) ,
and

Adv sprp E (A) = Pr(A E k (•,•), E -1 k (•,•) → 1) -Pr(A p(•,•),p -1 (•,•) → 1)
with k $ ← --{0, 1} κ and p(t, •) an independent random n to n-bit permutation for all t ∈ {0, 1} τ .

Liskov et al. [START_REF] Liskov | Tweakable Block Ciphers[END_REF] proposed two constructions of tweakable block ciphers from block ciphers, known as LRW1 and LRW2 and described as

E k (t, m) = E k (t ⊕ E k (m)) and E k (t, m) = E k (m ⊕ h(t)) ⊕ h(t)
respectively with the requirement that h be an almost XOR-universal function (Definition 9.1). Those constructions are proven prp and sprp secure up to the birthday bound assuming an underlying prp and sprp secure block cipher respectively. There are simple matching attacks with complexity O(2 n/2 ) at the first collision.

x E k 1 y t • k 2 t • k 2 Figure 7
.9: The Xor-Encrypt-Xor (XEX) tweakable block cipher with a key k = k 1 k 2 , a tweak t and where

y = E t k (x) = E k 1 (x ⊕ t • k 2 ) ⊕ t • k 2 with t • k 2 a Galois field multiplication. x E k 1 y t • k 2
= E t k (x) = E k 1 (x ⊕ t • k 2 ) with t • k 2 a Galois field multiplication.
XEX and XE constructions. The original motivation of [START_REF] Liskov | Tweakable Block Ciphers[END_REF] was to simplify the proof of the mode OCB. In Section 2.3.4, the OCB mode is shown as a mode relying on a tweakable block cipher while the full specification of OCB [START_REF] Krovetz | The OCB Authenticated-Encryption Algorithm[END_REF] relies on the XEX and XE construction to build a tweakable block cipher out of a standard block cipher as shown in Figure 7.9 and 7.10 respectively.

The exact way the XEX and XE constructions are used in OCB is extensively analyzed in [START_REF] Rogaway | Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC[END_REF] and so is the security as OCB uses both constructions with the same key k 1 and derive the secret value k 2 from the nonce. However, the proof of security for XEX and XE, as shown in Figures 7.9 and 7.10 respectively, is derived from [START_REF] Liskov | Tweakable Block Ciphers[END_REF]. Indeed, XEX is an instantiation of LRW2 with the AXU function h(t) = t • k 2 where multiplication is done in a Galois Field. Therefore, the proof of [START_REF] Liskov | Tweakable Block Ciphers[END_REF] applies showing that XEX is sprp secure up to the birthday bound assuming a sprp secure E. It is also easy to adapt the proof to show the prp security of the XE construction assuming a prp secure E.

x P Ẽk (t, m)

(t 11 • k) ⊕ (t 12 • ∆) (t 21 • k) ⊕ (t 22 • ∆)
Figure 7.11: The XPX construction with key k and a secret value ∆ = P (k). The tweak is t = t 11 t 12 t 21 t 22 and is multiplied in a Galois Field.

The XEX constructions is also notably used for disk encryption within the XTS mode of operation [START_REF] Dworkin | Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Condidentiality on Storage Devices[END_REF]. Other Constructions. There are several other constructions of tweakable block ciphers. For instance the XPX construction by Mennink [START_REF] Mennink | XPX: Generalized Tweakable Even-Mansour with Improved Security Guarantees[END_REF] (Figure 7.12) that reaches a birthday bound O(2 n/2 ) security by building a tweakable block cipher based on a public permutation. There are also constructions where the tweak influences the key of the block cipher. Those constructions need to be proven secure in the ideal cipher model. This is the case of the F [2] construction by Mennink [START_REF] Mennink | Optimally Secure Tweakable Blockciphers[END_REF] (Figure 7.12) that reaches a O(2 n ) sprp security. There is also the XHX construction by Jha, List, Minematsu, Mishra and Nandi [Jha+17] (Figure 7.13) who is sprp-secure up to O(2 (n+κ)/2 ) queries. This is interesting as it shows that security beyond 2 n is achievable in the ideal cipher setting.

m E E k (t, m) E 2 • k t t ⊕ k
Exploring in that direction, Lee and Lee proposed to iterate two independent XHX with the XHX2 construction [LL18] (Figure 7.14). They proved that it is sprp secure up to min{2 ) showing the tightness the bound of Lee and Lee for κ ≤ 2n. In fact, we generalize this design strategy by interpreting it as follows: First, expand the key space with an r-round iterated FX construction (seen in Section 7.1.3), and then compute the subkey by blending the master key with the tweak. Each subkeys become a function of the tweak and the master key, and we call the resulting scheme the iterated tweakable FX construction. Therefore, we also generalize the cryptanalysis to attack r rounds of the generic iterated tweakable FX construction with a query complexity of O(2 r r+1 (n+κ) ).

m E E E k (t, m) λ 0 (k, t) λ 1 (k, t) γ 1 (k, t) γ 2 (k, t)

Introduction

We've seen in Section 7.1.2 that iterated Even-Mansour is an idealization of the SPN strategy to build block ciphers notably used for the AES. Although tight bounds for information theoretic is now known for all r-round iterated Even-Mansour, attacks in the computational setting may not match this bound. The gap is arguably the largest for the 2-round version. Indeed, while there is a tight information security proof and a matching attack in O(2 2n/3 ) queries, the best attacks on single keyed 2-round Even-Mansour have a time complexity of O(2 n /n). Even worse, the best strategies also have either the data or the memory complexity in the order of O(2 n /n) making them hardly better than a brute-force attack that has negligible data and memory usages.

In this chapter we show how to use algorithms solving the 3-XOR problem seen in Section 3.2.2 in order to perform novel cryptanalyses of 2-round Even-Mansour. Those cryptanalyses reduce for the first time both the data and memory usages to way below 2 n while keeping a time complexity of O(2 n /n). In addition, we find the same kind of gap we explored in Section 3.2.2 hinting that it may be really hard to get a better time complexity. More precisely, we show a reduction that implies that an improved 3-XOR algorithm would lead to an improved 2-round Even-Mansour attack.

Our results. The main contributions of the chapter are key-recovery attacks on single key 2-round Even-Mansour (2EM). Those attacks are given in Section 8.3 and their complexities are summarized in Tables 8.1 and 8.2. These are the first attacks on 2EM to significantly reduce simultaneously the data and the memory complexities below 2 n . In Section 8.3.2 we show how to use a 3-XOR solver in a black-box manner to attack 2EM and propose some instantiations of the solver with known 3-XOR algorithms seen in Section 3.2.2. In particular, when using the generalized approach by Bouillaguet, Delaplace and Fouque [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF], this shows that we can achieve the best computational time complexity known so far, that is O(2 n /n), while using just as much data and queries as the best known distinguisher which is optimal in the balanced case (2 2n/3 calls to E, P 1 and P 2 ) with a memory usage not exceeding the number of queries. We can also use the Baran, Demaine and Pǎtraşcu [START_REF] Baran | Subquadratic Algorithms for 3SUM[END_REF] algorithm to further improve the asymptotic time complexity to O(2 n ln 2 n/n 2 ) which beats the best one known so far. Unfortunately, this 3-XOR algorithm is impractical for realistic block sizes, notably for n ≤ 10 6 . Our last attack shown in Section 8.3.3 exploits the specific properties of the 3-XOR problem derived from 2EM to improve those generic results. This results in a very low data attack, λn online queries, with low memory, 2 λn , for some λ < 1 while keeping a competitive asymptotic time complexity of O(2 n /λn).

We also present some security reduction in Section 8.2 notably showing that adding a linear key schedule does not protect against generic attacks. This effectively extends the scope of our attacks in particular showing they can also be applied to various variants. Then, we exhibit a symmetry in the Even-Mansour construction that shows how, in the sprp security game, an attacker can always swap the number of queries he is making to E, P 1 and P 2 to optimize on the most available resources. This result implicitly extends our and previous attacks to adapt to many data and query complexity profiles.

Lastly, we generalize our approach in Section 8.4.1 to show that a single key r-round Even-Mansour scheme can be rewritten as a structured (r + 1)-XOR problem with words of size rn. Interestingly, both the single key r-round Even-Mansour and the (r + 1)-XOR problem with words of size rn have a simple information theoretic solver using 2 r•n r+1 queries though solving these uses more computations than a brute-force solution for r ≥ 4.

Previous Results

There are two kinds of single-key 2-round Even-Mansour schemes with a security proof, one with two independent permutations (EMIP) and one with a single permutation and a fixed linear orthomorphism (that is a linear operation such that x → π(x) and x → x ⊕ π(x) are invertible) such as a doubling in a GF(2 n ) Galois Field (EMSP):

EMIP :

E k (x) = P 2 P 1 (x ⊕ k) ⊕ k ⊕ k EMSP : E k (x) = P P (x ⊕ k) ⊕ π(k) ⊕ k, π a linear orthomorphism.
In this chapter we'll focus on the EMIP variant as we'll see in Section 8.2.1 that any attack on EMIP is easily translated to an attack on EMSP. We refer to single key 2-round Even-Mansour EMIP as simply 2EM.

Multi-collision based Cryptanalysis.

The first non-trivial attack against 2EM was proposed by Nikolic, Wang, and Wu [NWW14] using multi-collisions. They consider the function φ : u → P 1 (u)⊕u and evaluate it on many points to find a value v that occurs multiple times (say ν times). Then, for each known plaintext pair x, E(x) they assume that

φ(x ⊕ k) = v implying that P 1 (x ⊕ k) ⊕ k = x ⊕ v and thus they guess k ? = P 2 (x ⊕ v) ⊕ E(x).
Since φ(•) has at least ν/2 n chances to be equal to v, the expected complexity is 2 n /ν. Following the asymptotic analysis of [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF], the algorithm is optimal when ν = θ(n/ ln n). Indeed, a value v repeating θ(n/ ln n) times is expected to be found after evaluating φ(•) about 2 n /n times so that the total complexity of this attack is 2 n • ln n/n which is asymptotically smaller than 2 n . Dinur, Dunkelman, Keller and Shamir [START_REF] Dinur | Key Recovery Attacks on 3-round Even-Mansour, 8-step LED-128, and Full AES2[END_REF] later improved this attack reducing its data complexity. Their variant looks for N v different values v i appearing at least ν times each for a smaller value of ν. Thus, they make N v guesses of the key for each known plaintext pair x, E(x) which reduce the data complexity to 2 n /(N v • ν). They computed that after evaluating the function on µ2 n points then N v = 2 n µ ν e -ν /ν! multicollisions should be found. In particular, setting µ = 1/n and ν = o(n/ ln n), an upper bound on the data complexity is given by 2 n /N v ≤ n 2ν = e 2ν ln n which is 2 o(n) . The time complexity remains at 2 n /ν.

Dinur et al. also proposed attacks against the variant construction with 3 independent keys, using multi-collisions to find differential properties of the random permutation. However, this attack only reaches time complexity O(2 n / n/ ln n).

Overall, multi-collisions attacks require large pre-processing to locate such a ν-collision that is only expected after 2 n(ν-1)/ν evaluations of φ(•). Moreover, the best known multi-collision algorithm requires 2 n(ν-2)/ν memory [START_REF] Joux | Improved Generic Algorithms for 3-Collisions[END_REF]. Therefore, those techniques intrinsically require time and memory close to 2 n (asymptotically, we need to have ν approaching infinity in order to gain a non-constant advantage over brute-force attacks).

Other Approaches. In the journal version of their paper, Dinur et al. show an interesting side-result on EMIP. They describe an alternative attack with low memory using linear algebra [Din+16, Section 4.2]. In this attack, they evaluate φ : u → P 1 (u) ⊕ u on a small set of λn values (0 < λ < 1/3), and they look for linear relations that are satisfied by all φ(u) in the set: L(φ(u)) = 0 with nλn equations. Then, for a given plaintext pair x, E(x) , if x ⊕ k is in the set, this implies linear relations on z = k ⊕ P 1 (x ⊕ k), the input of P 2 : L(z) = L(x). Finally, using structures for x and z, a match can be identified using linear relations on the key (following from the assumption that x ⊕ k is in the set), using k = P 2 (z) ⊕ E(x). The full details of the attack are given in [START_REF] Dinur | Key Recovery Attacks on Iterated Even-Mansour Encryption Schemes[END_REF]. This attack only requires a memory of size 2 λn to store the structures, but it requires 2 n /λn chosen plaintext pairs. In fact, our low data memory attack can be seen as an improved version of their attack. We comment on the similarities and improvements at the end of Section 8.3.3.

Another approach by Isobe and Shibutani [START_REF] Isobe | New Key Recovery Attacks on Minimal Two-Round Even-Mansour Ciphers[END_REF] introduced Meet-inthe-Middle techniques to attack the 2-round Even-Mansour construction. The basic variant of their attack uses a function f depending on a bits of the key k f (with a in the order of ln n), and a function g depending on the remaining na bits k g . Furthermore, they use a starting point such that a output bits of f are actually independent of the key k f . This allows them to do the matching over P 2 using just k g . The attack works with chosen plaintexts and has a time and data complexity of 2 n-a .

