Elena Andreeva

Maria Naya-Plasencia

David Pointcheval

Yannick Seurin

Je

Thomas Fuhr

Vivek Arte

Mihir Bellare

Ryad Benadjila

Pooya Farshim

Nicky Mouha

Damien Vergnaud

Léonard Assouline

Michel Abdalla

Balthazar Bauer

Thibaut Bagory

Sonia Belaïd

Fabrice Benhamouda

Raphaël Bost

Florian Bourse

Céline Chevalier

Jérémy Chotard

Léo Colisson

Mario Cornejo

Geoffroy Couteau

Edouard Dufour Sans

Del Rafaël

Aurélien Pino

Pierre-Alain Dupin

Ehsan Dupont

Pooya Ebrahimi

Georg Farshim

Romain Fuchsbauer

Junqing Gay

Dahmun Gong

Chloé Goudarzi

Julia Hébant

Hesse

Hieu Duong

Hugo Phan

Pierrick Marival

Thierry Méaux

Brice Mefenza

Michele -Vii Minaud

Lucas Minelli

David Music

Anca Naccache

Michele Nitulescu

Alain Orrù

Antoine Passelègue

David Plouviez

Thomas Pointcheval

Răzvan Prest

Mélissa Roşie

Théo Rossi

Azam Ryffel

Adrian Soleimanian

Bogdan Thillard

Hoeteck Ursu

Quoc Wee

Vu Huy

Anne Canteau

Maria Naya- Plasencia

Lise-Marie Bivard

Joëlle Isnard

Valérie Mongiat

Sophie Jaudon

José Araujo

Aurélie Bauer

Marc Blanc-Patin

Guillaume Bouffard

Colin Chaigneau

Christophe Devine

David El-Baze

Jean-Pierre Flori

Thomas Fur

Henri Gilbert

Patrick Haddad

Eliane Jaulmes

Jérémy Jean

Karim Khalfallah

José Lopes Esteve

Emmanuel Prouff

Jean-René Reinhard

Guénaël Renaud

Mathieu Renard

Manuel San

Boris Simunovic

Adrian Thillard

Aurélie

Chatura

Frédéric, Kawtar Magali Fiona

Romain Mathieu

Ks

l'équipe cryptographie de l'ENS pour toutes les discussions enrichissantes, les pauses-café et autres moments agréables

Keywords: Replacement, Feistel Ciphers, Alternating Feistel, 4, 4, 2 Sliding attack for r-round

This thesis is dedicated to the analysis of modes of operation in the context of disk protection usage. First, we give modes of operation secure in the Full Disk Encryption (FDE) model where additional data storage is not allowed. In this context, encryption has to be length preserving which implies deterministic encryption. However, it is possible to use a value already present in the system, called a diversifier, to randomize the encryption and to achieve a better security. Then, we introduce two methods to analyse symmetric primitive in the very constrained Key-Dependent Message (KDM) model which is of interest for disk encryption since some particular application may store the encryption key in the disk. The Even-Mansour and the Key-Alternating Feistel constructions, which are commonly found in blockciphers, are analysed in this model. Moreover, knowing that data authenticity cannot be ensured in the FDE model because tag storage is not allowed, we relax this constraint which yields two models: the Authenticated Disk Encryption model (ADE) and the Fully Authenticated Disk Encryption (FADE). A secure mode in the ADE model ensures data authenticity of a sector but can be vulnerable to replay attacks; and a secure mode in the FADE model ensures the authenticity of the entire disk even against replay attacks. Besides security (confidentiality and authenticity), performances of the mode need particular attention, indeed read and write delays on a sector is a competitive argument for disk manufacturers since disk performances tightly depend on it. Consenquently, adding extra computation to handle authentication codes does not help which leds us to analyse incremental Message Authentication Codes that have the property to be updatable in a time proportional to the corresponding modification.

v -Tous ceux qui ont déjà rédigé une thèse savent que l'écriture des remerciements n'est pas un exercice facile : je suis sûre d'oublier de remercier certaines personnes qui m'ont aidée, soutenue, conseillée, encouragée ou critiquée afin que je m'améliore tant elles sont nombreuses. Je commence donc par présenter mes excuses à tous ceux que j'ai oublié de citer ci-dessous (et tous ceux que je n'ai pas assez cités).

Dans un premier temps, je tiens à remercier mon directeur de thèse, Damien Vergnaud, qui, avec beaucoup de patience et de bienveillance m'a accompagnée et a dirigé mes travaux durant cette thèse. Je le remercie sincèrement de m'avoir donné l'opportunité de réaliser cette thèse. Je le remercie notamment pour sa disponibilité, sa gentillesse et pour tous les enseignements qu'il m'a apportés.

I would like to express my deepest gratitude to my reviewers: Pierre-

Résumé

Cette thèse est dédiée à l'analyse de modes opératoires pour la protection des disques durs. Dans un premier temps, l'analyse des modes opératoires permettant de protéger la confidentialité des données est réalisée dans le modèle Full Disk Encryption (FDE). Ce modèle est très contraignant puisqu'il exclut tout mode qui ne conserve pas la longueur (la valeur en clair et chiffrée du secteur doivent avoir la même taille) et seuls des modes déterministes peuvent avoir cette propriété. Néanmoins, il est possible de tirer partie d'une valeur du système nommée le diversifiant, qui originellement a un autre but, dans le but d'améliorer la sécurité des modes opératoires. Dans un second temps, nous introduisons deux méthodologies d'analyse dans le modèle Key-Dependent Message, où l'adversaire est autorisé à chiffrer des messages qui dépendent de la clé de chiffrement, qui nous ont permis d'analyser la sécurité des schémas Even-Mansour et Key-Alternating Feistel. Enfin, sachant qu'il est impossible de garantir l'authenticité des données dans le modèle FDE, la présence de codes d'authentification étant nécéssaire, deux modèles où le stockage de métadonnées est possible sont envisagés: le modèle Authenticated Disk Encryption (ADE) et le modèle Fully Authenticated Disk Encryption (FADE). Le premier permet de garantir l'authenticité au niveau du secteur mais est vulnérable aux attaques par rejeu et le second garantit l'authenticité du disque en entier et prévient ce type d'attaque. La securité des mécanismes cryptographiques utilisés pour protéger le contenu du disque n'est pas le seul paramètre à prendre en compte: les vitesses de lecture et d'écriture sont un enjeu de taille pour les constructeurs puisque ces dernières conditionnent fortement les performances d'un disque. C'est la raison pour laquelle, nous avons étudié les codes d'authentification incrémentaux puisque ces derniers ont la propriété d'être mis à jour en un temps proportionnel à la modification réalisée.

Chapter 1

1.1 Disk Protection 3

Disk Protection

Cryptography is a well-known domain aiming at protecting communication and data. A large part of humanity already used cryptography through communication protocols or when accessing securely stored data. Data protection requires secure cryptographic schemes that were, before the introduction of provable security, the result of a ping-pong game between cryptographers, who design and patch schemes when needed, and cryptanalysts who are looking for security flaws in those designs. A scheme that successfully resists years of cryptanalysis does not mean that it is secure, a vulnerability can be found in the future. This thesis aims at analysing symmetric encryption schemes for data at rest with specific constraints. This is all the more important since the proliferation of mobile electronic devices has made it critical to protect the on-device data. Mobile phones or laptops have the unfortunate propensity to be lost or stolen. In case of such an event, the data stored in the device, which may contain extremely valuable and sensitive information, is extremely vulnerable. Users are indeed storing nowadays copies of personal documents (i.e., social security cards, driver's license, financial documents, personal pictures . . . ) on these devices that, if breached, can cause significant problems for them. An important security objective is therefore to ensure the confidentiality of on-device data for mobile devices. This mobile technology setting implies strong constraints on the methods to be used for secure disk storage. The encryption algorithm has to be computationally, and space efficient concerning the storage for reading/writing access of the data.

It is usually assumed that an encryption scheme suitable for the application of disk encryption must be length-preserving for performance reasons. This property reduces the scheme candidates by removing cryptographic schemes that require the storage of additional data such as initialization vectors or tags. This so-called Full Disk Encryption (FDE) method is implemented in a large panel of devices, from the compact and widespread ones like smartphones but also to the larger ones more fitted to industrial needs such as data center servers, reflecting its importance. FDE, properly used, is known guarantee the confidentiality of every bit in the disk at a low level (e.g., sector level). Obviously, reading and writing operations in a disk should suffer as little as possible from performance degradation that occurs when FDE technology is deployed. This goal requires FDE to have random access to every single sector on the drive and impacts different layers in a device: from the disk memory cells to the operating system.

FDE is now a mainstream technology that provides confidentiality but unfortunately does not provide cryptographic data integrity protection. However, if data confidentiality is necessary, it is perhaps even more critical to prevent data alteration. A system using a memory should detect and alert the user when undesired modifications appear on the disk. Up to now, most disk encryption solutions rely on the so-called poor-man's authentication to ensure integrity, meaning if an attacker alters some encrypted data on the disk, the corresponding plaintext will be scrambled unpredictably, and the operating system or the application would notice that and gives an alert. However, in practice there exist applications that ignore errors in important data and simply change behavior (e.g., if the security configuration file does not parse, then the application simply ignores it). This poor-man's authentication approach is not cryptographically viable and stronger integrity should be provided. This protection comes with a cost: any authenticity oriented cryptosystem needs at least to store authentication tags and it seems that some latency will be added due to extra read/write accesses and tags' computation. Having said that, it is important to analyse if a cryptographic mechanism guarantees data authenticity with minimal performance impact and minimal storage.

In this thesis, we present cryptographic constructions specifically designed for disk protection, or at least very suitable for this usage and their security is analysed with security proofs.

Provable Security

The security analysis of any scheme is not only reduced to ensure that it is not vulnerable to all the known attacks, this is not enough. A new attack can be found every day. This is why provable security was introduced in the seminal paper [START_REF] Goldwasser | Probabilistic encryption[END_REF] by Goldwasser and Micali. Its principle is that to prove that a cryptographic scheme satisfies some security property, we must show that no algorithm running in polynomial time can be able to break this security property assuming some mathematical assumptions. The security argument is a reduction that uses an algorithm A against a cryptographic scheme to break the mathematical assumption which means that breaking the security property of the scheme implies attacking the mathematical assumption. To do so, a first step is to specify the security model which is the definition of the security property and the adversarial model. The security property specifies what it means to the cryptographic scheme to be secure, and the adversarial model specifies what actions the adversary is allowed to do and what information he is allowed to know. All cryptographic schemes proved in this thesis have been analysed in the framework of "reductionist security" (with a concrete security approach).

Adversary. Following Church-Turing thesis, an adversary is a probabilistic Turing machine (or algorithm, or program) which can be computationally bounded or unbounded. It is denoted A O(.) meaning it has access to an oracle O(.).

Games. For computationally bounded adversaries, we use the game-based framework of Bellare and Rogaway [START_REF] Bellare | The security of triple encryption and a framework for code-based game-playing proofs[END_REF]. A Game is a program that is run with an adversary A. The adversary interacts with procedures, usually called oracles, specified in the game Game. A game Game starts with a Initialize procedure, follows with a non-negative number of additional procedures called oracles, and ends with a Finalize procedure. If Finalize is omitted it is understood to be a trivial procedure that simply returns its output. Execution of adversary A with game Game consists of running A with oracle access to the game procedures, with the restrictions that A's first call must be to Initialize (if present), its last call must be to Finalize, and it can call these procedures at most once. The output of the execution is the output of Finalize. By Pr[Game(A)] we denote the probability that the execution of game Game with adversary A results in this output being true. In games, integer variables, set variables and boolean variables are assumed initialized, respectively, to 0, the empty set ∅, and false.

Notations and Definitions

We now introduce basic notations and definitions used all along this thesis. Other notations and definitions, relevant only in specific sections, are introduced when needed.

First, we let N := {0, 1, . . . } denote the set of non-negative integers, and {0, 1} * denote the set of finite binary strings.