Actually, the function f is equivalent to looking for partial multicollisions in φ(•) while imposing a structure on the inputs: they fix na bits of u and hope that a outputs bits of φ(u) will be independent of the remaining a bits of u. The parameter a must satisfy a•(2 a -1) ≤ n-a, and Isobe and Shibutani [START_REF] Isobe | New Key Recovery Attacks on Minimal Two-Round Even-Mansour Ciphers[END_REF] only give concrete parameters for some values of n. Asymptotically, the maximal value of a can be found by solving a•(2 a -1) = n-a; since a ≪ n and 1 ≪ 2 a , we have a ≈ W (n ln 2)/ ln 2 ≈ log n -log log n, using the Lambert W function (remember that ln and log are the natural and base 2 logarithms, respectively).

They also describe a low data-complexity variant of the attack where the starting point is dynamically chosen so that a + d bits of the plaintext are fixed. This reduces the data complexity to 2 n-d-a , while the time complexity is still 2 n-a . The parameters are more constrained and must satisfy a•2 a +d ≤ n-a. If we want to achieve a data complexity of 2 λn for a constant 0 < λ < 1, we can set d = nλn, and a = log λ + log n -log log n. This gives a time complexity of 2 n log n/λn. Finally, they give a time-optimized attack where b = a + c output bits of f are independent of k f (instead of just a). This reduces the number of queries and memory needed for the matching to 2 n-b , but the attack still requires 2 n-a memory accesses and chosen plaintext. The parameters must satisfy b • 2 a + ba ≤ nb, but the authors only give concrete values for some choices of n, and no asymptotic analysis. However, we can observe that we must have b • 2 a ≤ n; in particular, if we want an attack with an advantage that is not asymptotically bounded, we need to have a approaching infinity and therefore b/n approaching zero (this attack cannot reduce the memory to 2 λn with λ < 1). In particular, the optimal parameters satisfy b • 2 a + ba = nb, with b ≪ n and a ≪ 2 a , hence b • 2 a ≈ n. Therefore, we have a complexity of roughly 2 n-b in queries and memory, and b2 n /n in time and data, with log n ≤ b ≪ n.

All those attacks are summarized in Tables 8.1 and 8.2. We point out that the complexity reported in [START_REF] Isobe | New Key Recovery Attacks on Minimal Two-Round Even-Mansour Ciphers[END_REF] are lower than listed here, because the authors assume that a memory access to a large table is significantly cheaper than the evaluation of the public permutations P i . Given that a public permutation can obviously be implemented with a table lookup if memory is fast and cheap, we assume that a memory access to a table of size roughly 2 n cannot be faster than the evaluation of the P i permutations.

Practical considerations. In the computational setting, the data and memory complexity are important considerations. In particular, an attack with time complexity 2 n /n is unlikely to be more efficient than a bruteforce attack if it requires in addition almost 2 n data, or almost 2 n memory. As mentioned above, some previous attacks can reduce the data complexity to 2 λn for an arbitrary λ > 0, and the attack from [Din+16, Section 4.2] can reduce the memory to 2 λn , but so far none of them can simultaneously reduce the data and memory complexity below 2 λn for λ < 1.

Besides, multi-collision based attacks can use a sequential memory (such as a hard drive) and sort values to locate collisions whereas the Meetin-the-Middle attacks require random access memory, with Θ(2 n ln n/n) accesses to a table of size Θ(2 n ln n/n).

On the other hand, the linear algebra techniques we use in our attacks will require algorithmic tricks very close to what was done by Bouillaguet, Delaplace and Fouque [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] for the 3-XOR problem. In particular, the values we deal with are sufficiently random to be sorted linearly and the right matrix multiplication LM in a GF(2) field for an exponentially long matrix L can be computed with a number of operations linear in the size of L. Many constant time optimizations are therefore omitted in this work which justifies that performing indepently a right multiplication, sorting and merging two big lists L 1 and L 2 take time and space O(|L 1 | + |L 2 |). This is consistent with previous cryptanalysis on 2EM.

For the cost of queries to the oracles E, P 1 and P 2 we mainly follow the convention established by Dinur et al. [START_REF] Dinur | Key Recovery Attacks on Iterated Even-Mansour Encryption Schemes[END_REF] which states that an online query to E costs 1 unit of computation implying that P 1 and P 2 cost 1/2. The main advantage is that it makes it easy to compare with the brute-force solution whose complexity is O(2 n ) computations. The disadvantage is that it makes it hard to combine with the computations used for simple operations: an evaluation of a cryptographically secure permutation should cost more than a XOR operation.

We give concrete complexity values for n = 64 in Table 8.2 with the assumption that a combination of some linear time operations does not exceed the cost of computing a permutation that is 1/2 time unit. Concretely, iteratively right multiplying, sorting and merging two lists L 1 , L 2 costs |L 1 |/2 + |L 2 |/2. We believe this makes an honest comparison with previous works though they may use other assumptions.

x P 1 P 2 E(x) γ 0 (k) γ 1 (k) γ 2 (k)

Security Reductions

We start with some general observations about the security of iterated Even-Mansour schemes. In particular, we show that we can focus on the EMIP construction without loss of generality, how to reduce the security of this construction to an instance of the 3-XOR problem, and how to reorder the oracles to achieve many trade-offs. Some previous works already implicitly took advantage of such reductions. For example Isobe and Shibutani [START_REF] Isobe | New Key Recovery Attacks on Minimal Two-Round Even-Mansour Ciphers[END_REF] realised that their recent attack on EMIP is also applicable to EMSP and Dinur et al. [START_REF] Dinur | Key Recovery Attacks on Iterated Even-Mansour Encryption Schemes[END_REF] realised that they could reorder the oracles for their cryptanalysis of reduced round LED. We formally show here that these tricks are in fact real security reductions and do not depend on the approach used.

Taking care of Linear Key Schedules

Several variants of single key 2-round Even-Masour were studied in the literature. The most general form uses two independent permutations and a fixed key schedule (see Figure 8.2):

E k (x) = P 2 P 1 (x ⊕ γ 0 (k)) ⊕ γ 1 (k) ⊕ γ 2 (k).
Following the analysis of [START_REF] Chen | Minimizing the Two-Round Even-Mansour Cipher[END_REF], the construction is secure when the key schedules γ i (•) are public linear bijective n to n bits functions. Actually, when the γ i (•)'s are such a public linear bijective functions, the security of this construction reduce to the single key EMIP construction without any key schedule.

The main trick is to rewrite the addition of the subkey γ i (k) as the application of the inverse γ -1 i (•), the addition of k and the application of the forward γ i (•): which works thanks to γ i (•) being linear. Then, we define E , P 1 , P 2 as follows:

x ⊕ γ i (k) = γ i γ -1 i (x ⊕ γ i (k)) = γ i γ -1 i (x) ⊕ k x γ -1 0 γ 0 P 1 γ -1 1 γ 1 P 2 γ -1 2 γ 2 E(x) k k k P 1 P 2 γ -1 0 (x) γ -1 2 E(x) = E γ -1 0 (x) k k k
P 1 (x) = γ -1 1 P 1 (γ 0 (x)) P 2 (x) = γ -1 2 P 2 (γ 1 (x)) E (x) = γ -1 2 E(γ 0 (x))
Thanks to the previous relation, E , P 1 , P 2 is actually an instance of EMIP with the same key k (see Figure 8.3):

E (x) = P 2 P 1 (x ⊕ k) ⊕ k ⊕ k.
Therefore, any attack against EMIP can be used on E , P 1 , P 2 , and break the initial construction with a linear key schedule. In particular, a keyrecovery attack against EMIP will recover the key of the more general scheme of 2EM.

In the following we only consider the EMIP variant without a key schedule, but thanks to this reduction our attacks can be applied to many other 2EM variants, including the EMSP construction of [START_REF] Chen | Minimizing the Two-Round Even-Mansour Cipher[END_REF].

From a Key Recovery to a 3-XOR Problem

Instead of directly focusing on a key-recovery attack, we focus on locating a triplet of values x, y, z such that the encryption of x is evaluated with permutation call P 1 (y) and P 2 (z). Formally, we say that x, y, z is a right triplet when y = x ⊕ k and z = P 1 (y) ⊕ k. A right triplet corresponds to a sequence of intermediate values in the Even-Mansour encryption, as shown in Figure 8.4: x, y = x ⊕ k, P 1 (y), z = P 1 (y) ⊕ k, P 2 (z), E(x) = P 2 (z) ⊕ k ; we call this sequence a path.

Since the permutations P 1 and P 2 are public, it is easy to compute a path given the key. Recovering the key from a path is also easy (we have k = x ⊕ y), but it is hard to identify a right triplet corresponding to a path without the key. By definition, a triplet is right when it follows the relation R defined as:

R(x, y, z) :=        x ⊕ y = k P 1 (y) ⊕ z = k P 2 (z) ⊕ E(x) = k (8.1) ⇒ x ⊕ y = P 1 (y) ⊕ z x ⊕ y = P 2 (z) ⊕ E(x) (8.2)
Notice that we can't directly observe (8.1) since we don't know k, but we can easily verify the implied relation (8.2).

We claim that if one takes a random triplet and observes that it respects (8.2), then it is a right triplet with good probability. Indeed, there are 2 n possible paths (one for every possible input x) implying as many right triplets and 2 3n possible triplet combinations; thus a random triplet will be right with probability 2 -2n . Since (8.2) is a 2n-bit relation, a random but false triplet respects (8.2) also with probability 2 -2n . Therefore, we can expect roughly as many right triplets than false triplets that respect (8.2), implying that the first one we find is right with probability Ω(1).

So from now on and for simplicity we focus on filtering and recovering a triplet that simply respects (8.2). This means that our algorithms fails to recover the key on some instances, but they have a constant (nonzero) probability of success. In order to improve the success probability arbitrarily close to one, it is easy to test the triplets and continue the attack until we find a right triplet (alternatively, the whole attack can just be repeated).

In order to look for a triplet, the condition (8.2) is rewritten as:

x ⊕ y ⊕ P 1 (y) ⊕ z = 0 x ⊕ E(x) ⊕ y ⊕ P 2 (z) = 0
Therefore, finding a triplet satisfying (8.2) is equivalent to solving an instance of the 3-XOR problem with the functions defined as:

f 0 (x) := x x ⊕ E(x) (8.3) f 1 (y) := y ⊕ P 1 (y) y f 2 (z) := z P 2 (z)
Notice that the number of evaluations of f 0 (x) is the data complexity D as it requires to query the keyed construction. Conversely, the sum of the number of evaluations of f 1 (y) and f 2 (z) is the query complexity Q which can be seen as offline computations in the computational setting.

Permuting Oracle Calls

In the random 3-XOR problem the three functions behave essentially in the same way; if one has a distinguisher using a few evaluations f 0 and lots of evaluations of f 1 and f 2 , then the same distinguisher can aritraryly decide to use lots of queries to f 0 and f 1 and use fewer f 2 queries (just by permuting the functions). In our case, a natural choice is to minimize the number of evaluations of f 0 in order to optimize for the data complexity. This ensures that we have D ≤ Q. While this is easy to do with a 3-XOR approach, it is not obvious whether this can be done in general for a 2EM key recovery. Nevertheless, this is indeed the case: in the sprp security distinguisher, an attacker is free to permute the functions E k , P 1 and P 2 and, doing so, minimize the amount of online queries. Consider an EMIP instance E k (x) = k ⊕ P 2 (k ⊕ P 1 (k ⊕ x)) of 2EM based on P 1 , P 2 in the sprp security game, so that we have forward oracle access to E k , P 1 , P 2 , and backward oracle access E -1 , P -1 1 , P -1 2 . We use a black-box distinguisher A that distinguishes the construction E k [P 1 , P 2 ] from a third independent random permutation P :

Adv sprp 2EM (A) = Pr(A E k ,E -1 k ,P 1 ,P -1 1 ,P 2 ,P -1 2 → 1)
-Pr(A P,P -1 ,P 1 ,P -1

1 ,P 2 ,P -1 2 → 1)
where P , P 1 , P 2 are independent random permutations, E k answer query

x with k ⊕ P 2 (k ⊕ P 1 (k ⊕ x)), and k $ ← --{0, 1} n . We assume A E k ,E -1 k ,P 1 ,P -1 1 ,P 2 ,P -1 2 uses α calls to E k /E -1 k (online queries), β calls to P 1 /P -1 1 and γ calls to P 2 /P -1 2 and outputs its bit decision. The trick is that we can rewrite the 2EM instance E k , P 1 , P 2 , by permuting the oracles. For instance, we know that P 1 (x) = k ⊕ P -1 2 (k ⊕ E k (k ⊕ x)) (directly from the definition of E k ), which gives the following 2EM instance parametrized by the same secret key k:

E k = P 1 P 1 = E k P 2 = P -1 2 .
Therefore, we can use the same distinguisher but permuting the oracles as

A P 1 ,P -1 1 ,E k ,E -1 k ,P -1
2 ,P 2 using β online queries with the same advantage that is:

Adv sprp 2EM (A) = Pr(A P 1 ,P -1 1 ,E k ,E -1 k ,P -1 2 ,P 2 → 1)
-Pr(A P 1 ,P -1 1 ,P,P -1 ,P -1 2 ,P 2 → 1)

as E k and P -1 2 will behave exactly like independent random permutations and P 1 like the keyed construction with the random key k. Similarly, we can write P 2 (x) = k ⊕ E k (k ⊕ P -1 1 (k ⊕ x)); therefore, we can use the distinguisher as A P 2 ,P -1 2 ,P -1 1 ,P 1 ,E k ,E -1 k with the same advantage using γ online queries.

It is easy to see that the result also applies for key recovery attacks.

2EM Cryptanalysis

Following the security reductions shown in Section 8.2, we focus on cryptanalysis of the EMIP variant of 2EM by looking for a triplet that is a solution to the 3-XOR problem with functions f 0 , f 1 , f 2 as described in Equation (8.3).

3-XOR Algorithms.

Let us first recall the different known techniques to solve the 3-XOR problem for w-bit words we've seen in Section 3.2.2. There are three main techniques, the one using multi-collisions by Nikolic and Sasaki [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] running in time and memory O 2 w/2 / w/ ln(w) and performing as many queries to all three functions. The techniques exploiting linear algebra by Joux [START_REF] Joux | Algorithmic Cryptanalysis. 1st[END_REF] that reaches a time and memory complexity of O(2 w/2 / √ w) and as many queries to f 1 and f 2 but with only w/2 evaluations of f 0 . The generalization of this technique by Bouillaguet, Delaplace and Fouque [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] builds lists L 0 , L 1 , L 2 from the respective functions so that It has an asymptotic time complexity of O(2 w/2 • ln 2 (w)/w 2 ) but relies on heavy precomputations making it impracticable for most w.

|L 0 | • |L 1 | • |L 2 | =
Notations. The ith element of a list L is denoted as L[i], a list L of w-bit words is often seen as a |L| × w matrix with bit coefficients in GF(2) where the w bits of the element L[i] form the ith row. Moreover, 0 a×b is the a × b zero GF(2) matrix and I a is the a × a identity GF(2) matrix.

Direct Applications

We start to describe a key recovery algorithm by directly using the linear algebra techniques of Joux [START_REF] Joux | Algorithmic Cryptanalysis. 1st[END_REF]. In our case, w = 2n so the attack has a time and memory complexity of O(2 n / √ n).

See Algorithm 8.1 for a description of the attack.

Step 7 implicitly requires that L 0 contains n linearly independent 2n-bit rows which is true with very high probability. As we only need to observe n input/output pairs of the keyed construction, this is a known plaintext attack with a data complexity of only D = n.

The complexity analysis follows the one by Joux [START_REF] Joux | Algorithmic Cryptanalysis. 1st[END_REF] and so we have a constant probability of success with a query complexity Q = 2 n / √ n which is also the memory complexity. As we assume that looking for partial collision also costs Q operation, the total time complexity is

T = 2Q = 2 • 2 n / √ n.
Computations of the permutations in Steps 4 and 5 can be done as precomputations.

Using Multi-collisions. If, instead, we use the multi-collision based approach of [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] to solve the 3-XOR problem with w = 2n, we get a cryptanalysis of 2EM running in time and memory 2 n / n/ ln(n). In fact, with a simple optimization to the algorithm we can get to a complexity of 2 n • ln n/n as the attack will be equivalent to the one of [START_REF] Nikolic | Cryptanalysis of Round-Reduced LED[END_REF].

Algorithm 8.1 Key recovery on 2EM using linear algebra [START_REF] Joux | Algorithmic Cryptanalysis. 1st[END_REF].

1: input: E, P 1 , P 2 is EMIP. 2: output: the key k.

3: procedure AttackEMJoux(E(•), P 1 (•), P 2 (•)) 4: L 1 ← {(y ⊕ P 1 (y)) y : y ∈ Y}
For a random set Y of size Q.

5:

L 2 ← {z P 2 (z) : z ∈ Z} For a random set Z of size Q.

6:

L 0 ← {x x ⊕ E(x) : x ∈ X } For an obersvable set X of size n. See sets L i as |L i | × 2n matrices in GF(2).
7:

Find M s.t. L 0 M = [0 n×n I n ]. a 8: L 0 ← L 0 M 9: L 1 ← L 1 M 10: L 2 ← L 2 M 11: for all (i, j) s.t. L 1 [i] n = L 2 [j] n do n-bit partial collisions. 12: if L 1 [i] ⊕ L 2 [j] ∈ L 0 then 13: Let h such that L 1 [i] ⊕ L 2 [j] = L 0 [h]. 14: return L 0 [h] n ⊕ L 1 [i] n Corresponds to x ⊕ y. 15: return ∅ No solution found. a We write L0 = A B . If B is non-singular, we can use M = I 0 B -1 A B -1
Indeed, looking for an n-bit partial multi-collision in f 1 (y) = y ⊕P 1 (y) y is the same as looking for a multi-collision in φ(u) = u ⊕ P 1 (u) (it is impossible to have a multi-collision on the input y). We expect to find a value v = y ⊕ P 1 (y) appearing for n/ ln n different values y. However, in our case, for every observed f 0 (x) = x x ⊕ E(x) we can compute

f 2 (x ⊕ v) = x ⊕ v P 2 (x ⊕ v
) by setting z = x ⊕ v which ensures that the triplet match on the first part.

Choosing z is something we cannot do in the random 3-XOR but is possible in our case. As a result, for every plaintext/ciphertext pairs observed we can build n/ ln n triplets that sum to 0 on the first n-bit half and one of them is a solution with probability n/ ln n/2 n . Hence, we expect a data and query complexity of 2 n • ln n/n. Interestingly, the strategy and the complexity correspond to [START_REF] Nikolic | Cryptanalysis of Round-Reduced LED[END_REF] even though they didn't use the 3-XOR problem to describe their attack. Algorithm 8.2 Key recovery on 2EM using multicollision techniques for 3-XOR [START_REF] Nikolic | Refinements of the k-tree Algorithm for the Generalized Birthday Problem[END_REF] equivalent to [START_REF] Nikolic | Cryptanalysis of Round-Reduced LED[END_REF].

1: input: E, P 1 , P 2 is EMIP. 2: output: the key k. L 0 ← {x x ⊕ E(x) : x ∈ X } For an obersvable set X of size n.

7:

for all e 0 ∈ L 0 do 8: 12:

e 2 ← x ⊕ v P 2 (x ⊕ v) Fix z = x ⊕ v.
return ∅ No solution found.

Using Black-box 3-XOR Algorithms

As seen with the multi-collision attack, the 3-XOR problem (Equation 8.3) we wish to solve is strictly easier than a random 3-XOR problem as we can arbitrarily choose part of the values. Typically, the inputs to the permutations y and z are under our control and, in a chosen plaintext attack, also x. Thus, a variant of the clamping trick of Bernstein [START_REF] Daniel | Better price-performance ratios for generalized birthday attacks[END_REF] can be used to simplify the 3-XOR instance before using generic 3-XOR solvers.

Let us assume a known plaintext attack so that we can't choose the x values. We first align the values we can control, so we equivalently rewrite the Equation 8.3 as:

f 0 (x) := x x ⊕ E(x) (8.4) f 1 (y) := y ⊕ P 1 (y) y f 2 (z ) := P -1 2 (z ) z
As we set the data complexity D = 2 d , we require at least D • Q 2 = 2 n to have a solution and the query complexity is Q = 2 n-d/2 . We force the equality by choosing y and z such that they end by d/2 zeros and, additionally, filter the known plaintext/ciphertext pairs to keep them only if (x ⊕ E(x)) also ends by d/2 zeros. This is a d/2-bit filter on 2 d elements, so we expect L 0 to contain 2 d/2 elements.

This works as a clamping strategy and effectively reduces the bit size of the elements from 2n to 2nd/2. We then apply any 3-XOR solver we like on the lists L 0 , L 1 , L 2 with word's size w = 2nd/2 and lists size 2 d/2 , 2 n-d/2 , 2 n-d/2 respectively (notice that the lists size multiply to 2 2n-d/2 = 2 w as expected). We describe this in Algorithm 8.3. There is no obvious way to further clamp down the data using chosen plaintext or even chosen ciphertext. Algorithm 8.3 Key recovery on 2EM using black-box solver.

1: input: E, P 1 , P 2 is EMIP, data complexity is 2 d and Solver3XOR

is a 3-XOR solver.

2: output: the key k.

3: procedure ClampSolveEM(E(•), P 1 (•), P 2 (•), d, Solver3XOR) 4: L 1 ← {(u 0 d/2 ⊕ P 1 (u 0 d/2 )) u : u ∈ {0, 1} n-d/2 } 5: L 2 ← {P -1 2 (u 0 d/2 ) u : u ∈ {0, 1} n-d/2 } 6:
Let X be an observable set of size 2 d .

7:

L 0 ← ∅ 8: for all x ∈ X do 9: if x ⊕ E(x) d/2 ? = 0 then 10: L 0 ← L 0 ∪ {x x ⊕ E(x) n-d/
D = n 2 .
In the balanced case D = Q = 2 2n/3 , the attack is optimal in the information theoretic model [START_REF] Chen | Minimizing the Two-Round Even-Mansour Cipher[END_REF] and both the data and the memory are significantly below 2 n while having a time complexity competitive with the best known cryptanalysis. Notice also that evaluations of the cipher and permutations do not dominate the time complexity. Thus, the attack becomes even more competitive if we assume an evaluation of a permutation is much more costly than n-bit words operations and memory access to big lists as it was done in previous works [START_REF] Isobe | New Key Recovery Attacks on Minimal Two-Round Even-Mansour Ciphers[END_REF].

To optimize the memory complexity, we need to choose a fairly high value d. The data complexity D = 2 d may become problematic, so we simply swap the number of query to E with the number of offline query to P 1 as shown in Section 8.2.3. This effectively swaps f 0 and f 1 . Thus, we can have a data and memory complexity of 2 n-d/2 , a query complexity

Q = 2 n-d/2-1 + 2 d-1 while the time is still O(2 n /n).
As we need data with special values of x, this becomes a chosen plaintext attack. Examples of concrete trade-offs for n = 64 using [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] algorithm are given in Table 8.2.

Another interesting solver using arbitrary sized lists is the BDP Algorithm [START_REF] Baran | Subquadratic Algorithms for 3SUM[END_REF]

which runs in O |L 0 | • (|L 1 | + |L 2 |) • ln 2 (
w)/w 2 and has an asymptotic memory of the size of the lists. In our case, this yields the best asymptotic complexity known so far T = O(2 n • ln 2 (n)/n 2 ). However, this approach is hardly relevant for any realistic size of n. Indeed, following the analysis of [START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] the complexity of the BDP algorithm is dominated by |L 0 |.|L 1 |/m 2 where m n/(112 ln(n)). Therefore, we expect this approach to be competitive when m 2 > n that implies n > 2.75 × 10 6 , an absurdly big state size.

Using Very Low Data

The previous algorithm can reach a low data complexity for a small parameter d and a relatively low memory complexity close to 2 n/2 for large d. Having both the data and memory complexity close to 2 n/2 requires a chosen plaintext attack.

In this section we show a cryptanalysis with an online or data complexity D < n and a memory complexity of 2 D possibly below 2 n/2 . Concretely, it uses a fraction 0 < λ < 1 of n that is D = λn known plaintext/ciphertext pairs along with 2 λn memory and a time and query complexity T = Q = O(2 n /λn). Notice that we have D • T = 2 n and D • T 2 = O(2 2n /λn) which makes for a better trade-off than the best information theoretic attack known so far for low values of D. In fact, it is information theoretically optimal since it matches the D • T ≥ 2 n bound of the original Even-Mansour scheme which obviously applies for two rounds. Algorithm 8.4 Key recovery on 2EM for low data.

1: input: E, P 1 , P 2 is EMIP, data complexity is λn with 0 < λ ≤ W (2 n ln 2) n ln 2 . 2: output: the key k.

3: procedure LowDataEM(E(•), P 1 (•), P 2 (•), λ) 4: L 0 ← {x x ⊕ E(x) : x ∈ X } For an obersvable set X of size λn. 5: [ A n B n-λn C λn ] ← L 0
See L 0 as three concatenated λn-line matrices.

6:

M s ← I 0

C -1 B C -1 7: M -1 s ← I 0 B C 8: M ←    I 0 0 0 I 0 C -1 A C -1 B C -1    9: L 0 ← L 0 M Notice that L 0 = [ 0 n 0 n-λn I λn ].
10:

for all α ∈ {0, 1} n-λn do 11:

V ← {[α u] • M -1 s : u ∈ {0, 1} λn } 12: L 1 ← {v ⊕ P 1 v v : v ∈ V} 13: L 2 ← {P -1 2 (v) v : v ∈ V} 14: L 1 ← L 1 M 15: L 2 ← L 2 M Note that e [n:2n-λn] = α ∀e ∈ L 1 ∪ L 2 . 16: for all (i, j) s.t. L 1 [i] n = L 2 [j] n do n-bit partial collisions. 17: if L 1 [i] ⊕ L 2 [j] ∈ L 0 then 18: Let h such that L 1 [i] ⊕ L 2 [j] = L 0 [h]. 19: return L 0 [h] n ⊕ L 1 [i] n Corresponds to x ⊕ y.
We describe the attack in Algorithm 8.4. The broad strategy is again to look for a solution of the 3-XOR problem with functions as defined in Equation (8.4). However, since we have very few data we perform Gaussian elimination on L 0 to get words starting with 2nλn zeros. In fact, we define a small n × n transformation matrix M s that only deals with the right-hand side of L 0 . Decompose L 0 as L

0 = [ A n B n-λn C λn ] then the small transformation matrix is such that [B C]M s = [0 λn×(n-λn) I λn ].
And the big 2n × n transformation matrix M deals with the whole L 0 and is defined as:

M =    I 0 M s 0 A M s   
After we fix an (nλn)-bit value α, the small transformation matrix is used to compute the y and z values for L 1 and L 2 . In Steps 12 and 13 of Algorithm 8.4 we choose y and z to be of the form [α u] • M -1 s for a fixed α and all λn-bit values u. That way, when applying M to get the transformed problem, the right-hand side values of L 1 and L 2 revert to the form

[α u]. Let h 1 (u) = [α u]M -1 s ⊕ P 1 ([α u]M -1 s ) ⊕ uA and h 2 (u) = P -1 2 ([α u]M -1 s )
⊕ uA, the three transformed lists are thus:

L 0 = [0 λn×n 0 λn×n-λn I λn ] L 1 = {h 1 (u) α u : ∀u ∈ {0, 1} λn } L 2 = {h 2 (u) α u : ∀u ∈ {0, 1} λn }
This forces an (nλn)-bit collision at the beginning of the right-hand side where the fixed α values will always sum up to match the corresponding zeros in L 0 .