Binary strings. For two binary strings X and Y , X||Y denotes their concatenation and (X, Y ) denotes a uniquely decodable encoding of the pair X and Y . For X ∈ {0, 1} * , we use |X| to denote the bit length of X and |X| denotes the number of -bit block in the binary string X (and in particular |X| 1 = |X|). For n ∈ N, the set of all binary strings whose length is a multiple of n is denoted {0, 1} n * . For s ∈ {0, 1} n * , we also wrote s = s [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||s [2]|| . . . s [n] for

s[i] ∈ {0, 1} n .
Sets. We denote by #S the number of elements in the set S. The complement of a finite set S is denoted S. By x ← ← S, we mean sampling x uniformly from set S. By Pr[A], we mean the probability that the event A happens.

List. For a finite list L such that L = {(x i , y i ), i ∈ {0, .., n} where #L = n, we denote by Dom(L) the domain of L Dom(L) = (x 1 , .., x n ) and by Rng(L) the range of L Rng(L) = (y 1 , .., y n ). We denote appending element X (resp., a list L ) to a list L by L : X (resp., L : L ) and L ← [] initializing a list to empty.

Object access. The description of cryptographic scheme CS can be given a tuple CS := (A, B, . . . , C)

where each element can be a parameter of the scheme or an associated algorithm. The notation CS.A refers to the parameter or algorithm A of the scheme CS. Sometimes, it can be simply denoted by A if the corresponding scheme CS is clear by context. Often D = {0, 1} and R = {0, 1} L for ( , L) ∈ (N \ {0}) 2 . In the following, a random function F * refers to a function uniformly sampled at random in the set F * (D, R). We denote the composition of the same function F, i-th times, on a value x ∈ D such that

F i (x) = F • • • • • F(x).

Definition 1.3.2. (Permutations)

The set of all permutations is the subset of all bijections in F * (D, R) denoted P * (R) such that D = R .

Often R = {0, 1} L for L ∈ N \ {0}. In the following, a random permutation P * refers to a function uniformly sampled at random in the set P * (R).

Definition 1.3.3. (Function Family)

A function family F is a map F : K × D → R where the set of keys K, the domain D and the range R are finite non empty sets. The function F takes two inputs: a key K ∈ K and an argument x ∈ D and returns a value y ∈ R such that F(K, x) = y. Each key K ∈ K defines a map F K : D → R such that F K (x) = F(K, x) = y. Then F K denotes only one instance of the function family F.

A pseudorandom function family (PRF) is a function family which behaves like a random function for a computationally bounded adversary (e.g., input and output behavior). More formally, we have the following definition. Each key K ∈ K defines a permutation P K : D → R such that P K (x) = P(K, x) = y. Then P K denotes only one instance of the function family P.

A pseudorandom permutation family (PRP) is a function family which behaves like a random permutation for a computational bounded adversary (e.g., input and output behavior). More formally, we have the following definition. Definition 1.3.6. (Pseudorandom permutation family) A pseudorandom permutation family P = (KS, Dom, eval, inverse) is a permutation family P whose key space and domain are denoted respectively P.KS and P.Dom and F.Rng together with two algorithms eval and inverse such that for all K ∈ P.KS and for all x ∈ P.Dom, P.eval(K, x) outputs P(K, x) and P.eval(K, P(K, x)) outputs x. We define the prp-advantage of an adversary A against a pseudorandom permutation family P is defined in terms of the probability of success in the PRP game G prp P,A as defined in the right of Figure 1.1, as Adv prp P (A) = 2 • Pr G prp P,A -1.

In the following, for simplicity, we will denote P(K, x) instead of P.eval(K, x) and P -1 (K, x) instead of P.inverse(K, x). Definition 1.3.7. (Blockciphers BC) Given two non-empty subsets K and M of {0, 1} * , called the key space and the message space respectively, we let Block(K, M) denote the set of all functions E : K × M -→ M such that for each K ∈ K the map E(K, •) is (1) a permutation on M and (2) length preserving in the sense that for all M ∈ M we have that |E(K, M )| = |M |. Such an E uniquely defines its inverse D : K × M -→ M. A blockcipher for key space K and message space M is a triple of efficient algorithms BC := (K, E, D) such that E ∈ Block(K, M) and its inverse is D.

A blockcipher BC is therefore a pseudorandom permutation family with key space K, domain M and algorithm eval = E and inverse = D. In more detail, K is the randomized key-generation algorithm which returns a key K ∈ K. Typically K = {0, 1} k for some k ∈ N called the key length, and K endows it with the uniform distribution. Algorithm E is the deterministic enciphering algorithm with signature E : K × M -→ M. Typically M = {0, 1} n for some n ∈ N called the block length. (3) D is the deterministic deciphering algorithm with signature D : K × M -→ M. Thus a blockcipher is correct in the sense that for all K ∈ K and all M ∈ M we have that D(K, E(K, M )) = M . It is also length preserving. (Note that length preservation follows from correctness if M = {0, 1} n ). A permutation on M is simply a blockcipher with key space K = {ε}. We denote a permutation with P and its inverse with P -. A permutation can be trivially obtained from blockcipher (by fixing the key). For a blockcipher BC := (E, D), notation A BC denotes oracle access to both E and D for A. We abbreviate Block({0, 1} k , {0, 1} n ) by Block(k, n) and Block({ε}, {0, 1} n ) by Perm(n).

Definition 1.3.8. (Ideal-cipher Model ICM)

The ideal cipher for key space K and message space M is the uniform distribution over Block(K, M). The Ideal-Cipher Model (ICM) with key space K and message space M is a model of computation where all parties, honest or otherwise, have an oracle access to a uniformly chosen random element in Block(K, M) together with its inverse. The ideal-cipher model when restricted to K = {ε} gives rise to the random-permutation model (RPM).

Our contributions 1.4.1 Full Disk Encryption Modes

In Chapter 3, we revisit the problem of Full Disk Encryption (FDE), which refers to the encryption of each sector of a disk volume. In the context of FDE, it is assumed that there is no space to store additional data, such as an IV (Initialization Vector) or a MAC (Message Authentication Code) value. We formally define the security notions in this model against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA). Then, we classify various FDE modes of operation according to their security in this setting, in the presence of various restrictions on the queries of the adversary. We will find that our approach leads to new insights for both theory and practice. Moreover, we introduce the notion of a diversifier, which does not require additional storage but allows the plaintext of a particular sector to be encrypted to different ciphertexts. We show how a 2-bit diversifier can be implemented in the EagleTree simulator for Solid State Drives (SSDs), while decreasing the total number of Input/Output Operations Per Second (IOPS) by only 4 %. These results were the subject of a publication at CT-RSA 2017 entitled "Full Disk Encryption: Bridging Theory and Practice" with Nicky Mouha and Damien Vergnaud.

Key-Dependent Message Security

Chapter 4 is dedicated to Key-Dependent Message security. The Key-Dependent Message (KDM) security model enables to analyse the security of a scheme even when the messages depend on the secret key. This approach is relevant for full disk encryption as the whole disk is encrypted, the encryption key or a function of the encryption key can end up in the disk. Two contributions analyse the KDM security of two constructions widely used as the basis for blockcipher design with different security proof techniques: the iterated Even-Mansour (EM) ciphers also known as the Key-Alternating Ciphers is analysed with a particular framework and the Key-Alternating Cipher (KAF) is analysed with the H-Coefficient technique.

The analysis of the KDM security of the iterated Even-Mansour ciphers is a joint work with Pooya Farshim and Damien Vergnaud; it was published with the title "Security of Even-Mansour Ciphers under Key-Dependent Messages" at IACR Transactions on Symmetric Cryptology in 2018. The iterated Even-Mansour ciphers form the basis of many blockcipher designs. Several results have established their security in the CPA/CCA models, under related-key attacks, and in the indifferentiability framework. We also formalize the folklore result that the ideal cipher is KDM secure. We then show that EM ciphers meet varying levels of KDM security depending on the number of rounds and permutations used. One-round EM achieves some form of KDM security, but this excludes security against offsets of keys. With two rounds we obtain KDM security against offsets, and using different round permutations we achieve KDM security against all permutation-independent claw-free functions. We also present some KDM-attacks on some EM ciphers. As a contribution of independent interest, we present a modular framework that can facilitate the security treatment of symmetric constructions in models that allow for correlated inputs.

The analysis of the KDM security of the Key-Alternating Feistel (KAF) constructions is a joint work with Pooya Farshim, Yannick Seurin and Damien Vergnaud. We use a different technique to analyse the KDM security of KAF schemes and this time, the analysis is based on the H-coefficient technique. We give a general approach to analyse KDM security of blockciphers and we apply it to the 4-round KAF. This security result gives properties on the KDM set of functions that the adversary can ask to encrypt to have a secure scheme. Moreover, we describe a KDM-attack against 4-round KAF if those properties are not respected (and additional attacks on other KAF schemes).

Incremental MACs

An interesting feature for disk protection is integrity but using regular authentication schemes has a severe impact on performances that is why in Chapter 5, we analysed some constructions to minimize as much as possible the slowdown of performances: the incremental MACs. Introduced in cryptography by Bellare, Goldreich and Goldwasser in 1994, incrementality is an attractive feature that enables to update a cryptographic output efficiently like a ciphertext, a signature or an authentication tag after modifying the corresponding input. This property is very valuable in large scale systems where gigabytes of data are continuously processed (e.g., in cloud storage). Adding cryptographic operations on such systems can decrease dramatically their performances and incrementality is an interesting solution to have security at a reduced cost.

On the one hand, we analyse the security of the original Xor-scheme construction proposed by Bellare, Goldreich and Goldwasser in [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF] and based on a chained structure as defined in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF]. We provide an attack that breaks the Xor-scheme basic security claimed by the authors 1 . It succeeds with probability 1 using only one MAC query. It takes advantage of the chaining structure of this scheme and some XOR function properties. This attack is very simple and it is surprising that it remained unnoticed until now (especially since the paper [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF] appeared in a major computer science conference and was extensively cited since 1994). We analyse our attack and the original Xor-Scheme to find where its security breaks down. We show that the main flaw is that the Xor-Scheme does not explicitly take into account the document length and we noticed that adding the number of data blocks to the construction prevents this kind of attack. We analyse different ways to patch the scheme by introducing the document blocklength in the construction and found that the scheme can still be weak for some options. We propose a modified version of the Xor-Scheme and prove its basic security. Our security proof for the patched Xor-Scheme uses tools from the unchained XOR-scheme security proof [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF]. This result was published in a paper co-authored with Damien Vergnaud and entitled "Analysis and Improvement of an Authentication Scheme in Incremental Cryptography" which was published at SAC 2018.

On the other hand, we revisit incremental MAC security notions by giving clear security games for basic security where an adversary can call for update operations only on untampered documents and tamper-proof security game where the adversary can call for update operations on modified documents. We compare the relative strengths of our new security notions and we provide generic constructions. Moreover, we analyse existing incremental constructions and we provide a new scheme using our security proofs which is the first one achieving some kind of tamper-proof security called IUF2 (as formalized by our new model). This part of the chapter is a joint work with Vivek Arte, Mihir Bellare and Damien Vergnaud.

This chapter aims at giving in a first place a state-of-the-art of cryptographic constructions used in FDE model and the reason for their design induced by storage constraints and performance goals. Then we formalize new models where, in addition to confidentiality, two levels of data authentication at low-level are possible. In section 2.1, data at rest threats are analysed to present adversary models and explain which adversary model FDE covers and which one it does not. Disk storage technologies are described in order to extract disk storage constraints. In section 2.2, the challenge of FDE is to take into account these constraints to maintain the device performances. In this context, performance impacts different aspects of a device and developers have to consider specific implementation choices for different components and layers. This leads to numerous types of FDE products. Section 2.3 explores the possibility to add data authentication. Two strategies of data authentication are detailed: local and global authentications. The first one protects authentication at a block level but does not prevent replay attacks where an adversary tries to restore a former version of the disk content. The second one protects the entire disk even against replay attacks by using specific authentication schemes that have the property to be incremental. An incremental authentication scheme enables to generate a tag on an input once and then for any modification; the tag is updated instead of being re-computed from scratch. The implications of these authentication schemes in terms of storage and update time are analysed and discussed.