Complexity Analysis. In Step 4 we require D = λn known plaintext/ciphertext pairs with makes for the data complexity. To build M s we implicitly assume that the matrix C is invertible which is true with constant probability for a random square matrix.

In each loop a new value for α is chosen and new lists L 1 , L 2 of size 2 λn are built. A solution exists if one pair among the 2 2λn pairs XORs to one of the λn values of L 0 . As the lists are built so that it forces an (n-λn)-bit collision, a pair will match a value in L 0 with probability λn • 2 -(n+λn) . Thus, each loop yields a solution with probability 2 2λn • λn • 2 -(n+λn) . Therefore, Algorithm 8.4 has a constant probability of success after 2 n-λn λn iterations.

The memory complexity is dominated by storing the lists L 1 and L 2 of size 2 λn . As the algorithm loops over values of α those lists are reused so that the total memory complexity is indeed O(2 λn ).

The expected query complexity is simply 2 λn times the expected number of loops that is

Q = 2 λn • 2 n-λn λn = 2 n λn .
The time complexity is essentially the query complexity. Indeed, computations of the matrices M s and M are polynomial in n and so negligible while building the lists L 1 and L 2 , computing L 1 and L 2 and looking for collisions are linear in the number of elements so it takes O(2 λn ) time per loop. Therefore, T = O( 2 n λn ). The reasoning to derive the query and time complexity implicitly assumes that one needs at least one loop to finish the algorithm as it makes no sense to finish after half-a-round. Therefore, those trade-offs depending on λ are constraints by:

2 n-λn λn ≥ 1 ⇔ λ ≤ W (2 n ln 2) n ln 2 = 1 - ln(n ln 2) n ln 2 + o(1)
using the Lambert W function.

Discussion. Algorithm 8.4 thus describes a known plaintext attack using only λn pairs and O(2 λn ) memory while being on par with the time complexity of the best known cryptanalysis of 2EM.

In the information theoretic setting, the best distinguisher by Gaži has a trade-off DQ 2 = 2 2n [START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF]. Our attack has a trade-off DQ 2 = 2 2n /λn thus being the best distinguisher as well as the best key recovery for very low data D. In fact, the proof of security of 2EM by Chen et al. [START_REF] Chen | Minimizing the Two-Round Even-Mansour Cipher[END_REF] says nothing for low data range D ≤ 2 n/4 . The best proof of security of 2EM in this case is inherited from the original Even-Mansour proof which state D • T ≥ 2 n . Therefore, Algorithm 8.4, where D • T = 2 n , shows the tightness of the original proof for low data range 1 ≤ D ≤ W (2 n ln 2) ln 2 n -ln(n ln 2) ln 2 .

Overall, this cryptanalysis can be seen as an advanced version of the attack by Dinur et al.using linear algebra [Din+16, Section 4.2]. However, there are three main differences that make this attack an improvement over the previous one. First, we use the symmetry between E, P 1 , P 2 (as shown in Section 8.2.3) to reduce the data complexity from 2 n /λn to λn. Then, the use of the big transformation matrix M , that essentially x 0

x 1 P 1 P 1 (x 1 )

x 2 P 2 P 2 (x 2 ) ... performs a Gaussian elimination over the whole 2n-bit words of L 0 , makes the attack works with known plaintexts while Dinur et al. required chosen plaintexts (even after applying the symmetry trick). Finally, the resulting n-bit filter of Step 16 allows for a larger acceptable range of λ than their attack that required λ < 1/3 to limit the number of partial collisions.

Going Further

Extending to More than 2 Rounds

The idea of the attack can also be used for longer iteration of Even-Mansour. In general, a single key r-round Even-Mansour key recovery attack can be done by solving a particular r + 1-XOR problem with words of size rn. While generic solvers won't be of much help as soon as r ≥ 4, this elegantly rewrites the known generic distinguisher on rEM shown in Section 7.1.2, Algorithm 7.3.

Generic Reduction.

We follow the same reasoning as in Section 8.2.2 and apply it to r-round Even-Mansour (Figure 8.5) so that we look for an (r + 1)-tuple (x 0 , x 1 , . . . , x r ) satisfying the relation R:

R(x 0 , x 1 , x 2 , ..., x r ) :=        x 0 ⊕ x 1 = k P i (x i ) ⊕ x i+1 = k, 1 ≤ i ≤ r -1 P r (x r ) ⊕ E(x 0 ) = k (8.5) =⇒        x 0 ⊕ x 1 = P 1 (x 1 ) ⊕ x 2 P i (x i ) ⊕ x i+1 = P i+1 (x i+1 ) ⊕ x i+2 , 1 ≤ i ≤ r -2 P r-1 (x r-1 ) ⊕ x r = P r (x r ) ⊕ E(x 0 ) (8.6)
Again, while R cannot be observed it is easy to verify the implied relation (8.6) which forms an rn-bit filter. Such a filter is enough so that a randomly (r + 1)-tuple satisfying (8.6) also satisfies R with good probability.

From the filter (8.6) we define r + 1 functions whose words are the concatenation of r entries of bit-size n:

f 0 (x 0 ) [hn-n:hn] :=        x 0 , h = 1 0 , 2 ≤ h ≤ r -1 E(x 0 ) , h = r f 1 (x 1 ) [hn-n:hn] :=        x 1 ⊕ P 1 (x 1 ) , h = 1 P 1 (x 1 ) , h = 2 0 , h ≥ 3 f i (x i ) [hn-n:hn] 2≤i≤r-1 :=                  0 , h ≤ i -2 x i , h = i -1 x i ⊕ P i (x i ) , h = i P i (x i ) , h = i + 1 0 , h ≥ i + 2 f r (x r ) [hn-n:hn] :=        0 , h ≤ r -2 x r , h = r -1 x r ⊕ P r (x r ) , h = r
An example in lists form for r = 5 is given in Table 8.3. This indeed defines an (r + 1)-XOR problem with rn-bit words even though it is way more structured than a purely random (r + 1)-XOR problem. Upon its resolution we make a key guess k ? = x 0 ⊕ x 1 that succeeds with high probability.

Generic Solvers. Generic algorithms for the k-XOR problem can typically be applied to this structured variant to perform a key recovery attack. The generic query lower-bound seen in Section 3.2 for the random (r + 1)-XOR problem with words of size w = rn is O(2 rn r+1 ). Interestingly this exactly coincides with the lower bound on the queries for the single key r-round Even-Mansour scheme proved in [START_REF] Bogdanov | Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations -(Extended Abstract)[END_REF]. Generic solvers requiring D = Q = O(2 rn r+1 ) are thus optimal with respect to the data/query complexity trade-off. This results in a distinguisher quite similar to the Lists' construction for a cryptanalysis using the 6-XOR problem.

L 0 { x 0 . . . E(x 0 )} L 1 { x 1 ⊕ P 1 (x 1 ) P 1 (x 1 ) . . . } L 2 { x 2 x 2 ⊕ P 2 (x 2 ) P 2 (x 2 ) . . } L 3 { . x 3 x 3 ⊕ P 3 (x 3 ) P 3 (x 3 ) . } L 4 { . . x 4 x 4 ⊕ P 4 (x 4 ) P 4 (x 4 )} L 5 { . . . x 5 x 5 ⊕ P 5 (x 5 )} Table 8.3: Cryptanalysis of 5EM.
one shown in Section 7.1.2, Algorithm 7.3 but, instead of looking for contradictory paths, it directly looks for a correct path implying a right tuple and guesses the key.

In the computational setting, Wagner's algorithm [START_REF] Wagner | A Generalized Birthday Problem[END_REF] can be applied to our case with a time complexity of T = O r • 2 rn log(r+1) +1 . For r = 2 and 3 rounds this becomes O(2 n ) and in the case of 2EM we could use more recent techniques to get slightly below O(2 n ). In the case of 3EM, Dinur et al. [START_REF] Dinur | Key Recovery Attacks on Iterated Even-Mansour Encryption Schemes[END_REF] described a cryptanalysis with a complexity of O(2 n • ln n n ) using multicollisions and while it is fairly straightforward to rewrite the same attack in the 4-XOR context it is also non-trivial to improve this.

On the other hand, the time complexity of the generic solver becomes significantly higher than 2 n for r ≥ 4 while there is no known cryptanalysis with a time complexity below the 2 n brute-force attack. However, as the number of rounds grows the lists get a strong structure as illustrated in Table 8.3 with many bits fixed to 0. This opens the question of a dedicated algorithm with competitive computational time/memory trade-off for r ≥ 4.

Conclusion

Iterated Even-Mansour schemes are an idealization of SPN networks and understanding their security is important because many block ciphers, including the AES, are based on this design. In this chapter we focused on the two-round construction linking it to the 3-XOR problem. Using linear algebra techniques initially developed for the random 3-XOR problem we devised novel and competitive key recovery attacks with a particularly competitive data and memory complexity. In particular, we give the first attacks where both the data and memory complexity are below O(2 n-ε ) for ε > 0, while achieving the best known time complexity of O(2 n /n). Previous attacks with a similar time complexity required either a very large memory or very large data, making them unlikely to be useful in practice. We also give an attack that improves the asymptotic time complexity to O(2 n • ln 2 (n)/n 2 ), although it is not applicable for practical values of n. Additionally, our low data attack Algorithm 8.4 reaches a trade-off DT = 2 n for small D beating the best known distinguisher and proving the optimality of the original lower bound given for the single round.

As Algorithm 8.3 is a black-box construction using a 3-XOR solver, future improvements of the random 3-XOR algorithms will further improve our cryptanalysis. Note that the converse may not hold: it is not trivial to derive an improved computational lower bound for 2EM assuming the 3-XOR algorithms cannot be improved.

We also extend this approach to link the r-round Even-Mansour with the (r + 1)-XOR problem with a particular structure. However, additional work is required to deduce competitive key-recovery attacks exploiting the particular structure.

Introduction

Since they were formalized by Liskov, Rivest and Wagner [START_REF] Liskov | Tweakable Block Ciphers[END_REF], tweakable block ciphers have received a great deal of attention from the scientific community. However, regular block ciphers such as the DES [DES77] and the AES [AES] benefit from a longer history of research and their security is arguably better understood.

Therefore, we naturally ask ourselves how can we build a tweakable block cipher out of a regular block cipher.

We saw in Section 7.2.2 that simple constructions such as LRW2 and, by extension, XEX effectively achieve this at a relatively small cost (one block cipher call, one Galois field multiplication and two XOR operations). There is though a cost in security. Indeed, even when the underlying block cipher is assumed to be sprp-secure up to O(2 n ) queries, the resulting LRW2 / XEX construction is only sprp-secure up to O(2 n/2 ) queries, that is secure up to the birthday bound. Therefore, subsequent works aimed at improving this bound and in particular some works started mixing the tweak with the master key to derive the effective key for the block cipher. For instance the F [2] construction by Mennink [Men15] • λ(k, t) is said to be δ-almost universal (δ-AU) if for any distinct t and t ∈ T , Pr k ← $ K : λ(k, t) = λ(k, t ) ≤ δ .

• λ(k, t) is said to be δ-almost XOR-universal (δ-AXU) if for any distinct t and t ∈ T and any y ∈ Y,

Pr k ← $ K : λ(k, t) ⊕ λ(k, t ) = y ≤ δ .
Interestingly, the XHX provable bound shows that we can achieve a security growing in κ and, in particular, achieve a security above 2 n in the ideal cipher setting. Notice that it is impossible prove beyond 2 n security by only assuming an sprp-secure block cipher. There is a matching attack on XHX that looks for distinct tweaks t, t such that E t k (m) = E t k (m) which happens as soon as both λ(k, t) = λ(k, t ) and γ(k, t) = γ(k, t ). This is effectively an (n + κ)-bit collision and thus is expected to require O(2 (n+κ)/2 ) queries, matching the proof.

This attack can be adapted to the generalized version of XHX, GXHX (Figure 9.1), where λ(k, t) is replaced by two independent AXU functions λ 0 (k, t) and λ 1 (k, t) as E t k (m) = λ 0 (k, t) ⊕ E γ(k,t) (m ⊕ λ 1 (k, t)). Simply look for two distinct tweak t, t such that E t k (m) ⊕ E t k (m ⊕ 1) = E t k (m) ⊕ E t k (m ⊕ 1) which is independent of λ 1 (k, •) and thus happens as soon as λ 0 (k, t) = λ 0 (k, t ) and γ(k, t) = γ(k, t ). GXHX has the same provable security bound as XHX. However, using Galois Field multiplication as subkey functions can prevent the attack: it is impossible to find two different tweaks such that k 0 • t = k 0 • t . Nevertheless, the attack on single FX turns out to have the same complexity as our generic attack on iterated FX for a single round. Hence, it is always possible to attack GXHX in O(2 (n+κ)/2 ) queries. Later, Lee and Lee analyzed XHX2 (Figure 9.2), the iteration of two independent XHX, and showed that it is sprp secure up to min{2 2 3 (n+κ) , 2 n+κ/2 } queries [START_REF] Lee | Tweakable Block Ciphers Secure Beyond the Birthday Bound in the Ideal Cipher Model[END_REF]. The tightness of the bound was left as an open question, and we'll show that our generic attack for two rounds actually matches this bound.

m E E E k (t, m) λ 0 (k, t) λ 1 (k, t) γ 1 (k, t) γ 2 (k, t)
This shows that we can improve the security bound by iterating. Therefore, we ask ourselves what security can be achieved by iterating this strategy even further.

The Generic Tweakable FX Model

The generic iterated tweakable FX model hopes to capture the most generic strategy to build tweakable block ciphers from block ciphers in order to give a lower-bound on its security advantage.

Notations

Security in the Ideal Cipher Model. First, let us define the sprp security game we will use. In Section 7.2.2 we've seen the definition of sprp, but the fact that we are in the ideal cipher setting also reflects onto the distinguishing game. Concretely, a distinguishing game in the ideal cipher setting captures the fact that the attacker can directly query the underlying block cipher under any key which should behave like a family of independent and random permutations.

Consider a tweakable block cipher E k (t, •) defining a family of n to n-bit permutations indexed by a κ-bit master key k and a τ -bit tweak t, that is E : {0, 1} κ × {0, 1} τ × {0, 1} n → {0, 1} n . Furthermore, consider that E k (t, •) is a construction based on a block cipher E(u, •) defining a family of n to n-bit permutations indexed by a κ-bit subkey u, that is E : {0, 1} κ × {0, 1} n → {0, 1} n . Then, we define the sprp advantage of E in the ideal cipher model as:

Adv sprp (A) = Pr(A E k (•,•), E -1 k (•,•),P (•,•),P -1 (•,•) → 1)

-Pr(A p(•,•),p -1 (•,•),P (•,•),P -1 (•,•) → 1)

where E is based on the public family of permutations P (•, •) instead of E(•, •), k $ ← --{0, 1} κ , p(t, •) and P (u, •) are independent and random n to n-bit permutations for all t ∈ {0, 1} τ and u ∈ {0, 1} κ .

When multiple block ciphers are used, the number of oracles simply increases accordingly to allow the attacker to query each one of them individually. This is similar to how we handle security games of schemes based on a public permutation, in particular for the Even-Mansour construction studied in Chapter 8. However, in this chapter we don't directly consider the sprp advantage of the iterated tweakable FX construction. Instead, we'll build a key recovery attack on E k (•, •) using known plaintexts only. Notice that such a key recovery is an sprp distinguisher as well as a prp distinguisher (no Real World Ideal World backward queries). Following this, queries to the underlying block cipher E(•, •) are offline queries (they are computations) and make up for the query complexity, while queries to E k (•, •) are online queries and make up for the data complexity.

A E k (•, •) E -1 k (•, •) A p(•, •) p -1
The Generic Construction. We first describe a most generic construction that captures many constructions of tweakable block ciphers. The design strategy of most tweakable block cipher constructions can be seen as a two-step process: first, expand the key space and, then, derive all subkeys from the tweak and the master key. Expanding the key space is usually done by the FX construction that can be iterated r times to allow for alternating r + 1 n-bit subkeys and r block cipher's κ-bit subkeys (Section 7.1.3). Therefore, we formally define the generic r-round tweakable FX construction shown in Figure 9.4 as follows. Let E 1,2,...,r (u, •) be r block ciphers with κ-bit key u and n-bit input and output. Let k be the κ-bit master key of the tweakable block cipher construction and t be a tweak of arbitrary length. Let γ i (k, t) be the subkey for the ith block cipher of length κ-bit for 1 ≤ i ≤ r and λ i (k, t) the n-bit subkey to be XORed in the state for 0 ≤ i ≤ r. For every plaintext/tweak input (m, t) the output E k (t, m) = c is defined as:

s 0 := m ⊕ λ 0 (k, t) s i := E i (γ i (k, t), s i-1 ) ⊕ λ i (k, t)
, for 1 ≤ i ≤ r c := s r .

For example the r = 2-round tweakable FX construction E k (t, m) is described as:

E k (t, m) = E 2 γ 2 (k, t), E 1 γ 1 (k, t), m ⊕ λ 0 (k, t) ⊕ λ 1 (k, t) ⊕ λ 2 (k, t)
A description of previous constructions within this generic framework is given in Table 9.1.

Results

In this chapter we ask ourselves what is the best security bound attainable when using the iterated FX framework to build tweakable block ciphers from regular block ciphers. To do this, we improve on the attack by Gaži [Gaž13] (Algorithm 7.5 of Section 7.1.3) on regular iterated FX construction to apply it in the tweakable setting. Most proposed schemes can be rewritten within this framework and most single round constructions have well understood security with tight bounds and matching attacks. On the other hand, we don't know of any constructions involving more than 2 rounds of tweakable FX. This is why we first focus on r = 2 in Section 9.2 and describe an information theoretic key recovery when κ ≤ 2n with offline and online query complexity of:

Q = O(2 2 3 (n+κ) • 3 κ/n) .
Note that Q = O(2 2 3 (n+κ) ) under the reasonable assumption that the size of the master secret key is linear with respect to the state size, that is,

κ = O(n).
In particular, the XHX2 construction by Lee and Lee [START_REF] Lee | Tweakable Block Ciphers Secure Beyond the Birthday Bound in the Ideal Cipher Model[END_REF] is included in the 2-round tweakable FX framework where λ 1 (k, t) = λ 0 (k, t)⊕λ 2 (k, t).

1 (k, t) = k [Men15] F [1] 1 λ 0 (k, t) = λ 1 (k, t) = t • k γ 1 (k, t) = t ⊕ k [Men15] F [2] 1 λ 0 (k, t) = λ 1 (k, t) = E 1 (2 • k, t) γ 1 (k, t) = t ⊕ k [Men16] XPX 1 κ = 0 so E 1 (•, m) = P (m) t =
= λ 2 (k, t) = 0 λ 1 (k, t) = t γ 1 (k, t) = γ 2 (k, t) = k [LST12] CLRW2 2 λ 0 (k, t)
and λ 2 (k, t) two uniform and AXU functions.

λ 1 (k, t) = λ 0 (k, t) ⊕ λ 2 (k, t) γ 1 (k, t) = γ 2 (k, t) = k [LL18] XHX2 2 γ 1 (k, t)
and γ 2 (k, t) two uniform and AU functions.

Cryptanalysis of 2-Round Tweakable FX

In this section we give an algorithm to extract the master key of a 2round tweakable FX construction (Algorithm 9.1). Then, we analyze its probability of success by deriving the required total query complexity.

Algorithm

The cryptanalysis shown in Algorithm 9.1 is a key recovery attack following the idea of the original cryptanalysis by Gaži [START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF]: we want just enough data to construct contradictory paths for each wrong key. First, we do a large amount of offline computations under all possible κ-bit key for the block ciphers. Input values are the sets S 1 and S 2 which can be chosen randomly and the input/output pairs under the key j are stored in L j,1 and L j,2 for E 1 (j, •) and E 2 (j, •) respectively. In Step 12 we store all known tweak/plaintext/ciphertext triples in L 0 . We don't need to choose the set S 0 of inputs to the tweakable block cipher as the attack works in the known plaintext setting. Finally, we can test all the κ-bit values that are potential master keys k only using the stored values by reconstructing the paths round by round. Indeed, sets A and B reconstruct the paths under the current key guess. For completeness, we provide Algorithm 9.2 to show how to construct the sets A and B. To construct A is to apply Algorithm 9.2 with A = MergeSet(S 0 , L γ 1 (k,t),1 , λ 0 (k, t)). For every guess of k, the goal is to check every known tweak/message pairs, compute the input to the first block cipher m ⊕ λ 0 (k, t) and see in set L γ 1 (k,t),1 whether we already know its output. If we know it, we record the guessed internal state. Then, starting from the many guessed states (under the guessed key), we do the same with B and record, if possible, the internal state after the second block cipher call. The constants ν and Q are derived in Section 9.2.2, and the algorithm already ensures that the total query complexity is of magnitude Q. Indeed, once we construct the sets L j,i and L 0 we will have all the necessary queries to perform the attack. Since

Analysis

The Query Complexity. To derive the constant Q used in Algorithm 9.1 we focus on what happens when we guess the correct master key k. In particular, we look at the test of Step 16 and wish to avoid false negative that would reject it even though it is the correct key. Concretely, we need to ensure that |B| ≥ ν happens with good probability as the second constraint is satisfied by construction when the guess is correct.

First, let's look at the construction of A in Step 14:

A ← t, m, a : (t, m) ∈ S 0 , (m ⊕ λ 0 (k, t), a) ∈ L γ 1 (k,t),1

Remember that there are Q values (t, m) ∈ S 0 , and, as S 1 is chosen randomly and independently, there is a |S 1 |/2 n probability that (m ⊕ λ 0 (k, t)) ∈ S 1 for each (t, m) observed meaning that there exists an a such that (m ⊕ λ 0 (k, t), a) ∈ L γ 1 (k,t),1 . Therefore, in expectation, we have to find that in expectation |B| = Q3 /2 2n+2κ . With some regularity assumptions, if |B| = ν in expectation then |B| ≥ ν with constant probability. Therefore, we can derive the constant Q in terms of ν as:

|A| = Q 2 /
Q 3 /2 2n+2κ = ν =⇒ Q = 2
The Number of Paths. Let us now derive the constant ν so that

Step 16 doesn't result in a false positive. In other words, the test must fail for all the wrong guesses of k with good probability. First, notice that Q = 2 probability. Since |B| ≥ ν, the second condition is satisfied with probability at most (2 -n ) ν = 2 -ν•n . We need the test to fail for all the wrong guesses and there are 2 κ -1 such wrong guesses. Therefore, all the tests fail with constant probability when:

2 κ • 2 -ν•n ≤ 1 =⇒ κ -ν • n ≤ 0 =⇒ ν ≥ κ/n ,
thus we take ν = κ/n.

Constraints.

For this attack to be coherent we need to make sure that all quantities are well-defined. In particular, we require:

1 ≤ |S i | ⇐⇒ 1 ≤ 2 2 3 n-1 3 κ • 3 √ ν ⇐⇒ κ ≤ 2n + log(ν)
which limits the block cipher key size κ to a multiple of the state size n. In practice, block ciphers rarely admit a key larger than 2n so this is not a strong limitation.

We also require that all master key / tweak combinations (k, t) induce a different sequence of subkeys. We didn't put any requirement on the functions λ i (k, t) and γ i (k, t) and they may even not depend on k or t, but we nevertheless require that changing one of them induces another permutation for our attack to work. Concretely: ∀k ∈ {0, 1} κ ∀(t, m) ∈ S 0 ∀(t , m ) ∈ S 0 :

t = t =⇒ ∃i : γ i (k, t) = γ i (k, t ) OR λ i (k, t) = λ i (k, t ) .
This condition mostly ensures that the construction behaves like a tweakable block cipher. Indeed, if this condition is not fulfilled, there is an even easier distinguisher: if two tweaks induce the same subkeys, then the permutation is also the same which is a near zero probability event for a family of random permutation, and hence it is an prp distinguisher.

m E 1 E 2 ... E r E k (t,

Cryptanalysis of Iterated Tweakable FX

We now generalize the attack of Section 9.2 to attack an arbitrary number of rounds r ≥ 1 of the iterated tweakable FX construction (Figure 9.6).

Generic Algorithm

The attack is described in Algorithm 9.3. The strategy is the same, we start by doing all the necessary offline queries (Step 10) and online queries (Step 12) before reconstructing paths round by round for all guesses of k (Step 16) to finally check whether the obtained ciphertext is consistent with the known values (Step 17).

Analysis

The Query Complexity. We first derive the constant Q used in Algorithm 9.3 in the same way as we did for the 2-round version. We focus on what happens when we guess the correct master key k. In Step 17 we want to avoid getting a false negative meaning that we need to ensure that |B| ≥ ν happens with good probability. Again, the second condition is always fulfilled when the guess is correct. First, the set A 1 is built in Step 14 as:

A 1 ← t, m, a : (t, m) ∈ S 0 , (m ⊕ λ 0 (k, t), a) ∈ L γ 1 (k,t),1 .

There are Q values (t, m) ∈ S 0 and S 1 is chosen randomly and independently, there is a |S 1 |/2 n probability that ∃a : (m ⊕ λ 0 (k, t), a) ∈ L γ 1 (k,t),1

Algorithm 9.3 Cryptanalysis of r-round tweakable FX construction.