Data Protection and Data Storage

Data Protection

Nowadays, the need for user data protection has become a critical matter, even more, emphasized by democratized cheap outsourced storage and the constant rise of mobile devices. For various reasons, a user (the device owner) can let his mobile device unattended, e.g. when attending a meeting or doing sport. A device may be sent for repair, sold to someone else, lost or stolen. It is also common that a device has to be given to legal authorities during checks in airports or when entering a police station. These examples are ordinary situations where a third party can have access to the user data stored in the disk even if the device is switched off. Unfortunately, the user is not always aware of potential threats when this third party is an adversary.

Devices. In the following, a device refers to a system that runs autonomously with a persistent memory to protect. FDE concerns data at rest stored in the disk only. Data is encrypted before being stored in the disk and decrypted after being loaded from the disk which means that the disk should always store data encrypted 1 . Data is said to be encrypted and decrypted "on the fly". From a data at rest perspective, devices can be classified by the data size to protect, their power on and off cycle frequency, the number of users and so on. A server stores terabytes of data, it can be used by multiple users as it is a shared resource. It is commonly used in professional environments where critical material is stored in a shared appliance that is owned by the company or just rented for commodity (cloud). A desktop computer or a laptop is used by fewer users than a server and has a smaller disk but is powered off more often than a server which has to be running almost all the time. A smartphone or a digital tablet is usually used by a single user. As they become more and more powerful, they can almost be used as laptops and store sensitive data like contacts, business data, personal data or passwords. These devices are designed to be small and mobile to be taken everywhere: in the street, public transportation, at work and so on which render them easy to lose or to steal. We can mention smartwatches, biomedical devices and IoT devices which can store data at rest. Another category is USB thumb drives and disks which are dedicated to storing data at rest and are powered off very often when unplugged from a computer. The power on/off cycles frequency of a device is an important factor: FDE protects data against unauthorized access only when a machine is powered off. In other system states (running and sleep modes) FDE is not sufficient and additional protections are required due to the presence of the encryption key in the RAM for instance.

Threat Models. All these devices store some amount of data that need to be protected in confidentiality, and different solutions exist depending on the model (architecture and adversary). In the following, we gather all these scenarios in three main attack categories according to how the adversary accesses the disk.

1. Single passive access to the disk. When a device is stolen or lost, the user wants to be assured of his data confidentiality: anyone except the user should learn no information about the disk data. When the disk is encrypted, the adversary has access to encrypted data, and he aims at discovering some information about the corresponding plaintexts. As examples, he can cryptanalyse the cryptographic algorithms, or he can compare some parts of the disk to others.

2. Multiple passive access to the disk. It encloses -1-but here the adversary is more powerful as he can make copies of the disk at different times. The adversary can analyse these copies in order to track modifications on the disk. Later, we will see that even with a strong FDE encryption mode, an adversary is able to recognize if the same value was stored in the same place at different moments and he knows exactly which parts have been changed between two copies.

3.

Active access to the disk. This scenario encloses -1-and the adversary can tamper with the disk data. These attacks are also known as "active attacks" [START_REF] Gjøsteen | Security notions for disk encryption[END_REF]. As an active attack, we can think about silent data corruption [BAA + 08] even if it is not an intentional attack as it can be due to random hardware failures. This issue is usually solved by checksums and CRC32 [START_REF] Sheinwald | Internet protocol small computer system interface (iscsi) cyclic redundancy check (crc)/checksum considerations[END_REF] is the most used one.

Another case is an adversary that succeeds to perform malicious modifications in the disk without the user realizing it. He can also tamper with the disk, and they can give it back to the user. After that, the user works with his disk as usual without knowing that his data are corrupted. An example is a copy-and-paste attack where a disk is shared between a user 1 and a user 2: the malicious user 1 copies data from the user 2 part of the disk and pastes it in its own part. As in many FDE tools, a unique key is used for the entire disk (more details in section 2.2.1); user 1 could be able to decrypt user 2's data.

In addition to data confidentiality, the user wants to be able to check the authenticity of the data he is using. A specific tampering attack is what we can call a "Downgrade attack" or a "replay attack": the adversary snapshots the entire disk at time t and waits for a specific moment to restore it. The desired property to thwart this is a so-called temporal data authentication: at any moment, the user wants to be sure that the data he is manipulating now is the data stored during the previous legitimate manipulation.

For each category, an adversary can perform online attacks which means that it has physical access to the device to perform his attacks. As a consequence, he can attack the disk content but also the other components including hardware components. Otherwise, if it performs offline attacks, we suppose that he has no access to the entire device but only to the raw disk memory content, i.e. storage memory cells bits.

Attacks out of scope. Many other attacks [START_REF] Müller | A Systematic Assessment of the Security of Full Disk Encryption[END_REF] can be performed when the disk is in use. An adversary can try to freeze and extract cryptographic secrets from the Random Access Memory (RAM) when the disk is in use to decrypt the disk afterwards. This attack is known as a cold boot attack [GM14, MTF12, CK10, Sim11]. The encryption key can also be recovered through side channels by observing data manipulations on the disk and exploiting physical leakage such as power consumption or electromagnetic radiations [START_REF] Unterluggauer | Exploiting the physical disparity: Side-channel attacks on memory encryption[END_REF]. A malware can also infect a device in order to spy on the legitimate user password and other secrets; this is the Evil Maid attack2 as exhibited in [START_REF] Rutkowska | Evil maid goes after truecrypt[END_REF][START_REF] Kleissner | Stoned bootkit. Black Hat[END_REF][START_REF] Tereshkin | Evil maid goes after PGP whole disk encryption[END_REF][START_REF] Götzfried | Analysing android's full disk encryption feature[END_REF].

Attack families -1-and -2-threaten data confidentiality whereas scenario -3-is also a threat to their authenticity. In the next section, disk architectures are detailed to highlight specific disk features that have to be taken into account to choose a disk protection mechanism.

From Disk Storage to Data Encryption

In this section, a simplified description of a system is provided in order to understand what is full disk encryption and the differences between FDE products. First, let us define the taxonomy of the subjects that are of interest when studying FDE. At the highest level, we consider systems running operating systems (OS) and hosting applications. The core and privileged component of the OS is its kernel. In a nutshell, when a system is powered on, the first piece of code executed is called the BIOS, which runs in chain specific components in order to execute the kernel. After the boot, the kernel handles the memory and peripherals. It manages data stored in the disk through different virtualization layers as shown in Figure 2.2. Simply put, from an end-user perspective, data is abstracted in the form of files. All the files are aggregated in a filesystem, and filesystems can be stored in volumes or partitions (a volume can be split among different partitions). The kernel handles physical disks through partitions with specific drivers in charge of low-level reading and writing operations. As shown in The physical disk contains a controller and non-volatile memory units to store data sectors. The controller is usually a dedicated micro-controller with embedded firmware that deals with the commands received from the kernel driver and manages the internal non-volatile memory depending on the disk technology (see Figure 2

Kernel (Host)

Hard Disk Drive

The older and well-known technology is the Hard Disk Drive (HDD) that is essentially composed of platters. It can be read and written by a mechanical arm handled by the disk controller. Each drive has one or more disk platters, each with two magnetic surfaces. The platters are coated on both surfaces with magnetic particles, allowing to store and retrieve data in the form of zeros and ones by polarizing the relevant area. Information on the disk surface is located on a set of concentric rings called tracks. The tracks on each platter are in turn divided into a number of sectors as shown in Figure 2 As already stated, the controller communicates with a driver through a specific interface using a protocol that enables write and read commands depending on sector numbers also called the Logical Block Addresses (LBA).

Solid State Drive

The physical composition of a Solid State Drive (SSD) is totally different. SSDs are flash memory devices that are gradually replacing the HDDs due to improved performances. Similarly to magnetic drives, they are logically sector-addressable devices. The flash memory cells of an SSD (see Figure 2.4) are hierarchically organized as a set of flash chips called packages, which are further divided in dies, planes, blocks3 and pages. Every page consists of one or more sectors and is the smallest unit that can be written. The smallest unit that can be erased is a block. Invalidated blocks must be erased before writing. The Flash Translation Layer (FTL) stores the mapping between LBAs and Physical Block Addresses (PBAs). This FTL ensures an even distribution of writes to every sector number (wear leveling) and, it invalidates blocks so that they can later be recycled (garbage collection). The FTL is necessary due to the physical constraints of flash storage: any physical address can only be written a limited number of times, and rewriting individual sectors is not possible: invalidated sectors can only be recovered in multiples of the erase block size. The FTL implements an abstraction layer to be compatible with systems using HDD: the driver reads and writes sectors using LBA. Disk interfaces such as PATA or SATA have different physical link properties, speed and communication protocols but they all enable access to sector granularity. The driver and other components from the OS manage data and optimize read and write access.

Physical and Logical sectors

The physical sector is the sector used internally in the disk, and the logical sector is the one presented to the host by the disk controller. The kernel asks to write at least one logical sector and, this operation is atomic from its point of view: the host cannot ask to write less than one sector. Historically, the HDD had 512-byte length sectors that were presented to the host so, at the time, the logical and the physical distinction did not exist. To read and write disk data efficiently, the OS used a unit called a page 4 that is a virtual unit composed usually by eight logical sectors. A page is the smallest unit the OS can read and write and, its size is a multiple of logical sector size. OS storage page size is commonly chosen to match the virtual memory page size: this allows file system transfers between disk and RAM, caching and read/write operations to be optimized. Nowadays, disk manufacturers are able to produce disks with longer sectors of 4096 bytes on par with the OS page size to increase disk performance at the lowest native level. Due to this heterogeneous situation regarding logical and physical sectors sizes, the Advanced Format standard has been created to specify various compatibility modes.