1: input: E is tweakable FX with given block ciphers and subkeys, κ ≤ rn. 2: output: k, the master key of E. for all k ∈ {0, 1} κ do 14:

A 1 ← t, m, a : (t, m) ∈ S 0 , (m ⊕ λ 0 (k, t), a) ∈ L γ 1 (k,t),1

15:

for all i ∈ {2, ..., r} do 16: Under some regularity assumptions, if in expectation we set |A r | = ν then |A r | ≥ ν with constant probability. We deduce the value of Q depending on ν as:

A i ← t,
Q r+1 /2 r(n+κ) = ν =⇒ Q = 2
2 κ • 2 -ν•n ≤ 1 =⇒ κ -ν • n ≤ 0 =⇒ ν ≥ κ/n
thus we take ν = κ/n. Constraints. At last, we check the coherence of our values so that:

1 ≤ |S i | ⇐⇒ κ ≤ rn + log(ν)
which limits κ to a multiple of the state size n.

And the condition on the induced subkeys is: ∀k ∈ {0, 1} κ ∀(t, m) ∈ S 0 ∀(t , m ) ∈ S 0 :

t = t =⇒ ∃i : γ i (k, t) = γ i (k, t ) OR λ i (k, t) = λ i (k, t )
Note that this condition prevents the known matching attack on XHX. Indeed, as for XHX r = 1 and λ 0 = λ 1 , a collision on the full subkeys is expected after trying O(2 (n+κ)/2 ) different tweaks. However, our attack works with the same complexity even when we can't observe a lot of tweaks. It also works on the generalized setting GXHX that doesn't enforce λ 0 = λ 1 .

In fact, for r = 1 and κ ≤ n our attack is equivalent to the generic attack on the FX construction (Algorithm 7.4). Indeed, when k ≤ n the online query complexity is less than 2 n , so we don't take full advantage of the tweakable setting.

Remarks and Conclusion

Comparison with Attacks on FX. Our attack on iterated tweakable FX is closely related to the attack on regular iterated FX by Gaži [START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF] with two main differences. First, in the tweakable case, the number of online queries is unbounded (it is bounded by 2 n in [START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF]), so we better balance out the queries to obtain a lower query complexity. Moreover, our attack shows that the tweak space does not matter: we don't even need to choose the tweak for this to work. Indeed, to generically apply the regular FX attack we would need to fix a tweak and perform all of our query, but our analysis shows that this is not required. Using Tweakable Block Ciphers. If, instead of regular block ciphers, we use tweakable block ciphers, then it is not trivial to adapt this attack. Indeed, the cryptanalysis exploits the fact that the master key and the tweak must be blended before computation and not separately plugged in a tweakable block cipher. Such a construction of a tweakable block cipher based on another tweakable block cipher could be used to increase the security and/or the size of the tweak, in the same way that the original FX construction builds a stronger block cipher from another block cipher. On the cryptanalytic side, it is always possible to fix a single tweak and perform an attack on regular iterated FX.

Weaker Constructions. The attack described is generic given any reasonable key schedule represented by the λ and γ functions. However, they are particular cases where better attacks are possible. In particular, the cascaded LRW2 construction is a 2-round tweakable FX construction where the key in the block cipher does not vary with the tweaks (γ 1 and γ 2 don't depend on t). This construction permits an attack in O(2 3n 4 ) as shown by Mennink [Men18] using only two different tweaks which beats our generic attack as soon as κ > n 8 .

Tweak-rekeying. In fact, our generic attack being a key recovery attack, it necessarily requires at least 2 κ calls to the underlying block cipher. As soon as κ ≥ n, this implies a complexity above 2 n . Mennink [START_REF] Mennink | Insuperability of the Standard Versus Ideal Model Gap for Tweakable Blockcipher Security[END_REF] showed that provable 2 n security is unattainable in the standard block cipher model where one only assumes the block cipher to be a good pseudorandom permutation. Therefore, our generic attack can only hope to be tight for schemes that are proven secure with an ideal cipher and use tweak-rekeying.

Towards Simplicity. The attack on generic 2-round tweakable FX is also tight since Lee and Lee could prove with XHX2 [LL18] that we can reach this level of security even when λ 1 (k, t) = λ 0 (k, t) ⊕ λ 2 (k, t) with some conditions on those functions. Moreover, the previously known matching attack on XHX [Jha+17] exploited the fact that λ 0 (k, t) = λ 1 (k, t) but our generic attack shows that it cannot be made more secure without this simplification. Another way to say it is that enforcing λ 0 (k, t) = λ 1 (k, t) does not affect the provable security bound.

Using the iterated tweakable FX framework, one can therefore wonder how much can we simplify the subkey functions while maintaining an optimal provable security with respect to the generic security upper bound shown in this work.

General Conclusion

This manuscript introduced many provably secure cryptographic constructions along with the contributions made during my thesis. In this general conclusion I wish to insist on a few points that link most of my works as well as give orientations for future research topics.

Proofs and Cryptanalysis.

Even though the techniques used can be quite different, proofs and cryptanalysis fundamentally complete each others. The intuition of cryptanalysis often gives insight on its dual proof.

While this manuscript clearly focuses on cryptanalysis, techniques for proofs are introduced in Chapter 6 to show the robustness guarantee of the authenticated encryption mode MONDAE which is derived from SUNDAE. However, the intuition for the design of MONDAE clearly comes from the simple RUP attack shown in Section 6.1.2. Indeed, MONDAE was first thought as a quick fix to avoid this simple attack and, as we couldn't come up with anything else, we derived a proof to formally show its AERUP security. Hence, even simple attacks can give the necessary insights to build stronger provably secure designs.

Another good example is shown in Chapter 5 about Double-block Hash-then-Sum MACs. The attacks described are using O(2 3n/4 ) tag queries for small messages and a single verification query [LNS18]. At the time of publication, this result was not known to be information theoretically optimal, but about a year and a half later Kim, Lee and Lee [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] improved the best proof guaranteeing security up to Ω(2 3n/4 ) short queries, matching our result for many constructions. We finally have a tight bound on the security of SUM-ECBC, about 10 years after it's been proposed by Yasuda [START_REF] Yasuda | The Sum of CBC MACs Is a Secure PRF[END_REF]. The timing of the proof quickly following after the cryptanalysis is not a coincidence and, in a private communication, one author of [START_REF] Kim | Tight Security Bounds for Double-Block Hash-then-Sum MACs[END_REF] wrote that our attack inspired them to improve the proof to this tight bound. Hence, it is clear that the intuition behind one cryptanalysis actually helps to improve designs and build better proofs. Combining proof and analysis can reduce the gap and lead to tight proofs.

From Information Theoretic to Computational Security. There are many examples of substantial gaps between the best information theoretic proof and the best time complexity cryptanalysis even when the proof is tight in the IT model. In particular, this happened with the cryptanalysis of Poly1305 and GMAC in Chapter 4 (Ω(2 n/2 ) vs O(2 2n/3 )), with the cryptanalysis on 2-round Even-Mansour scheme in Chapter 8 (Ω(2 2n/3 ) vs O(2 n /n)), and with the generic attack on Double-block Hashthen-Sum in Chapter 5 (Ω(2 3n/4 ) vs O(2 n )).

In fact, the best attack on those cited cases solves some algorithmic problem that is a particular instance of the missing difference, the 3-XOR and the 4-XOR, respectively. While it might be possible to speed up those attacks, it may well be impossible to reach a lower time complexity. To prove such an impossibility would provide a computational security bound that potentially goes beyond the information theoretic one to match the best known time complexity.

Having computational security in cryptography is not a new thing; this is what is basic prp assumption for block cipher is about. This is also the basis of all public key schemes that relies on security reduction to a conjectured hard problem such as the discrete logarithm or learning with error. Moreover, the relatively recent fine-grained complexity theory aims at categorizing and relating algorithmic problems with polynomial time complexity solvers. Typically, it is now fairly common to assume that random 3-SUM, and also random 3-XOR, requires a quadratic (relative to the lists size and ignoring log factors) amount of computations to solve.

How can we link the security of the mentioned symmetric key constructions to a group of problem in the fine-grained complexity theory remains an open question, but it is a promising way to accurately characterize their practical security.

Ideal Primitives against Practice. We've seen many schemes proved with ideal primitives, be it ideal ciphers with the tweakable FX construction in Chapter 9 or ideal permutations with the iterated Even-Mansour in Chapter 8. The proof for those schemes ignores the actual primitive and randomly draws one at the start of the security game. In practice, those primitives need to be publicly described and efficiently computable which creates a gap between what is proven and what is used. Even worse, Black proposed a hash construction that is provably secure in the ideal cipher model but insecure for any instantiation [START_REF] Black | The Ideal-Cipher Model, Revisited: An Uninstantiable Blockcipher-Based Hash Function[END_REF].

Black's construction is a rather unnatural proof of concept as it exploits the compact representation of any instantiation, but it nevertheless means that there is necessarily a gap between the practical primitive and its ideal counterpart. However, there has been no natural scheme that can be proven in the ideal setting but hard to instantiate. Quite the contrary, some schemes seem to be secure even when using relatively weak primitives. For instance, consider the combination of Merkle-Damgård with Davies-Meyer we've seen in Section 7.2.1: Winternitz [START_REF] Winternitz | A Secure One-Way Hash Function Built from DES[END_REF] showed that some amount of weak keys and a complementation property (typical of the DES block cipher) posed no lethal threat for the security of the hash scheme. This is also especially true for authenticated encryption schemes using a sponge-like construction as most properties found on various permutations are not exploitable to build an attack on the final mode.

Overall, proving security under an ideal primitive is a good indication that the construction is sound and secure, but it hardly tells what is required from the primitive's instantiation. Since a gap necessarily exists between the ideal version and the practical version, designers may tend to increase it in order to gain efficiency. This makes the proof of security less and less relevant. In fact, proofs in the ideal setting fail to reduce the security to a well-defined but strictly easier cryptanalytic problem on the primitive in the same way as it is done with the classical PRP notion for block ciphers.

  Typiquement, la sécurité des modes d'opération est formellement décrite comme l'avantage maximum d'un jeu de type distingueur. Par exemple, nous utiliserons la notion d'indistinguabilité du chiffré d'une suite aléatoire avec messages choisis (IND$-CPA) pour évaluer la sécurité d'un mode de chiffrement, voir Définition 2. Définition 2 (Distingueur IND$-CPA). Soit un mode de chiffrement qui chiffre un message m avec une valeur initial IV et une clé k comme c = Enc IV k (m) et une fonction $ qui à partir de IV et m renvoie une suite aléatoire de la même taille que le chiffré correspondant. L'avantage d'un adversaire A pour l'indistinguabilité du chiffré d'une suite aléatoire avec messages choisis est :Adv IND$-CPA • (A) = Pr(A Enc • k (•) → 1) -Pr(A $(•,•) → 1) , la sécurité IND$-CPA d'un tel mode est définit comme l'avantage maximum parmi tous les adversaires A, notée Adv IND$-CPA .

Définition 3 (

 3 Problème de la Différence Manquante). Soit deux ensembles A et B et un ensemble d'aide S tous inclus dans {0, 1} n . Trouvez une valeur S ∈ S telle que : ∀(a, b) ∈ A × B, S = a ⊕ b .

Schéma 3 :

 3 Diagramme du MAC de Galois GMAC pour un message de blocs, une clé de hachage H et une clé de chiffrement par bloc k.

  [IM16] O q 3 m 2 2 2n Ω(2 2n/3 ) O(2 3n/4 )

  qui implique la relation : R(X, Y, Z, T ) =⇒ MAC(X) ⊕ MAC(Y ) ⊕ MAC(Z) ⊕ MAC(T ) = 0. La forme des messages X, Y, Z, T est ensuite choisie de façon à ce que cette relation R soit non-seulement possible mais surtout forme une relation linéaire de rang trois, c'est à dire que : Σ(X) = Σ(Y ) et Θ(Y ) = Θ(Z) et Σ(Z) = Σ(T ) =⇒ Θ(T ) = Θ(X).

Schéma 5 :

 5 Diagramme du mode de chiffrement authentifié ANYDAE où les données A et M sont d'abord utilisées dans une fonction de formattage pour calculer B[1 . . . ], δ[1 . . . -1] ← Fmt(A, M ).

{0,

  1} n : The set of all n-bit words. 0 n : The n-bit all 0 word. S × T : The Cartesian product of sets S and T . a ∧ b : Bitwise AND. a ⊕ b : Bitwise exclusive-or, XOR. a b : Concatenation of a and b. a ? = b : Test for equality of a and b. |a| : The bit length of a. a [i] : The bit i of a. a [i:j] : The bits i to j -1 of a. a s : The s most significant bits of a. a s : The s least significant bits of a. Pr(x) : Probability of event x happening. Im(f ) : The image set of function f . O : The big O notation, or Bachmann-Landau notation, for asymptotic behavior. O : The soft O notation ignoring log factors. $ ← --S : Uniformly randomly drawn from the set S. log(•)/ ln(•) : the base 2 logarithm / the natural logarithm, respectively. E k (m) : Block cipher E with key k and message m. E t k (m) : Tweakable block cipher E with key k, tweak t, message m. Enc IV k (m) : Encryption of a message m under the key k and (optional) initial value IV . Dec IV k (m) : Decryption of a message m under the key k and (optional) initial value IV .

Figure 1 . 4 :

 14 Figure 1.4: Iterating a random function f (•) versus iterating a random permutation p(•).

Figure 2 . 1 :

 21 Figure 2.1: Distinguishing game for the IND$-CPA security of an encryption mode where k is a random key value and $(•, •) is a random function.