Full Disk Encryption

Challenges

Encryption can be implemented at different levels: from file to sector-based encryption (see Figure 2.2). File encryption aims at encrypting independently each file with different keys and usually without encrypting the corresponding meta-data. With filesystem encryption, the files and the meta-data (including the internal hierarchy) are encrypted as implemented in ecryptfs [Tec] for instance. Volume encryption, partition encryption and disk encryption use a block-oriented encryption known as Full Disk Encryption (FDE). Block refers to a sector which is the disk data unit. It is also known as Low-level full disk encryption or whole disk encryption [START_REF] Tereshkin | Evil maid goes after PGP whole disk encryption[END_REF]. An advantage of FDE is that it ensures unconditional encryption of all the data stored in the disk, instead of selectively encrypting only the data to be kept secret. This is an advantage over file level encryption where extra data like the number of files or the file size cannot be encrypted. Hence, FDE has an interesting feature to ensure confidentiality for all the data while being transparent for the user. These advantages are even more important for organizations and companies where data protection must be enforced in contexts where human errors are unavoidable. FDE cost. Disk memory access is time-consuming, and it is a critical issue for manufacturers and academic research. Software and hardware manufacturers made huge efforts to optimize memory accesses and succeeded to achieve tremendous advances in memory latency. Memory subsystems are tuned as much as possible with cache memories and fast SRAM memory chips to speed up computer capabilities. Adding an encryption layer could affect performance drastically. FDE framework developers try to integrate encryption that takes into account this optimization work. A consequence is that FDE is length-preserving: all the sectors are encrypted independently without additional data; otherwise sector (un)alignment management becomes a problem. Moreover, most FDE implementations aim at being compatible with a maximum number of systems. A large panel of FDE frameworks tries to defeat different adversaries by implementing encryption at different layers and by managing the key differently. Key management. To perform decryption, the user has to provide a secret; it is usually a password or a pin code. The secret will unlock the disk encryption key, and this key is then used to decrypt the whole disk. More complicated key managements are also implemented in some devices, but in this chapter, we consider the classical FDE encryption schemes where the whole disk is encrypted with a unique key. This choice is due to shared disk usage, password modification and backup. The disk encryption key is encrypted with another key derived from a user password. This provides the ability to encrypt the key encryption key for different users with independent passwords. It is also useful in cases where a user wants to change his password without re-encrypting the whole disk (which would prove very inefficient), and allows to set up a backup password. Popular and well known key derivation functions are scrypt [START_REF] Percival | The scrypt password-based key derivation function[END_REF] and PBKDF2 [START_REF] Josefsson | Pkcs# 5: password-based key derivation function 2 (pbkdf2) test vectors[END_REF] because of their resistance to brute force attacks. These functions take as parameters the user secret, a random salt and a number of iterations. The random salt prevents rainbow attacks [KKJ + 13] where the adversary has pre-computed hash tables for different passwords. A large number of iterations slows down slightly the legitimate user that computes it once, but it aims at making the computation time of the brute force attacker umpractical because it has to evaluate the key derivation function a very large number times. The minimum salt size recommended for PBKDF2 by the standard PKCS#5 [START_REF] Josefsson | Pkcs# 5: password-based key derivation function 2 (pbkdf2) test vectors[END_REF] is 64 bits. In 2017, NIST recommended at least 1 000 iterations [START_REF] Grassi | Digital Identity Guidelines, Authentication and Lifecycle Management[END_REF] and specifies that more iterations are better as long as it is acceptable for the device to compute one evaluation of the derivation function (the appropriate number is 10 000 000 [START_REF] Grassi | Digital Identity Guidelines, Authentication and Lifecycle Management[END_REF]). Nowadays, attackers can use mainstream GPUs, FPGAs or dedicated hardware like ASICs to drastically speed up and parallelize the key derivation evaluation to recover passwords [START_REF] Visconti | Exploiting an hmac-sha-1 optimization to speed up pbkdf2[END_REF]. This is the reason why the memory-hard functions [ACP + 17] like scrypt have been designed. The idea is that if the computational time is divided by some factor, it should cost an increase in space by the same factor. Another independent key (specific to a device) can be added as a parameter in the key derivation function. When this key is hardware bound and protected by a hardened circuit (like eFuses [RFC + 07] in recent processors and SoCs), offline attacks become impossible, and the adversary is forced to perform online attacks with the devices as an oracle: brute force exhaustive search becomes impractical even with dedicated hardware components. This is mostly the case for mobile phones that embed Secure Elements and/or hardened hardware: a fused AES-256 key called UID for iPhones 5 [App18] and a key used by the hardware-backed KeyMaster module for Android devices [START_REF] Loftus | Android 7 file based encryption and the attacks against it[END_REF].

The location of the key management, the kernel driver or the disk controller, is a way to define two families of FDE products: the first one called Self-Encrypted Disks (SEDs) corresponds to stand-alone systems performing encryption/decryption inside the disk by the controller and the other corresponds to implementations performing encryption/decryption in software on the host side.

Standard Encrypted Disks . A standard disk (either HDD or SSD) usually aims only at storing data without encryption. Software FDE solutions like dm-crypt[dm-19a] (Linux), Bitlocker [START_REF] Ferguson | AES-CBC + Elephant diffuser: A Disk Encryption Algorithm for Windows Vista[END_REF] (Windows), FileVault [START_REF] Choudary | Security analysis and decryption of filevault 2[END_REF] (MacOS), Truecrypt/Veracrypt 6 (multiplatforms) [ver19] perform encryption through a computer and store the encrypted data in the standard disk. Even though such implementations can take advantage of hardware accelerated instructions such as AES-NI, we refer to them as software based solutions as opposed to dedicated hardware solutions where most of the FDE logic is performed in dedicated controllers. In software oriented solutions, the standard disk does not manipulate raw user secrets neither the raw cryptographic key but the host does. An adversary can take advantage of this by targeting the RAM yielding attacks denoted "out of scope" previously in this section. In this case, the adversary has access to the standard disk and aims at breaking confidentiality.

Self-Encrypted Disks. In SEDs, encryption is performed by some dedicated hardware component in the disk itself. The SED is supposed to be unlocked only by the legitimate user. The user authentication is performed directly on a SED interface like a pinpad or through a trusted computer. Then the storage device performs the encryption/decryption on the device and the encryption key should never leave the device [START_REF] Müller | Self-encrypting disks pose self-decrypting risks[END_REF].

Software/Hardware Implementation. Software implementations are easy to develop and maintain contrary to hardware implementations. But hardware implementations have the advantage to be dedicated to encrypt data making them more efficient, reliable [START_REF] Bar-El | Security implications of hardware vs. software cryptographic modules[END_REF] and potentially more resistant to attack vectors such as side channel leakage. Such advantages explain that SEDs are usually found at a higher price compared to software based solutions. Different SEDs were analysed in [START_REF] Meijer | Self-encrypting deception: weaknesses in the encryption of solid state drives (ssds)[END_REF] and the authors exploited flaws in the firmware of the micro-controllers handling the hardware encryption. This study disproves the common belief that hardware FDE solutions are more secure than software based one. Building a secure FDE solution is however not straightforward, it is a complex mechanism that that involves a versatile skill set. The resistance of the cryptographic mechanism, the key derivation function, the usage of hardware keys are not sufficient: the encryption and the firmware implementations are also part of this mechanism and none of them should be neglected. Having the control of the entire design and production chain, which is the case for SEDs and some smartphones, can help but comes at some cost regarding the implementation neatness and consistency.

Performance. The performance of a FDE solution can encompass the execution time and for some specific usages power consumption. The execution time depends essentially on the cryptographic algorithm, the way the tool is implemented, the number of the read and write operations. The cryptographic algorithm efficiency includes among others its structure (number of basic operations), its parallelization capabilities for encryption and decryption, the key size. An implementation can be more or less optimized to speed up the execution time. And a dedicated hardware implementation should have a smaller execution time than its software version. Obviously, read and write operations on the disk should be minimized. It is desirable to limit the power consumption of the system for cost efficiency reasons. For some of them like smartphones, it is crucial because the usability of the smartphone depends on its battery: using too much power on cryptographic computations and extra read/write operations on the memory for data protection is not an interesting deal. It is therefore suitable to have an FDE mechanism that limits energy consumption [START_REF] Fujimoto | Comparing the power of full disk encryption alternatives[END_REF].

FDE and Cryptography

As argued above, writing and reading a sector have to be as quick as possible which implies that encryption/decryption delays have the same requirement. That is why each sector is encrypted independently and encryption relies on blockciphers for their time performance.

A secure blockcipher reveals no information about the plaintext knowing the ciphertext as long as the key is randomly sampled and kept secret. Today, the most used blockcipher is AES (128 bits block length). The sector length is a multiple of the blockcipher length and a secure encryption mode has to be used because using sequentially7 the blockcipher on the sector content will lead to insecure encryption. A full disk encryption mode uses the same key [START_REF] Gjøsteen | Security notions for disk encryption[END_REF][START_REF] Khati | Full disk encryption: Bridging theory and practice[END_REF] to encrypt the whole disk and it can be the case that the key is composed by sub-keys or used to derive sub-keys. A widespread FDE mode is CBC-ESSIV [START_REF] Fruhwirth | New methods in hard disk encryption[END_REF] for "Cipher Block Chaining-Encrypted Salt-Sector IV". This mode is a CBC mode where the Initialization Vector (IV) is derived from the sector number. In CBC mode, the IV is required for decryption and it is stored as a first block in the ciphertext which is not possible for length preserving encryption. That is why, in CBC-ESSIV, for each sector, the IV is the encryption of the sector number s under a different key k' and the plaintext block are encrypted using the key k. The keys k and k have to be different otherwise this mode is vulnerable to sliding attacks [START_REF] Rogaway | Nonce-based symmetric encryption[END_REF]. This mode is parallelizable for decryption only and it is secure for an adversary belonging to the threat models -1-and -2-. This mode is less and less used and it should not be used because of its vulnerability to malleability attacks. A malleability attack consists in applying a transformation on a ciphertext block i and knowing the impact on the plaintext. To be able to perform a malleability attack, the adversary must have an active access to the disk (theat model -3-). For CBC, flipping the j-th bit on the ciphertext block i will lead to decrypt the plaintext block i + 1 correctly but with the j-th bit also flipped as shown in Figure 2.6. The i-th plaintext, which is 128 bits for AES, is randomized. This attack has severe impacts: a plaintext bit can be flipped at any position which gives the power to the adversary to change the plaintext block the way he wants. Practical attacks are demonstrated by Lell in [START_REF] Lell | Practical malleability attack against cbc-encrypted luks partitions[END_REF] on dm-crypt. In the bitlocker solution, the elephant diffuser component [START_REF] Ferguson | AES-CBC + Elephant diffuser: A Disk Encryption Algorithm for Windows Vista[END_REF], which is a keyed diffuser, is applied to the entire sector plaintext to mix all plaintext bits and then CBC-ESSIV is used for encryption. The diffuser makes the malleability attack on CBC impractical. Nowadays, the standard for storage devices [START_REF]IEEE Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices. IEEE Std 1619-2007[END_REF] specifies XTS mode for "XEX Tweakable blockcipher with ciphertext Stealing" which is based on XEX for "Xor-Encrypt-Xor" designed by Rogaway [START_REF] Rogaway | Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC[END_REF]. A tweakable blockcipher is a blockcipher that takes not only the classical inputs, a key and a plaintext block, but also a tweak and outputs the plaintext block. A tweak is a public value and in the case of FDE, it is the sector number then there is no need to store this value. This trick enables to have a length preserving mode to encrypt each sector. A modification on a sector can be seen by a passive adversary (threat model -2-): all unchanged plaintext blocks at the same position will have the same ciphertext blocks and the modified ones will be different. Then it provides a "spatial" security in the senses that each encrypted sector block looks random for the adversary as long as there is no repetition

m 1 s m 1 m 1 m 2 m 3 m 4 m 5 E K E K E K E K E K E K m 1 m 1 c 1 c 2 c 3 c 4 c 5 Encryption m 1 s m 1 c 1 c 2 c 3 c 4 c 5 l E K E K E K E K E K E K m 1 m 1 m 1 m 2 m 3 m 4 m 5
l Decryption Figure 2.6: Malleability attack on CBC-ESSIV using a blockcipher (E K ,D k ) where D k = E - k . Bit flipping ("X") in the i-th ciphertext block affects the entire i-th block and exactly one bit in the i+1-th block.

of plaintext block at the same position (security proof [START_REF] Rogaway | Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC[END_REF]). If the adversary is active and modifies sector content (ciphertext), he is limited to tamper with one blockcipher only that corresponds to 128 bits in case of AES usage. For example, it can flip one bit in the sector, after decryption the corresponding plaintext will look random (see Figure 2.7) but all the other plaintext blocks will be decrypted normally. This property makes a tampering attack harder but does not prevent it. Moreover, XTS has the advantage to be parallelizable for encryption and decryption. Moreover, it necessitates only one AES call for each plaintext block8 . Wide Tweakable Block Ciphers (WTBC) go further in limiting tampering ability of the adversary but require more AES calls per block. A WTBC is based on a standard blockcipher that processes input blocks through multiple passes in order to simulate a blockcipher over the input size. This is why they are known to be slow [START_REF] Ferguson | AES-CBC + Elephant diffuser: A Disk Encryption Algorithm for Windows Vista[END_REF] and much less used than XTS for example. In FDE context, their block size is the sector size so an adversary, belonging to threat model -3-, corrupting one bit ciphertext will lead to randomize the entire plaintext sector (illustration in Figure 2.8). EME2 [START_REF] Halevi | A parallelizable enciphering mode[END_REF][START_REF]IEEE Standard for for Wide-Block Encryption for Shared Storage Media[END_REF], CMC [START_REF] Halevi | A tweakable enciphering mode[END_REF] and XCB [START_REF] Mcgrew | The security of the extended codebook (xcb) mode of operation[END_REF][START_REF]IEEE Standard for for Wide-Block Encryption for Shared Storage Media[END_REF] are examples of WTBC. Recently, a new WTBC, Adiantum [START_REF] Crowley | Adiantum: length-preserving encryption for entry-level processors[END_REF], was introduced by Biggers and Crowley that is more performant than XTS when there is no cryptographic accelerator.

m 1 m 2 m 3 m 4 m 5 α α α α c 1 c 2 c 3 c 4 c 5 E K E K E K E K E K E K s Encryption c 1 c 2 c 3 c 4 c 5 l α α α α m 1 m 2 m 3 m 4 m 5 D K D K D K D K D K E K s Decryption Figure 2
.7: Malleability attack on XTS (here without ciphertext stealing) using a blockcipher (E K ,D k ) where D k = E - k . Bit flipping ("X") in the i-th ciphertext block affects the i-th plaintext block (black block) after decryption.

m 1 m 2 m 3 m 4 m 5 c 1 c 2 c 3 c 4 c 5 E K E K E K E K E K E K E K E K E K E K Encryption c 1 c 2 c 3 c 4 c 5 l m 1 m 2 m 3 m 4 m 5 E K E K E K E K E K D K D K D K D K D K Decryption Figure 2
.8: Malleability attack on WBTC using a blockcipher (E K ,D k ) where D k = E - k . Bit flipping ("X") in the i-th ciphertext block affects all the plaintext (black blockq) after decryption.

Data Authentication

In the context of full disk encryption the strongest notion of integrity is the poor man's authentication which means that if an adversary modifies the ciphertext (here a sector content), one can hope that this modification will lead to a random change in the corresponding plaintext in such a way that the system or the user will detect this tampering. To be able to detect all the illegitimate data modifications, data authenticity 9 is required in addition to encryption. In this thesis integrity and authenticity refer to the same security notion.

Data authenticity enables to detect if the adversary modified the disk content with a message authentication scheme also called MAC for Message Authentication Code (MAC). It takes as input a plaintext and returns a tag. This primitive is a keyed algorithm based on blockciphers [fS11a] like CBC-MAC and CMAC or a hash functions [fS11b] like the HMAC family. MACs are preferred over signatures because their computational time is smaller, which is crucial given the amount of data to process on a disk and the expected throughput. Authenticity for disk content is not a new subject [HGX + 09, BMM10]; it is the purpose of the standard [START_REF]IEEE Standard for Authenticated Encryption with Length Expansion for Storage Devices[END_REF] and was the aim of different recent projects: the dm-integrity framework [START_REF] Broz | Practical cryptographic data integrity protection with full disk encryption[END_REF] and dm-x [CJK + 17] and StrongBox [START_REF] Dickens | Strongbox: Confidentiality, integrity, and performance using stream ciphers for full drive encryption[END_REF]. Having data authentication is out of FDE scope due to the storage of additional data [SWZ05, KMV17, BPM18], which is the reason why the definition of new models are required. These new models bring new challenges: how should we store tags, which algorithms minimize the added computational latency (e.g. additional to encryption only latency) and additional data storage. The purpose of this section is to clarify the models where data authentication is possible and to provide solutions and their analysis. Some solutions are practical in the sense that existing frameworks implement the corresponding mechanism and others are, for now, only theoretical.

Local Authenticity

A naive solution is to compute a tag over all the disk content using a MAC and only one tag is stored for the whole disk. However, then each time a sector is read or written, this tag has to be verified or re-generated which means processing all disk sectors; this is too much time-consuming. A better and natural mechanism is to compute a local tag for each sector to keep independence between each sector which costs to store a tag per sector. We call this per sector data authentication local or spatial authentication. ADE Model. The possibility to store tags for each data sector gives a model that diverges from the FDE model called the Authenticated Disk Encryption (ADE) model in the sequel of the chapter. Depending on how these tags are stored (see section 2.3.1.2), we can consider storing more than the local tags to make the cryptographic primitive stronger. That is why from here local tags refer to additional data stored for data protection including cryptographic tags, IV, etc. . . In this model, the adversary has access to the disk at several times and can modify its content: data sectors and tag sectors. This adversary is part of the threat model -3-, his goal is to break confidentiality or to build a forgery for at least one data sector (e.g. data sector d and the corresponding tag τ ). He wins if data confidentiality is broken of a sector content or if for the data sector number s, he builds a fresh data sector d * and it corresponding tag τ * where verification succeeds. A mechanism secure in the ADE model does not cover replay attacks [START_REF] Van Dijk | Offline untrusted storage with immediate detection of forking and replay attacks[END_REF]: an adversary having a copy of the disk (or a part of it) at the time t can replace the disk content at any moment after that time (replay attacks in theft with recovery described in section 2.1.1).

Authenticated Encryption (AE)

Here, we can choose among generic compositions or authenticated encryption.

Generic compositions.

[BN00] There are three classical generic compositions: MAC-Then-Encrypt, MAC-and-Encrypt or Encrypt-Then-MAC. An encryption scheme and a MAC are composed to achieve data confidentiality and data authenticity, so two keys are needed. These keys can be derived from a master key or generated independently. These solutions store exactly the same amount of extra data (without taking into account the keys) and the choice between them has to be made according to security and calculation efficiency. From a security point of view, the composition Encrypt-Then-MAC is known to be secure if the underlying primitives are secured10 . For example, XTS-AES can be composed with HMAC-SHA-2 as in [START_REF] Broz | Practical cryptographic data integrity protection with full disk encryption[END_REF], but the simple approach will lead to sector reordering attacks. As the MAC of a sector does not take as input the sector number, tag reordering will not be detected: an adversary changing the location of a sector together with its tag will obtain a valid MAC verification. The standard for authenticated encryption for storage devices [START_REF]IEEE Standard for Authenticated Encryption with Length Expansion for Storage Devices[END_REF] specifies that additional data for each sector should be added and the MAC ensures its authenticity. This is also the case for authenticated encryption.

Authenticated encryption schemes (AE). They are specific schemes that provide confidentiality and authenticity at the same time by design. They take usually a single key and use derivation function(s) to obtain the required key material. For a given plaintext, it outputs a ciphertext and a tag. As they are dedicated to this purpose, they can be more efficient. In 2009, some schemes were standardized among them CCM [fS09, IEE18], OCB [fS09] and GCM [START_REF]International Organization for Standardization. Information technology -Security techniques -Authenticated encryption[END_REF][START_REF]IEEE Standard for Authenticated Encryption with Length Expansion for Storage Devices[END_REF] with AES as blockcipher. AES-GCM is a widely deployed Authenticated encryption scheme: it is used in protocols such as SSH [START_REF] Igoe | Aes galois counter mode for the secure shell transport layer protocol[END_REF], TLS [START_REF] Rescorla | Tls elliptic curve cipher suites with sha-256/384 and aes galois counter mode[END_REF], IPSec [START_REF] Viega | The use of galois/counter mode (gcm) in ipsec encapsulating security payload (esp)[END_REF] and storage [START_REF]IEEE Standard for Authenticated Encryption with Length Expansion for Storage Devices[END_REF]. A few years ago, the CAESAR competition [START_REF] Bernstein | Caesar competition[END_REF] was organized with the goal to identify a portfolio of authenticated ciphers that offer advantages over AES-GCM and are suitable for widespread adoption. Specifically, robustness and tolerance against nonce misuse [START_REF] Vaudenay | Under pressure: Security of caesar candidates beyond their guarantees[END_REF] (a missing feature of AES-GCM) have been one of the leitmotivs for the emergence of seven finalists [START_REF] Bernstein | Caesar finalists[END_REF] ACORN [START_REF] Wu | Acorn: a lightweight authenticated cipher (v3). Candidate for the CAESAR Competition[END_REF], AEGIS [START_REF] Wu | Aegis: a fast authenticated encryption algorithm[END_REF], Ascon [START_REF] Dobraunig | Ascon v1. 2. Submission to the CAESAR Competition[END_REF], COLM [LLL16], Deoxys-II [JNPS16], MORUS [START_REF] Wu | The authenticated cipher morus (v2)[END_REF] and OCB [START_REF] Rogaway | OCB: A blockcipher mode of operation for efficient authenticated encryption[END_REF].

Local Tag Storage

Different ways of storing local tags on the disk can be implemented and depending on the chosen strategy; the seek time can be more or less large.

Location. Local tags storage solutions can be: [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] to extend physical sector size; (2) to implement virtual sector smaller than physical sector (illustration in Figure 2.9) or (3) to keep the same sector size and dedicate some of them to store tags. Solution (1) was proposed in [START_REF] Chakraborty | Disk encryption: Do we need to preserve length?[END_REF] by arguing that it is feasible for manufacturers to produce disks with bigger sector size because some space is already reserved for checksums.

AE(k, i, p i )

p i p 0 p 1 pn t 0 c i c 0 c 1 cn tn
Plain sectors Encrypted and tagged sectors In this case, the only additional step is to modify the device mapper or the device controller to take into account authentication, but this solution can not be implemented in all deployed disks. Changing physical sector size is expensive so the majority of manufacturers will wait for a standard. Solution (1) relies on manufacturers. Solution (2) avoids to wait a new disk format; it is compliant with existing disks. The counterpart is implementing a virtualization layer. A basic virtualization strategy is to split the physical sector into two parts: data and local tags. An example is the FreeBSD disk encryption GELI [Daw14]: 480 bytes of data and a 32 bytes for the tag are stored in a 512 bytes physical sector. Solutions (3) breaks atomicity contrary to solutions (1) and ( 2). If, for any reason, some sectors are written and the corresponding local tags are not (or the other way around), the data authenticity check will fail. If a sector writing operation on the disk is interrupted, the previous sector content should be recovered otherwise authenticity check will fail. An example dm-integrity: it implements interleaved meta-data sectors [START_REF] Broz | Authenticated and Resilient Disk Encryption[END_REF] where the metadata include local tags. A fixed number n of consecutive sectors are processed, and the corresponding meta-data is stored in the next sector (see Figure 2.10). The user can choose the number n. The software dm-integrity allows the possibility to manage recovery on write failure with journals: for example, it can save an old data content of unfinished sector write. Enabling journals is an option and experiments with dm-integrity shows that enabling them has severe impacts on performances. Data authentication protecting against replay attacks is a desirable property; we can call this security notion temporal authenticity or global authenticity. The next section aims at analyzing how we can get such property and at estimating its cost.

Discussion

Global Authentication and Incremental Cryptography

Global authenticity is a strong security notion that aims at protecting all the local tags from tampering. A simple solution is to store all these tags in persistent secure memory, which means the adversary cannot tamper with it.

Secure Memory (SM). Obviously, such a component is not an accessible part of the disk otherwise downgrade attacks are still applicable. Now, we will assume that such memory exists otherwise replay attacks cannot be prevented in the context of full disk encryption [HGX + 09, BPM18] and also in the context of secure cloud storage with block-level encryption [OR05, CJK + 17]. Disk and cloud storage are similar from a theoretical point of view in the sense that the server can be seen as a big remote disk. These two use cases are different; nonetheless the data authenticity problem for data stored in a physical disk or in a distant disk (cloud) can be solved similarly. For disk protection, we can consider a Secure Element11 as a SM but it can store only a limited amount of data typically few kilobytes to few megabytes [START_REF]High-speed secure MCU with 32-bit ARM® SecurCore® SC300TM CPU with SWP, ISO, SPI, I2C and high-density Flash memory[END_REF]. Whereas for cloud storage, the SM can be associated with a dedicated client local storage where it is possible to store data that cannot be tampered with by the server. In this case, the SM can be a whole disk partition that the local OS protects from any server access, yielding few gigabytes of "secure memory". Once again, the naive idea is to compute a global tag over all the local tags. Then reading a sector will lead to re-computation over all the local tags which is too much time-consuming. FADE Model. Once more, we have a different model that is slightly deviating from the ADE one called the Fully Authenticated Disk Encryption (FADE) where the adversary has the possibility to perform any modification on the disk. It breaks data authentication if it succeeds to build a forgery for a sector s different from the last legitimate one. In this model, the adversary can attempt replay attacks.