Figure 2 . 6 :

 26 Figure 2.6: Diagram of the counter mode (CTR) wherec i = E k (N i)⊕m i .

Figure 2 . 7 :

 27 Figure 2.7: Raw CBC-MAC. Outputs the last block of a CBC encryption.

Figure 2 . 8 :

 28 Figure 2.8: Encrypt-last-block Cipher Block Chaining Authentication mode (ECBC).

Figure 2 . 9 :

 29 Figure 2.9: Cipher-based MAC Authentication mode (CMAC).

Figure 2 . 10 :

 210 Figure 2.10: The Wegman-Carter-Shoup construction.

Figure 2 . 13 :

 213 Figure 2.13: Encrypt-then-MAC generic Authenticated Encryption construction.

Figure 2 . 14 :

 214 Figure 2.14: The Galois/Counter Mode GCM AEAD scheme for an ablock authenticated data a 1 ... a a and an m -block message m 1 ... m m with a block cipher key k and an hash key H = E k (0).

Figure 2 . 15 :

 215 Figure 2.15: The CCM AEAD scheme m -block message m, a block cipher key k and b 0 b 1 ... b = Fmt(N, a, m).

Figure 2 . 16 :

 216 Figure 2.16: Distinguishing game for the AE security of an authenticated encryption mode based on a public permutation where p is a random permutation, k is a random key value, $(•) a random function and ⊥(•, •) returns ⊥ on all inputs.

Figure 2 . 18 :

 218 Figure 2.18: Diagram of a variant of SpongeWrap for AEAD mode processing blocks of size α bits with an n-bit permutation P and a capacity β = nα bits. The state is initialized by the key k and a nonce N before absorbing three blocks of AD a and three blocks of message m. The output is c 1 c 2 c 3 MAC.

Figure 2 . 20 :

 220 Figure 2.20: The SIV construction parametrized by two independent key k 1 and k 2 for a prf secure function F and an IND$-CPA-rIV secure encryption Enc respectively. It takes a message m as input and outputs

Figure 2 . 21 :

 221 Figure 2.21: The SIV decryption parametrized by two independent key k 1 and k 2 . It takes IV and c as inputs and outputs m = Dec IV k 2 (c) if the ciphertext is valid, ⊥ otherwise.

Figure 3 . 1 :

 31 Figure 3.1: Behavior of an iterated random function f with path of length µ and cycle of length λ.

Figure 3 . 2 :

 32 Figure 3.2: Memory efficient algorithm for 4-XOR with lists of size 2 w/4 .

Figure 4 . 1 :

 41 Figure 4.1: Diagram of the counter mode (CTR) wherea i = E k (N i) and c i = a i ⊕ m i .

Algorithm 4. 1

 1 Simple sieving algorithm 1: input: A, B, S ⊆ {0, 1} n . 2: output: {s ∈ S | ∀(a, b) ∈ A × B, a ⊕ b = s} . 3: procedure SimpleSieve(A, B, S) 4: for a in A do 5: for b in B do 6: Remove (a ⊕ b) from S; 7: return S Searching Algorithm. Moreover, McGrew

Algorithm 4. 2

 2 Searching algorithm 1: input: A, B, S ⊆ {0, 1} n . 2: output: {s ∈ S | ∀(a, b) ∈ A × B, a ⊕ b = s} . 3: procedure Searching(A, B, S) 4:

  for a in A do 7: if (s ⊕ a) ∈ B then 8:Remove s from S; 9: return S

Chapter 4 .

 4 The Missing Difference Problem 20 21 22 23 24 25 26 27 28 29 30 lower bound with δ = 2 -16

Figure 4 . 2 :

 42 Figure 4.2: Probability of success of the known prefix sieving knowing 2 32 encryptions of a 32-bit secret against the number of chunks of 2 32 key stream blocks of size n = 64 bits used.

Algorithm 4. 4

 4 Fast Walsh-Hadamard Transform 1: input: |C A | = 2 m . 2: output: The Walsh-Hadamard transform of C A . 3: procedure FWHT(C A ) 4: for d = m downto 0 do 5:

  Sieving with fast convolution1: input: : A, B ⊂ {0, 1} n , t ≤ n . 2: output: : S s.t. ∀(a, b) ∈ A × B, a ⊕ b = S . 3: procedure FastConvSieve(A,B, t) 4:C A , C B , C A⊕B ← arrays of 2 n-t integers initialized to 0; 5:

Figure 4 . 3 :Figure 4 . 5 :Figure 4

 43454 Figure 4.3: Results for lists size of 3 • 2 2n/3

Figure 4 . 7 :

 47 Figure 4.7: Example of an attack on two blocks secret S = S 1 S 2 S 3 S 4 . Each step performs the known prefix sieving algorithm. Known information in blue, unknown information in red, attacked information in yellow.

Figure 4 . 8 :

 48 Figure 4.8: f8 mode (i is a message counter)

Figure 5 . 1 :

 51 Figure 5.1: Diagram for SUM-ECBC with a m -block message.

Figure 5 . 3 :

 53 Figure 5.3: Diagram for PMAC+ with a m -block message where ∆ 0 = E 1 (0) and ∆ 1 = E 1 (1).

  0|m

Figure 5 . 4 :

 54 Figure 5.4: Diagram for LightMAC+ with (nz)-bit blocks of a m -block message where (v) z is the value v written over z bits.

Figure 5 . 5 :

 55 Figure 5.5: Diagram for 3kf9 with a m -block message.

Figure 5 . 6 :

 56 Figure 5.6: Diagram for 1kf9 with a m -block message.

Figure 5 . 7 :

 57 Figure 5.7: Diagram for 1kPMAC+ with a m -block message where ∆ 1 = E(1) and ∆ 2 = E(2).

  One may think of Dec k as the decryption function of encryption-only modes but used in authenticated encryption context. It is often clear what the definition of Dec k is from the definition of AEnc k .

  Figure 6.1: SUNDAE authenticated encryption mode of operations with two blocks of associated data a = a 1 a 2

Figure 6 . 2 :

 62 Figure 6.2: Distinguishing game for the AERUP security of an authenticated encryption mode where k is a random key value, $(•) is a random function, Sim(•, •) is an efficient simulator with no access to $(•) and ⊥(•, •) returns ⊥ on every input.

Figure 6 . 3 :

 63 Figure 6.3: ANYDAE authenticated encryption mode of operations with formatting function preprocessing (b, δ) ← Fmt(a, m).

  b1 . . . b , δ1 . . . δ -1 , b 1 . . . b , δ 1 . . . δ -1 ∈ Im(Fmt) with < , b1 . . . b , δ1 . . . δ -1 = b 1 . . . b , δ 1 . . . δ -1 .

  Figure 6.4: MONDAE authenticated encryption mode of operations with two blocks of associated data a = a 1 a 2

Figure 7 . 2 :

 72 Figure 7.2: Distinguishing game for the sprp security of a block cipher E based on a public permutation where P and p are independent random permutations, k is a random key value.

Figure 7 . 3 :

 73 Figure 7.3: Single key Even-Mansour scheme y = k ⊕ P (k ⊕ x).

Figure 7 . 6 :

 76 Figure 7.6: Merkle-Damgård construction with a compression function f .

1:

  input: f is a α to β-bit function for the MD construction H. 2: output: M of size 2 u such that H(p m i ) = H(p m j )∀m i , m j ∈ M. 3: procedure MultiCollisionMD(f (•, •), p, u)

Figure 7 . 8 :

 78 Figure 7.8: The sponge construction for an arbitrary long hash based on a public permutation P . The diagram shows H(m 1 m 2 m 3 ) =

Figure 7 . 10 :

 710 Figure 7.10: The Xor-Encrypt (XE) tweakable block cipher with a key k = k 1 k 2 , a tweak t and where y= E t k (x) = E k 1 (x ⊕ t • k 2 ) with t • k 2 a Galois field multiplication.

Figure 7 . 12 :

 712 Figure 7.12: The F [2] construction. Multiplications are done in a Galois Field.

23

  (n+κ) , 2 n+κ/2 } queries and left

Figure 7 . 13 :

 713 Figure 7.13: The XHX construction with a master key k, an almost universal function γ(•, •) and an almost XOR-universal λ(•, •).

Figure 7 . 14 :

 714 Figure 7.14: The XHX2 construction is the cascade of two independent XHX with almost universal functions γ1(•, •), γ2(•, •) and almost XOR-universal functions λ 0 (•, •), λ 1 (•, •).the tightness of the bound as an open question. In Chapter 9 we present a cryptanalysis of XHX2 running in O(2 2 3 (n+κ) ) showing the tightness the bound of Lee and Lee for κ ≤ 2n. In fact, we generalize this design strategy by interpreting it as follows: First, expand the key space with an r-round iterated FX construction (seen in Section 7.1.3), and then compute the subkey by blending the master key with the tweak. Each subkeys become a function of the tweak and the master key, and we call the resulting scheme the iterated tweakable FX construction. Therefore, we also generalize the cryptanalysis to attack r rounds of the generic iterated tweakable FX construction with a query complexity of O(2

Figure 8 . 1 :

 81 Figure 8.1: Single key two-round Even-Mansour scheme (2EM) with two independent permutations E k (x) = k ⊕ P 1 (k ⊕ P 2 (k ⊕ x)).

Figure 8 . 2 :

 82 Figure 8.2: Linear key-schedule 2-round Even-Mansour.

Figure 8 . 3 :

 83 Figure 8.3: Reduction of linear key schedule 2EM to EMIP.

Figure 8 . 4 :

 84 Figure 8.4: A right (x, y, z) triplet forms a path of EMIP style 2-round Even-Mansour.

  2 w and solves the 3-XOR problem with a time complexity of O(|L 0 | • (|L 1 | + |L 2 |)/w). The last algorithm comes from Baran, Demaine and Pǎtraşcu [BDP08] initially for the 3-SUM problem and it was adapted to the 3-XOR by Bouillaguet et al. [BDF18].

  3: procedure AttackEMJoux(E(•), P 1 (•), P 2 (•)) 4:v ← argmax v |{y : y ⊕ P 1 (y) = v}| Any multi-collision algorithm.5:L 1 ← {v y : y ⊕ P 1 (y) = v} 6:

9 :

 9 if e 0 ⊕ e 2 ∈ L 1 then 10: e 1 ← e 0 ⊕ e 2 11: return e 0 n ⊕ e 1 n Corresponds to x ⊕ y.

Figure 8 . 5 :

 85 Figure 8.5: A right (x 0 , x 1 , ..., x r ) tuple forms a path of r-round Even-Mansour.

Figure 9 . 1 :

 91 Figure 9.1: GXHX construction with master key k, an AU function γ(•, •) and two independent AXU functions λ 0 (•, •), λ 1 (•, •). GXHX coincides with the single round Tweakable FX construction.

Figure 9 . 2 :

 92 Figure 9.2: The XHX2 construction is the iteration of two independent XHX with AU functions γ1(•, •), γ2(•, •) and AXU functions λ 0 (•, •), λ 1 (•, •).

Figure 9 .

 9 Figure 9.4: r-Round Tweakable FX.

  Scheme r Subkey functions

  γ

  λ 0 (k, t) = λ 1 (k, t)a uniform and AXU function.

  λ 0 (k, t)and λ 2 (k, t) two uniform and AXU functions.

Algorithm 9. 1

 1 Cryptanalysis of 2-round tweakable FX construction. 1: input: E is tweakable FX with given block ciphers and subkeys, κ ≤ 2n. 2: output: k : the master key of E. 3: procedure 2KeyRecovery(κ, n, κ, E, E1 , E 2 , γ 1 , γ 2 , λ 0 , λ 1 , λ 2 ) Randomly sample S 1 ⊂ {0, 1} n with |S 1 | = Q/2 κ = 2

7 :

 7 Randomly sample S2 ⊂ {0, 1} n with |S 2 | = Q/2 κ = 2 for all j ∈ {0, 1} κ do 9: L j,1 ← m, E 1 (j, m) : m ∈ S 1 10: L j,2 ← m, E 2 (j, m) : m ∈ S 2Offline Queries Sets 11:Let S 0 ⊂ {0, 1} * ×{0, 1} n with |S 0 | = Q be a known tweak/message set.

L 0

 0 ← t, m, E(t, m) : (t, m) ∈ S 0 Online Queries Set 13:for all k ∈ {0, 1} κ do 14:A ← t, m, a : (t, m) ∈ S 0 , (m ⊕ λ 0 (k, t), a) ∈ L γ 1 (k,t),1 15: B ← t, m, b : (t, m, a) ∈ A, (a ⊕ λ 1 (k, t), b) ∈ L γ 2 (k,t),2 by Algorithm 9.2 16: if |B| ≥ ν and ∀(t, m, b) ∈ B : (t, m, b ⊕ λ 2 (k, t)) ∈ L 0 then 17: Set construction. 1: input: S 1 ⊂ X × {0, 1} n , S 2 ⊂ {0, 1} n × {0, 1} n , ∈ {0, 1} n . 2: output: { e, s 3 : (e, s 1 ) ∈ S 1 , (s 1 ⊕ , s 3 ) ∈ S 2 } . 3: procedure MergeSet(S 1 , S 2 , ) e, s 1 ) ∈ S 1 do 6: if ∃s 3 : (s 1 ⊕ , s 3 ) ∈ S 2 then 7: S 3 ← S 3 ∪ {(e, s 3 )} 8: return S 3At last, the condition ∀(t, m, b) ∈ B : (t, m, b ⊕ γ 5 (k, t)) ∈ L 0 is checking whether the path is consistent with the known tweak/plaintext/ciphertext triples. The additional condition |B| ≥ ν is simply here to ensure a good reduction.

  |L j,i | = |S i | = Q/2 κand there are 2 κ different possible subkeys, the total number of queries to E 1 (•, •) andE 2 (•, •) is Q. The set L 0 records the online queries so that |L 0 | = |S 0 | = Q.

23

  (n+κ) • 3 √ ν implies that |B| = ν in expectation for all guesses of k, good or wrong. If |B| < ν, the test fails as it should. If |B| ≥ ν, we need to look at the second condition, that is: ∀(t, m, b) ∈ B : (t, m, b ⊕ λ 3 (k, t)) ∈ L 0 . When the key guess k is wrong, for a given (t, m, b) ∈ B we have (b ⊕ λ 3 (k, t)) = E(t, m) with a 2 -n

  3: procedure rKeyRecovery( κ, n, κ, E, E 1 , ..., E r , γ 1 , ..., γ r , λ 0 , ..., λ r ) ) • r+1 √ ν 6:for all i ∈ {1, ..., r} do 7:Randomly sample S i ⊂ {0, 1} n with |S i | = Q/2 κ = 2 rn-κ r+1 r+1 √ ν .

  j ∈ {0, 1} κ do 9:for all i ∈ {1, ..., r} do 10:L j,i ← m, E i (j, m) : m ∈ S iOffline Queries Sets 11:Let S 0 ⊂ {0, 1} * × {0, 1} n with |S 0 | = Q be an observable tweak/message set.

L 0

 0 ← t, m, E(t, m) : (t, m) ∈ S 0 Online Queries Set 13:

  r r+1 (n+κ) • r+1 √ ν The Number of Paths. Again, let us derive the constant ν to avoid all false positives in Step 17 of Algorithm 9.3. If |A r | < ν, the test fails as it should. If |A r | ≥ ν, the second condition is satisfied with probability(2 -n ) ν = 2 -ν•n .There are 2 κ -1 wrong guesses so all the tests should fail at least with constant probability when:

  The query complexity of the regular FX attack is O(2 r-1 r n+κ ) offline and 2 n online queries. When κ ≤ n r though, the offline query complexity fall below the online query complexity so it is actually easy to rebalance the query complexity to O(2 r r+1 (n+κ) ) in the same way as our attack. So the total query complexity of the original attack by Gaži[START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF] isO(2 r-1 r n+κ ) or O(2 r r+1 (n+κ) ) when κ ≤ n r .Notice that for a single round this matches the complexity of our attack, that is O(2 r r+1 (n+κ) ) when κ ≤ n.

  If there is no IV , A cannot repeat queries; the notion is deterministic IND$-CPA like in Section 2.1.2. If the IV is random, A is not allowed to choose it and the IV is instead randomly drawn before each encryption; we'll call this notion IND$-CPA-rIV as used in Section 2.1.3. At last, if the IV is a nonce, usually denoted N , A can freely choose the IV but can't repeat twice the same value even for two different messages; we'll call this notion IND$-CPA-N as used in Section 2.1.4.An IND$-CPA secure mode means that any adversary cannot distinguish the ciphertext from a random bit string uncorrelated with the plaintext.

.1) the IND$-CPA security of a mode is understood as the highest advantage against all attacker A, that is Adv IND$-CPA . Because (IV, m) query repetitions would lead to a trivial distinguisher, this game has some variants for restricting the adversary.

Table 3 . 1 :

 31 Algorithm. Wagner's algorithm provides a good time complexity but it has two drawbacks: it is not efficient in terms of queries and it only finds a single solution. A low memory algorithm was first described by Chose, Joux and Mitton[START_REF] Chose | Fast Correlation Attacks: An Algorithmic Point of View[END_REF] and shares some Various asymptotic complexity trade-offs for solving 4-XOR.ideas with Wagner's algorithm. For k = 4 the algorithm essentially repeat Wagner's algorithm for every -bit value α, and merge on α (and not only on zero) as shown in Figure3.2. Concretely, the lists are merged as

	Algorithm Wagner [Wag02] Memory Efficient [CJM02] 2 w/4 2 w/2 Data Time Memory Remarks 2 w/3 2 w/3 2 w/3 Particular solution 2 w/4 Optimal data Nikolic and Sasaki [NS15] 2 3w/8 2 3w/8 2 w/4 Unique function

  For instance a credit card number (or any number) could be encoded in 16 bytes of ASCII before getting encrypted. Because in ASCII the encoding of any digit starts by 0x3 (0x30 to 0x39), we know half of the bits of the plaintext, and we can use the known-prefix sieving with z = n/2. Other examples are information encoded by uuencode that uses ASCII values 0x20 to 0x5F (corresponding to two known bits) or HTML authentication cookies that are typically encoded to some subset of ASCII numbers and letters 1 .

  While the mode is provably AE secure, an easy forgery attack shows that SUNDAE is actually not INT-RUP secure. Concretely, there exists an INT-RUP adversary A such that:

return c 1 c 2 . . . c m RUP Attack on SUNDAE.

  t) is said to be -almost XOR-universal ( -AXU) if for any distinct t and t ∈ T and any Y ∈ {0, 1} n ,

	Pr X
	Based on Definition 6.2, we obtain the following corollary:
	Corollary 6.1. Let > 0, n ∈ N and a finite set T . Consider an -almost uniform function ρ : {0, 1} n × T → {0, 1} n . Then, for any t, t ∈ T , Y ∈ {0, 1} n we have
	Pr((X, X )

$ ← --{0, 1} n : ρ(X, t) ⊕ ρ(X, t ) = Y ≤ . $

  -Mansour interleaving n-bit keys k 1 . . . k r+1 with permutations P 1 . . . P r . It works by : input: E(•) is Even-Mansour with key k 1 . . . k r+1 . 2: output: k 1 . . . k r+1 . 3: procedure AttackrEM(E(•), P 1 (•), . . . , P r (•))

	Algorithm 7.3 Generic attack [Bog+12] on r-round Even-Mansour.
	4:

1

  matching the lower bound of[START_REF] Kilian | How to Protect DES Against Exhaustive Key Search[END_REF]. Key recovery on r-round FX construction[START_REF] Gaži | Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers[END_REF]. E is r rounds FX with k 1 , k 2 , ..., k r+1 and E k 1 , E k 2 , ..., E k r .2: output: (k 1 . . . k r+1 , k 1 . . . k r ) .

	Algorithm 7.5 3: procedure AttackrFX(E (•), E • (•)) 4:

1: input:

  For instance let us use the algorithm of Bouillaguet, Delaplace and Fouque[START_REF] Bouillaguet | Revisiting and Improving Algorithms for the 3XOR Problem[END_REF] using linear algebra to solve the 3-XOR with list of arbitrary sizes inO(|L 0 | • (|L 1 | + |L 2 |)/w)using no more memory than the lists require. In our case this yields a time complexity of O(2 n /(2nd/2)) matching the best known cryptanalysis of 2EM. The memory needed to store L 1 and L 2 is O(2 n-d/2 ), and the total time complexity stays O(2 n /n) for all values of D as long as the lists size does not exceed O(2 n /n), that is as long as D ≥ n 2 . Therefore, a data optimized attack in this setting can set the data complexity to as low as

2 } 11:

(e 0 , e 1 , e 2 ) ← Solver3XOR(L 0 , L 1 , L 2 )

Black-box 3XOR solver with w = 2nd/2.

12:

return e 0 n ⊕ ( e 1 n-d/2 0 d/2 ) Corresponds to x ⊕ y.

Using Known Solvers.

  achieves O(2 n ) sprp-security assuming an ideal underlying block cipher, at the cost of two block cipher calls and a few XORs asE t k (m) = E 2k (t) ⊕ E t⊕k (m ⊕ E 2k (t)). And the XHX construction by Jha, List, Minematsu, Mishra and Nandi[START_REF] Jha | XHX -A Framework for Optimally Secure Tweakable Block Ciphers from Classical Block Ciphers and Universal Hashing[END_REF] which

	λ 0 (k, t)	γ(k, t)	λ 1 (k, t)
	m	E	E k (t, m)
			239

  Distinguishing game in the ideal cipher setting for the sprp security of a tweakable block cipher E where P and p are independent families of independent random permutations (P (t, •) and p(t, •) are two independent random permutations for all t) and k is a random key value.

	m	E 1	E 2	...	E r	E

(•, •

)

P (•, •) P -1 (•, •) Figure 9.3: k (t, m) γ 1 (k, t) γ 2 (k, t) γ r (k, t) λ 0 (k, t) λ 1 (k, t) λ 2 (k, t) λ r (k, t)

Table 9 . 1 :

 91 Some previously proposed schemes and description of how it fits in our iterated tweakable FX generic framework.Multiplications (•) are over a characteristic 2 finite field.

	λ 0 (k, t)	λ 1 (k, t)		λ 2 (k, t)
		γ 1 (k, t)	γ 2 (k, t)
	m	E 1	E 2	E k (t, m)
		Figure 9.5: 2-Round Tweakable FX.

  2 n+κ . We do the same reasoning for B in Step 15:B ← t, m, b : (t, m, a) ∈ A, (a ⊕ λ 1 (k, t), b) ∈ L γ 2 (k,t),2

  m, a : (t, m, ā)∈ A i-1 , (ā ⊕ λ i-1 (k, t), a) ∈ L γ i (k,t),iby Algorithm 9.2 No proper key in the set for all observed tweak/message pairs (t, m). Therefore, in expectation, we have|A 1 | = Q 2 /2 n+κ .Moreover, it is easy to show by induction that|A i | = Q i+1 /2 i(n+κ) in expectation as it is true for |A 1 | and, in expectation and following Step 16,|A i+1 | = |A i | • |S i+1 |/2 n . Thus, we get |A r | = Q r+1 /2 r(n+κ) .

	17:
	18: 19:	return k return ⊥

if |A r | ≥ ν and ∀(t, m, a) ∈ A r : (t, m, a ⊕ λ r (k, t)) ∈ L 0 then

For example, wikipedia.org encodes cookies with lower case letters and digits, this corresponds to two known bits.

https://mzl.la/32PT4x9, accessed September 22, 2020

https://web.archive.org/web/20200620131835/https://censys.io/ipv4/ report?field=22.ssh.v2.support.client_to_server.ciphers&max_buckets=, scan performed over 18

820 servers on June 20, 2020

We can actually reduce the polynomial factors by fixing only (nlog 2 (n))/4 bits to zero, in order to have sets of size 4 √ n • 2

3n/4 .

We construct the kernel of the linear function λi → i λi(xi ⊕ yi)

(n+κ) • 3 √ ν

Remerciements

Part

II

Idealized Designs

Part

I

Modes of Operation

defined as:

-Pr(A $(•),Sim(•,•),⊥(•,•) → 1) , (6.3) with the randomness of k $ ← --{0, 1} κ , $ a random function, and the random choices of Sim and A. The simulator Sim has no access to the first oracle, but it has access to the query history of A. The adversary is not allowed to relay an earlier response from the first oracle to the third oracle.

Then, the AERUP advantage Adv AERUP

•

is the maximum advantage over all A under the best efficient simulator. In other words, the AERUP advantage is Adv AERUP

This will allow us to prove the robustness of ANYDAE in a single go.

Proving the Equivalence. Let us prove that AERUP is equivalent to AE, PA1 and INT-RUP security combined. We showed in Section 2.3.1 the equivalence of AE security with IND$-CPA-AE and EUF-AE combined. So now we proceed the same way with AERUP.

First, we prove that breaking AE breaks AERUP or, equivalently:

Indeed, for any AE adversary A 1 there exists an AERUP adversary A 2 with the same complexity with Adv AE • (A 1 ) ≤ Adv AERUP • (A 2 ) for any Sim. A 2 simply runs A 1 and answer all its queries with the first and third oracles and output the same conclusion. Indeed, the AERUP security game (Definition 6.1) falls back to the AE security game when ignoring the second oracle. Now we wish to prove that breaking PA1 breaks AERUP. In fact, we'll show that breaking PA1 breaks either AERUP or IND$-CPA-AE or, equivalently: The time complexity also includes the time necessary to generate the data.

Their provable security bound is 2 2 3 (n+κ) whenever κ ≤ 2n which matches our attack. Therefore, this attack proves the tightness of their bound and, conversely, their bound proves the optimality of the attack.

Even if we don't know of any construction matching 3 or more rounds of the iterated tweakable FX framework, there seem to be additional security to be gained from iterating further. In Section 9.3 we extend the attack to any number of rounds of the iterated tweakable FX construction. The result is an information theoretic key recovery on r rounds when κ ≤ rn with offline and online query complexity of:

We compare our generic attack with previously known attacks in Table 9.2.

Ref

Scheme r Proof Known Attack Our Generic Attack

[LRW11] LRW1 2 2 n/2 2 n/2 2 2 3 (n+κ)

[LST12] CLRW2 2 2 2n/3 2 3n/4 2 2 3 (n+κ)

[LL18] XHX2 2 2 2 3 (n+κ) 2 n/2+κ 2 2 3 (n+κ)

Table 9.2: Some previously proposed schemes with their known asymptotic bounds.