Global MACs. To be secure in the FADE model, a global MAC is needed, and it should have specific properties to be effective in the FDE context.

-Security: It has to guarantee the authenticity of the local tags.

-Speed: It has to be fast for tag generation and tag verification. It has to minimize cryptographic operations but also the added read and write access to the disk: tag generation and verification must be relative to a data unit.

-Locality: If the verification fails, the index of tampered sectors should be easy to find. -Minimal storage in the disk: If additional data has to be stored in the disk it should be as short as possible to lose a minimum space in the disk.

-Minimal storage in secure memory As argued above, a global tag has to be stored in secure memory that has limited storage space.

Incremental Cryptography.

Incremental MACs can fulfil some properties above. Incremental cryptography was introduced by Bellare, Goldreich and Goldwasser in 1994 [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF] and it is an attractive feature that enables to efficiently update a cryptographic output like a ciphertext, a signature or an authentication tag after modifying the corresponding input. A MAC can be incremental regarding some update operations like replacing, deleting or inserting a block in the input. In our case, the input is the concatenation of the sector local tags computed with a classical MAC e.g, not an incremental MAC then for each modification in a sector; the local tag will be recomputed, and the global tag (output of incremental MAC) will be updated.

p 1 p 2 p 3 f K f K f K Combine τ p 4 p 2 p 3 f K f K f K Combine τ Figure 2
.11: Overview of incremental replace operation. The function f K denotes the MAC primitive. The inputs τ 1 , τ 2 , τ 3 give the tag τ . After replacing the value τ 1 by τ 4 , the tag τ is updated with τ .

Usually, this efficiency comes from some independent MAC over all the inputs (values p i in Figure 2.11) and the resulting output block are combined to obtain the global tag τ . This independent processing seems to fit the independence of the disk sectors: as the sectors are modified independently, we can imagine a root tag τ for all the disk that is updated for each sector modification without recomputing the root tag from scratch (otherwise it would be inefficient). A disk is a fixed number of sectors, and local tags depend on the sector number so having an incremental MAC regarding the replace operation only is sufficient. The chaining Xor-Scheme [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF][KV18], Xor-MAC [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF] and GMAC [START_REF] Kohno | CWC: A high-performance conventional authenticated encryption mode[END_REF] and Merkle tree [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF] are incremental MACs. These algorithms use a keyed function f K 12 and, they are compared in table 2.1 with regard to the computational time of their tag generation algorithm, the replace update operation and the tag verification algorithm. The table gives the number of calls to f K for a disk composed of n sectors which means that the input of the tagging algorithm is the concatenation of the sector local authentication tags. In the following, log is for binary logarithm. For n inputs, the Xor-Scheme and the Xor-MAC have a constant time replacing operation (respectively 4 and 2 calls to f K ) and the storage cost is only a tag size. The main drawback is the verification cost: to verify the authenticity of 1 sector tag; it requires n calls to f K . Merkle tree is the only incremental scheme that has the locality property and a trade-off between replace and verify operation delays. The counterpart is that it requires more storage space, but it is not necessary to store the entire tree. In the next section, the Merkle tree storage will be discussed in details.

Merkle Tree

A Merkle tree is an authentication data structure where leaves are the values to protect, and each node is the MAC n = 2 n . This estimation is given for a perfect binary tree. A tree is said to be a perfect binary tree when all its nodes have two children, and all leaves have the same depth. So the number of actual data is exactly 2 n where n is an integer. In this chapter, all the Merkle tree storage cost are computed according to a number of leaves (tags) equal to a power of 2 e.g. where n = 2 n and n = log(n). The entire tree consists of 2 n -1 nodes. Otherwise, the value n can be set to log(n) + 1 which is the worst case e.g. non-optimized tree. Let L be the output size of the MAC algorithm f K used to compute the Merkle tree nodes. Then storing an entire Merkle tree takes (2 n -1)L bits.

There are different memories where it can be stored: the SM, the disk and the RAM. But in any case, a copy of the trusted root has to be stored in the SM. This value must not be tampered with in order to recompute the path from the sector local tag to the root and check the obtained root and the stored one. To simplify the analysis, we distinguish two ways of storing the tree: either it is entirely stored in the same memory which is said to be a stand-alone storage, or the tree is split into different memories which is said to be an hybrid storage. It is possible to store some strategic nodes and to recompute the corresponding subtrees when needed. The nowadays RAM modules can store a large amount of data; typically between 4 GB and 16 GB. In addition to current computation data, the RAM could store a part of the Merkle tree. In the following, an estimation of the update/verify times of a sector and, the storage cost in the different memories is given depending on the storage configurations. Some of the following solutions are suitable for disk protection but, once again it depends on the device: for a laptop, the disk size is in the range of gigabyte or terabyte, the RAM size is rarely larger than 32 GB and is in average around 8 GB. The secure memory is usually only few kilobytes. The access latencies of the different memories are also a parameter to take into account.

Cost S1 S1' S2 S3 S4 S5 Up/Ver n 1 2 n -1 n n n RAM - - - 2 n -1 - 2 n -1 Disk 0 0 0 0 2 n -1 2 n -1 SM 2 n -1 2 n 1 1 1 1

Stand-alone Storage

Table 2.2 gives 5 possibilities for Merkle tree storage where the entire Merkle tree is stored in the SM, the disk or the RAM.

• S1: The entire Merkle tree is stored in the SM and for each read and write operation, the update/verify operation on the Merkle tree costs n calls to f K . This solution does not use disk and RAM storage but the update/verify which has a reasonable cost. If it is possible to store 2 n -1 tags then it should be possible to store 2 n which corresponds to solution S1'. In this case, all the local tags can be stored in the SM and, as it is assumed that this memory is tamper proof, the global authentication scheme is no longer needed: the local tags are stored directly in SM. Then the Merkle tree is not needed any more. If the SM is big enough, this solution should be considered otherwise the following possibilities, where only a small value (the root) is stored in SM, are more suitable.

• S2: The only value stored is the Merkle tree root and it is stored in the SM. The advantage is that the storage on the disk, in the SM and RAM is minimized but the update/verify cost is the worst: the entire Merkle tree has to be recomputed for each update/verify operation. For this reason, this solution seems to be unsuitable for disks.

• S3: This solution considers a context where the RAM is big enough to store the entire Merkle tree and operates in rated conditions. The access time to Merkle tree nodes in the RAM is smaller than in the disk but the counterpart is that the Merkle tree will not be maintained when the system is switched off. It has to be recomputed each time the system is switched on. This solution could be interesting if saving disk storage is a priority. In fact, it stores only the root in SM and no additional data in the disk. The update/verify operation cost is reasonable but a re-computation delay due to the volatility of the RAM is added.

• S4: This solution has the same settings as S3 except that the Merkle tree is not stored in RAM but in the disk. It has the advantage to remove the re-computation delay, but this time the additional storage in the disk is the entire Merkle tree size. Moreover, the time to read and write a node will be larger as it is stored in the disk. Unsurprisingly, this solution could be implemented in an optimized manner by some developers as solution S5.

• S5: This solution combines solutions S3 and S4: the tree is stored in the disk and also in the RAM. Each time the device is switched on, the Merkle tree is copied from the disk to the RAM which avoids the re-computation delay of solution S3. This solution is the most efficient from a speed point of view.

For a reasonable amount of data, solution S1' can be considered for cloud storage as few gigabytes can be stored in the client side, but it seems unpractical for a stand-alone disk. Solution S5 stores only the root in the SM and is the quickest solution described above, which makes it the most suitable for stand-alone disk.

Cost

n -m -1 + m 2 n -m -1 n -m n -m n RAM - - 2 n -2 m+1 - 2 n -2 m+1 Disk 2 m+1 -1 0 0 2 n -2 m+1 2 m+1 -1 SM 1 2 m 2 m 2 m 1
Table 2.4: Estimation of Hybrid storage of Merkle Tree with n actual data sectors where n = 2 n and m ≤ n . Up/Ver stands for update and verify cost.

Hybrid Storage

Table 2.4 presents possibilities where the Merkle tree nodes of level m, where m ≤ n , are stored. Here, the performance depends on the choice of m and, it has to be instantiated in table 2.4. The optimum value of m depends on many factors: the disk, the SM and the RAM sizes, the CPU, the cryptographic algorithms etc. Due to this variety of factors, this analysis is only theoretical: it provides insights about the main tendencies of each implementation strategy. It would be nonetheless interesting to test these solutions in different devices to adjust the level m and compare their real performances.

• H1: This solution minimizes the storage in SM by storing the Merkle tree root only. The top of the Merkle tree, from the root to level m, is stored in the disk. For each update/verify operation, recomputing the corresponding subtree costs 2 m -1 calls to f K and the update/verify of the top of the tree cost m calls to f K . If a verification fails, it will not be possible to find exactly which sector was tampered with, in the best case, only the node at level m can be given as an information to the user.

• H2: The nodes at the level m (2 m nodes) are stored in the SM. Here, these nodes do not need data authenticity check; they are assumed to be authentic as they are stored in the SM. For each update, the needed subtree is recomputed which costs 2 n -m -1 calls to f K . Here, the SM has to store 2 m L bits. Depending on the value m and the SM size, it might be possible for a disk. For instance, if the SM can store 1 MB and the L = 256 bits, then the maximum value of m is 12.

• H3: The nodes of the level m are stored in the SM and, the m subtrees are stored in the RAM. Each update operation costs going through the subtree, which requires n -m calls. Storage in the RAM involves a re-computation time when the device is switched on.

• H4: The nodes of the level m are stored in the SM and all the subtrees (m) are stored in the disk. Unlike, the previous solution, accessing tree nodes in the disk takes more time.

• H5: The Merkle tree is split between all the memories: the root in SM, the top in the disk and the corresponding subtrees in the RAM. Because of the storage in the RAM, a recomputing delay is added each time the device is switched off. The update/verify time is acceptable.

Solution H1 seems to be the most suitable for disk encryption, the SM storage is reduced to the Merkle tree root, the upper part is stored in the disk, and some layers have to be recomputed. These solutions seem to remain acceptable for disk encryption as long as the value m gives decent storage cost in the SM and, also in the RAM. Solutions where update/verify time is minimized, seems to be better as this latency has a direct impact on the disk performances. Discussion. Table 2.5 gives an estimation for the value m = 15 with the same settings as in the discussion for stand-alone storage. The value m was chosen to have maximum storage in SM equal to 1 MB. We can note that the update and verification time is shorter for solution H3 and H4 whereas it is quite long for solutions H1 and H2. Storage in RAM in solutions H3 and H5 adds a re-computation delay that should be limited as much as possible. Solution H4 seems to be the best solution if the SM can store 1 MB otherwise H5 has to be considered. The storage cost for the entire FADE mechanism for H4 is close to solutions S4 and S5, which represents about 1,5% of the disk, however, the update and verify time is better. In section 2.3.2, the SM was limited to a few megabytes and corresponds to realistic figures of current state of the art of Secure Elements. Other technologies embedding more secure memory have raised the industry attention in the last years. Examples of such solutions are those belonging to the Trusted Execution Environment (TEE) ecosystem, with TrustZone, Intel SGX and so on. In the TEE paradigm, a Secure Element is "emulated" in the form of a sandboxed execution mode (the "Secure World") of a general purpose processor, yielding in more computing power and storage space when compared to classical Secure Elements. Even though the storage space of such solution is usually shared with the so called "Non Secure World", more and more SoC vendors embed non-volatile memory dedicated to the TEE with hardware security isolation insurance. In such components, the SM considered in our models could reach hundreds of megabytes to gigabytes of internal storage, and table 2.6 gives figures in a case where 1 gigabyte can be stored in the SM. Software implementations of FADE using TEE as a SM have been proposed in [START_REF] Hein | Secure Block Device-Secure, Flexible, and Efficient Data Storage for ARM TrustZone Systems[END_REF]: the Secure Block Device Library uses CMAC and Merkle trees to bring confidentiality and integrity to Trusted Applications data at rest storage. Temporal integrity is ensured whenever the underlying SoC provides a physical secure storage with non-tampering properties: the Merkle tree root as well as the master encryption key are then stored inside it. In tables 2.2, 2.3, 2.4, 2.5 and 2.6, the path of the Merkle tree (or a part of it in the case of hybrid storage) stored explicitly in RAM is updated and verified for each read and write operation. As attacks in RAM are excluded in the presented models, the verification path can be omitted to speed up the read operation of a sector. Doing so for the write operations is more tedious: after some number of writes, several paths in the tree are updated. These update leads to the refreshing the tree in SM (which can be reduced to the root or more nodes depending on the chosen solution) just before powering down the device. In case of failure (device out of battery for instance), the device has to be able to update the tree in SM otherwise the integrity check will fail for all sectors lately updated. Hence, this optimization seems suitable for SEDs that embed their own emergency batteries, leaving enough time to perform such updates.

Cost

Cost

Protection Name

Bitlocker

[Fer06] Veracrypt[ver19] FDE dm-crypt[dm-19a] FileVault[CGM13] CRYHOD[Pri19] ADE dm-integrity[BPM18] GELI[Daw14] Secure Block Device Library[HWF15] FADE dm-x [CJK + 17] StrongBox [IGFH18]
Table 2.7: Some implementations giving different levels of security for a stand-alone disk.

Conclusion.

Today, products implementing disk encryption are widespread. Most of these products use the classical FDE mode of operation, namely XTS. However, adding efficient data authenticity in the strong model (FADE) with tight constraints is an important yet unsolved practical challenge. Developers and researchers have begun to address the problem since a few years which gives some preliminary solutions (see Table 2.7). The global authentication mechanism is new from a cryptographic perspective, and the question is whether we can do better than Merkle trees. From an architectural point of view, the introduction of a secure memory in laptops as well as in smartphones seems to be a strong requirement to have global authentication. This is out of scope in this thesis, but there is a crucial question for the deployment of FADE solutions: if the secure memory exists then is it accessible to a standard FADE software for embedding authentication data (such as a root of a Merkle tree), or is it only accessible to device manufacturers, hence entailing proprietary implementations? The next step is to implement FADE mechanism with the Merkle tree in different devices with different configurations: stand-alone storage, hybrid storage and in this case we should find the trade-off for the value m.

Chapter 3

Chapter 3

Full Disk Encryption The term Full Disk Encryption (FDE) is commonly used when every sector of a disk volume is encrypted. There is typically no space to store any additional data, such as an IV or a MAC. As explained by Ferguson [Fer06], generic solutions to store additional data will at least double the number of read and write operations, and will significantly reduce the available disk space. In fact, to read one data sector, the sector contanining this data and the sector containing the corresponding additionnal data has to be read. They also change the disk layout, which makes it extremely complicated to enable FDE on existing disks. With this restriction, FDE cannot offer authentication, but at best "poor-man's authentication" [START_REF] Ferguson | AES-CBC + Elephant diffuser: A Disk Encryption Algorithm for Windows Vista[END_REF], which is to hope that ciphertext changes will result in a plaintext that is random enough to make the application crash. It can also not achieve chosen-plaintext indistinguishability: when the same data is encrypted twice at the same sector index, the resulting ciphertexts will be identical. Additional efficiency constraints may be imposed on FDE as well. For example, it can be desirable to perform encryption and/or decryption in parallel, which is not possible for inherently sequential constructions where one plaintext block of a sector cannot be processed until all previous plaintext blocks are processed. If there is not enough memory available to store an entire sector, it may be required that encryption and decryption are online, meaning that one block of a sector may only depend on the preceding blocks. These implementation constraints impose severe restrictions on the algorithms that can be used for FDE. However, a general problem in the domain of FDE is that the security properties of the resulting constructions are not always well-understood. And, cryptographers often complain about the absence of well-defined cryptographic goals for FDE (see e.g. Rogaway [START_REF] Rogaway | Evaluation of Some Blockcipher Modes of Operation[END_REF]), which are prerequisites to find a good-trade-off between security and efficiency.

In this chapter, we want to measure "how much security is left" within the constraints of FDE. In order to do so, we introduce a theoretical framework to capture that an FDE algorithm behaves as "randomly as possible" subject to different practical constraints. We consider settings where the encryption oracle can be random-up-to-repetition, random-up-toprefix or random-up-to-block. For each of the attack settings in the framework, we list an efficient construction that achieves security within this setting. We recall existing security results, and provide new proofs, in particular in the unique-first-block (ufb) setting where the Operating System (OS) or application ensures that the first n bits of the plaintext will not be repeated for a particular sector number, where n is the block size of the underlying blockcipher. Our model recalls that the modes of operation CBC (Cipher Block Chaining) and IGE (Infinite Garble Extension), even with a secret IV, do not achieve the security properties that developers often wrongly assume for these constructions. As already shown by Bellare, Boldyreva, Knudsen and Namprempre [START_REF] Bellare | and Chanathip Namprempre. On-line ciphers and the hash-CBC constructions[END_REF], CBC and IGE are not IND-CPA secure up-to-prefix. We will prove, however, that both constructions are IND-CPA secure under the ufb assumption. Regarding chosen-ciphertext attacks, we point out that Added Redundancy Explicit Authentication (AREA) [START_REF] Fruhwirth | New methods in hard disk encryption[END_REF] is not secure when used with CBC or IGE, even when the IV is secret. The insecurity of constructions such as AREA was already shown in 2001 by Jutla [START_REF] Charanjit | Encryption modes with almost free message integrity[END_REF], but has nevertheless not yet been pointed out in the context of FDE. We recall that there exist constructions that are secure in this setting, such as TC2 and TC3 [START_REF] Rogaway | Online ciphers from tweakable blockciphers[END_REF]. Secondly, we revisit the FDE constraints from an engineering point of view. We show that it is possible to produce different ciphertexts for the same plaintext at a particular sector index, without storing additional data. Our solution applies to solid state drives (SSDs), where we show how the SSD firmware can be modified to associate a diversifier to every sector. This is done without modifying the data structures of the SSD, but by forcing data to be written to a particular Logical Unit Number (LUN). For any particular sector, the diversifier value must be unique. However, as we will explain later, additional requirements are necessary for performance reasons. When looking at all sectors at any particular point in time, each diversifier value should occur roughly the same number of times. Additionally, this diversifier value can typically only be a few bits long. These requirements put the diversifier in a class by itself, and not as a specific case of a random IV or a nonce (i.e. a number that is only used once). When we benchmarked our solution in a modified EagleTree simulator [DSB + 13], we found that it increases the average latency by at most 12 % for reads and 2 % for writes, and that it reduces the SSD throughput (read and write combined) by less than 4 %.

Disk encryption methods and Security notions

The problem of FDE has been researched extensively, see for example Rogaway [START_REF] Rogaway | Evaluation of Some Blockcipher Modes of Operation[END_REF] for a provable security treatment, or Fruhwirth [START_REF] Fruhwirth | New methods in hard disk encryption[END_REF] for an implementer's perspective. The formal requirements of disk encryption are often not clearly stated. FDE is a topic that has gathered significant interest from industry and standardization and often leads to application-specific solutions due to the special requirements of full disk encryption. Of particular interest are the elephant diffuser used in Microsoft's BitLocker [START_REF] Ferguson | AES-CBC + Elephant diffuser: A Disk Encryption Algorithm for Windows Vista[END_REF], or IEEE P1619's XTS standard [START_REF]IEEE Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices. IEEE Std 1619-2007[END_REF], which later became a NIST recommendation [START_REF] Dworkin | Recommendation for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on Storage Devices[END_REF] as well. We assume that adversary has access to the disk volume at any time. The adversary has (partial) knowledge and even control of the plaintext, and can even change the ciphertext as well. We, therefore, go beyond just "single point-in-time permanent offline compromise" (see e.g. [START_REF] Halcrow | EXT4 Encryption Design Document[END_REF][START_REF] Gjøsteen | Security notions for disk encryption[END_REF]). Read and write operations are assumed to be atomic (on a sector level), so we do not consider blockwise adaptive attacks [START_REF] Joux | Blockwise-adaptive attackers: Revisiting the (in)security of some provably secure encryption models: CBC[END_REF]. Sound key management is required to avoid that the plaintext contains the key or any function of the key [START_REF] Halevi | Re: Lrw key derivation (formerly pink-herring)[END_REF]. Physical access threats (e.g. cold boot, DMA, evil maid, or hot plug attacks [START_REF] Müller | A Systematic Assessment of the Security of Full Disk Encryption[END_REF][START_REF] Götzfried | Analysing android's full disk encryption feature[END_REF]) are also outside the scope of FDE model.

Disk Encryption Methods

Data is read and written in a sector-addressable device by fixed-length units called sectors, usually 512 or 4096 bytes long. The OS can access a specific sector by its sector number s. We consider the case of an encrypted disk volume where data is encrypted by the OS before being stored.

We list the modes of operation that frequently appear in the context of FDE, whether it be in academic literature or practical implementations. We also mention other modes with interesting security or efficiency properties.

ECB (Electronic Codebook).

In the simplest encryption mode, the plaintext is divided into blocks of n bits, and each block is encrypted separately using an n-bit blockcipher. It can readily be used for FDE, even though it is well-known that it does not provide adequate security.

m 1 m 2 m 3 m 4 m nb . . . . . . c 1 c 2 c 3 c 4 c nb E K E K E K E K E K Figure 3
.1: Description of the mode of operation ECB (Electronic Codebook) where E is a blockcipher.

CTR (Counter)

. This mode uses a counter (incremented for each block) that is encrypted and then XORed with the plaintext block to output the ciphertext block. Typically, the counter is the sector number, bit-shifted to the left over a sufficient number of bits so that the least-significant bits can represent a counter for the number of blocks in one sector. CTR mode is IND-CPA secure [START_REF] Bellare | A concrete security treatment of symmetric encryption[END_REF] under the assumption that the counter is a nonce. In the context of FDE, this assumption does not hold as sectors can be overwritten.

i 0 i 1 i 2 i 3 i (nb -1) m 1 m 2 m 3 m 4 m nb . . . . . . c 1 c 2 c 3 c 4 c nb E K E K E K E K E K Figure 3
.2: Description of the counter mode (CTR) where E is a blockcipher and i is the counter.

Cipher Block Chaining (CBC). In this mode, each plaintext block is XORed with the previous ciphertext block (or an IV for the first plaintext block) before being encrypted. To be able to achieve the IND-CPA security notion, it is well-known that the IV has to be a random value [START_REF] Bellare | A concrete security treatment of symmetric encryption[END_REF]. However, for FDE, the first natural idea is to use the sector number as an IV. Fruhwirth [START_REF] Fruhwirth | New methods in hard disk encryption[END_REF] proposed to use as an IV the encryption of the sector number by the blockcipher keyed with an independent key (see Figure 3.3). 1Infinite Garble Extension (IGE). IGE was proposed by Campbell [START_REF] Carl | Design and Specification of Cryptographic Capabilities[END_REF] as a variant of CBC mode where each block of plaintext is XORed with the next ciphertext block (see Figure 3.3). For FDE, since the sector number is not secret, we will consider the variant where the IV is the encryption of the sector number s in which s is not XORed to the first ciphertext block. We will refer to this mode as IGE-ESSIV.

XEX with CipherText Stealing (XTS)

. XTS [START_REF]IEEE Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices. IEEE Std 1619-2007[END_REF] applies a tweakable blockcipher to every n-bit block of a sector, where the tweak depends on the sector number and the index of the block within the sector. It uses ciphertext stealing when the sector size is not a multiple of n bits; however, such sectors sizes are not considered in this thesis. Tweakable Ciphers TC1, TC2 and TC3. These modes for tweakable blockciphers were defined by Rogaway and Zhang in [START_REF] Rogaway | Online ciphers from tweakable blockciphers[END_REF]. The difference between these constructions is the way the tweak is used:

s m 1 m nb . . . . . . c 0 c 1 c 3 c nb E K E K E K CBC-ESSIV s m 1 m 2 m 3 m nb . . . . . . c 0 c 1 c 2 c 3 c nb E K E K E K E K IGE-ESSIV
m 1 m 2 m 3 m 4 m nb α α α α . . . . . . c 1 c 2 c 3 c 4 c nb E K E K E K E K E K E K s
• In TC1 (see Figure 3.5), the tweak is the previous ciphertext block as in the HCBC mode [START_REF] Bellare | and Chanathip Namprempre. On-line ciphers and the hash-CBC constructions[END_REF].

• In TC2 (see Figure 3.5), the tweak is the concatenation of the previous ciphertext block and the previous plaintext block as in the HCBC2 mode [START_REF] Bellare | and Chanathip Namprempre. On-line ciphers and the hash-CBC constructions[END_REF];

• In TC3 mode (see Figure 3.6), the tweak is the XOR of the previous ciphertext block and the previous plaintext block as in the MHCBC2 mode [START_REF] Nandi | Two new efficient CCA-secure online ciphers: MHCBC and MCBC[END_REF].

In FDE context, it is natural to consider a mode where the first block tweak is simply the sector number s.

Wide Tweakable Block ciphers WTBC. In the context of FDE, the block size of a WTBC is equal to the sector size, and the sector number is used as the tweak input. From a security point of view, any change in the plaintext or ciphertext affects the entire sector. A

m 1 m 2 m 3 m nb s . . . . . . c 1 c 2 c 3 c 3 c nb ẼK ẼK ẼK ẼK TC1 m 1 m 2 m 3 m 3 m nb s 0 s 1 . . . . . . c 1 c 2 c 3 c 3 c nb ẼK ẼK ẼK ẼK TC2 Figure 3
.5: Description of the TC1 and TC2 modes of operations where Ẽ is a tweakable blockcipher. In FDE context, the tweak can be the sector number s (for TC2, s 0 ||s 1 = P(s) where P is a permutation. WTBC is typically realized using smaller (tweakable) blockciphers, for example in the EME (Encrypt-Mix-Encrypt) [HR04] mode. Our goal in this chapter is to analyse these constructions and to evaluate their security in different models.

s m 1 m 2 m 3 m 4 m nb . . . . . . c 1 c 2 c 3 c 4 c nb ẼK ẼK ẼK ẼK ẼK

Security Notions for FDE

In this section, we formalize several security notions for FDE. We first give a formal syntactic definition of blockcipher-based FDE.

It is assumed that the plaintext of a sector is a multiple of n which is the blockcipher size. All plaintexts are nb blocks of n bits. m[i] denotes the i-th block of the plaintext m such that m = m [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||m [2] • KS is the key space, SS is the sector space;

• BS is the block message space and MS is the message space such that MS := BS nb where BS = {0, 1} n ; n and nb are a fixed positive integers;

• FDE.kg is the (probabilistic) key generation algorithm that takes no input and returns a key K ∈ KS;

s m 1 m 2 m 3 m nb . . . . . . c 0 c 1 c 2 c 3 c 3 c nb E K E K E K E K E K h K h K h K Figure 3
.7: Description of the HCBC1 mode of operation where E K is a blockcipher, h K a keyed hash function. The keys K and K are independent.

m 1 m 2 m 3 m 4 m nb . . . . . . c 1 c 2 c 3 c 4 c nb E K E K E K E K E K E K E K E K E K E K Figure 3
.8: WTBC where E K is either a blockcipher or a tweakable blockcipher. WTBC can use several calls to E K to process one message block.

• FDE.enc is the (deterministic) encryption algorithm that takes as input a key K ∈ KS, a sector number s ∈ SS and a plaintext m ∈ MS and outputs a ciphertext c ∈ MS;

• FDE.dec is the (deterministic) decryption algorithm that takes as input a key K ∈ KS, a sector number s ∈ SS and a ciphertext c ∈ MS and outputs a plaintext m ∈ MS,

such that ∀(K, s, m) ∈ KS × SS × MS : FDE.dec(K, s, FDE.enc(K, s, m)) = m.
In the rest of the thesis FDE.nb denotes the number of blocks m[i] ∈ FDE.BS of message m ∈ FDE.MS.

For each security notion, we define two variants: security under Chosen-Plaintext Attack (CPA) where the adversary is given access to the Encrypt procedure and security under Chosen-Ciphertext Attack (CCA) where the adversary is also given access to the Decrypt procedure. The adversary is not allowed to query the decryption of a ciphertext that was previously returned by Encrypt or vice versa.

Indistinguishability up-to-block. In this definition, each ciphertext block depends deterministically on the plaintext block, the sector number s and the block position in the plaintext, but behaves as "randomly as possible" subject to this constraint. The corresponding game, described in Figure 3.9, uses a random permutation family Π 1 : FDE.SS × {1, .., FDE.nb} × FDE.BS → FDE.BS simulated by lazy sampling that takes as input a sector number s ∈ FDE.SS, a position number i ∈ {1, .., FDE.nb} and a message block m ∈ FDE.BS and returns a cipher block c ∈ FDE.BS. For each couple (s, i), Π 1 defines a random permutation such that Π - 1 (s, i, (Π 1 (s, i, m)) = m. We specifically introduce this setting to describe the security goal of XTS, see Rogaway [START_REF] Rogaway | Evaluation of Some Blockcipher Modes of Operation[END_REF] for a formal definition (using a filter function) of what is known to leak by the XTS mode.

procedure Initialize b ← ←{0, 1}; K ← ← FDE.kg() Π 1 ← ⊥ procedure Encrypt(s, m) if b = 0 then c ← FDE.enc(K, s, m) Real world else Random world for i from 1 to nb if Π 1 (s, i, m[i]) = undef then Π 1 (s, i, m[i]) ← ← Rng Π 1 (s, i, .) c[i] ← Π 1 (s, i, m[i]) c ← c[1]|| . . . ||c[nb] return c procedure Decrypt(s, c) if b = 0 then m ← FDE.dec(K, s, c) Real world else Random world for i from 1 to nb if Π - 1 (s, i, c[i]) = undef then Π - 1 (s, i, c[i]) ← ← Dom(Π 1 (s, i, .) m[i] ← Π - 1 (s, i, c[i]) m ← m[1]||..||m[nb] return m procedure Finalize(b ) return (b = b )
Figure 3.9: Game "up-to-block" for the IND-CCA-block security notion.

Indistinguishability up-to-prefix. In this definition, for i ∈ {1, . . . , nb}, the i-th ciphertext block depends deterministically on the sector number s ∈ SS and all previous plaintext blocks at position j for j ∈ {1, . . . , i}, but again behave as "randomly as possible" subject to this constraint. The corresponding game is described in Figure 3.11 and it uses a random permutation family Π 2 : FDE.SS × FDE.BS t × FDE.MS → FDE.MS lazily sampled that takes as input a sector number s ∈ FDE.SS, a plaintext prefix m ∈ FDE.BS t such that t ≤ nb, a plaintext m ∈ FDE.MS and returns a ciphertext c ∈ FDE.MS. For each couple (s, m ), Π 2 defines a random permutation such that Π - 2 (s, m , Π 2 (s, m , m)) = m. This notion corresponds to security notion described in [START_REF] Bellare | and Chanathip Namprempre. On-line ciphers and the hash-CBC constructions[END_REF] for online ciphers.

Indistinguishability up-to-repetition. In this definition, each ciphertext block depends deterministically on the plaintext block and the sector number s, but behaves as "randomly as possible" subject to this constraint. The corresponding game, described in Figure 3.10, As different ideal-world encryption oracles are used in the various security notions, it is trivially possible to distinguish between the encryption oracles. For example, for a fixed sector number and position on the plaintext, an IND-CPA up-to-block construction always returns the same ciphertext block if the plaintext block is the same. This construction does not reach IND-CPA up-to-prefix security, which requires indistinguishability up to the longest common prefix for a fixed sector number. It also does not satisfy IND-CPA up-to-repetition security, which requires indistinguishability up to repetition of the entire plaintext for a given sector number. Conversely, a construction that achieves IND-CPA up-to-prefix security will also not be IND-CPA up-to-block nor IND-CPA up-to-repetition using similar reasoning.

procedure Initialize b ← ←{0, 1}; K ← FDE.kg() procedure Encrypt(s, m) if b = 0 Real world c ← FDE.enc(K, s, m) else Random world if Π 3 (s, m) = undef then Π 3 (s, m) ← ← Rng(Π 3 (s, .)) c ← Π 3 (s, m) return c procedure Decrypt(s, c) if b = 0 Real world m ← FDE.dec(K, s, c) else Random world if Π - 3 (s, c) = undef then Π - 3 (s, c) ← ← Dom(Π 3 (s, .)) m ← Π - 3 (s, c) return m procedure Finalize(b ) return (b = b )
Analysis of Existing Constructions. We now analyse the FDE modes of operation described in Section 3.1.1 with respect to these security notions. These results are summa- [2], ..., m[nb] can be any n-bit blocks). The first blocks of the obtained ciphertexts c [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] and c [2] will always satisfy c 1 [1] = c 2 [1] ⊕ 1 n , whereas this property holds only with probability 2 -n in all three random worlds. CBC mode. The attack on the CTR mode also applies to the variant of the CBC mode where the sector number is used as an IV. In the context of FDE, this attack is known as a Saarinen's watermarking attack [START_REF] Olavi Saarinen | Encrypted watermarks and linux laptop security[END_REF]. Bellare et al. [START_REF] Bellare | and Chanathip Namprempre. On-line ciphers and the hash-CBC constructions[END_REF] describe an attack on the CBC-based online cipher that shows that CBC-ESSIV is not IND-CPA up-to-prefix. This attack can be adapted to construct an adversary A for our three security notions: [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] and queries the Encrypt procedure to obtain its encryption:

1. A arbitrarily chooses (nb -1) blocks m[2], ..,
: c b [1]||c b [2]|| . . . ||c b [nb] ← Encrypt(s, m b ) for b ∈ {1, 2}. 3. A builds m 3 = 1 n ||m 3 [2]||m[3]|| . . . ||m[nb] where m 3 [2] = m[2] ⊕ c 1 [1] ⊕ c 2
c 3 [1]||...||c 3 [nb] ← Encrypt(s, m 3 ) 4. A returns 0 to the Finalize procedure if c 3 [2] = c 1 [2]
t ← t + 1 if b = 0 then Real world c ← FDE.enc(K, s, m) else Random world m s,t ← m (index, p) ← findLCP(m s,t , 'm') for i from 1 to p c[i] s,t ← c[i] s,index for i from p + 1 to k Π 2 (s, m[1]..m[i-1], m[i] s,t ) ← ← Rng Π 2 (s, m[1]..m[i-1], .) c[i] s,t ← Π 2 (s, m[1]m[2]...m[i-1], m[i] s,t ) return c s,t procedure Decrypt(s, c) t ← t + 1 if b = 0 Real world m ← FDE.dec(K, s, c) else Random world (index, p) ← findLCP(c s,t , 'c') for i from 1 to p m[i] s,t ← m[i] s,index for i from p + 1 to k Π - 2 (s, m[1]..m[i-1], c[i] s,t ) ← ← Dom Π 2 (s, m[1]..m[i-1], .) m[i] s,t ← Π - 2 (s, m[1]m[2]...m[i-1], c[i] s,t ) return m s,t findLCP(d s,t , 'd') for d ∈ {m, c} p ← 0; pref ← 0; index ← 0 for j from 1 to t -1 for i from 1 to nb while d[i] s,j = d[i] s,t p ← i if p >pref pref ← p; index← j return (index, pref) procedure Finalize(b ) return (b = b )

FDE Security with Unique First Block

Because encryption in the context of FDE is deterministic and length-preserving, encrypting the same plaintext twice will always result in an identical ciphertext. The OS or application may, therefore, want to use a particular encoding of the plaintext, in order to ensure that the ciphertext will not be repeated. This corresponds to Bellare and Rogaway's Encode-Then-Encipher approach [START_REF] Bellare | Encode-then-encipher encryption: How to exploit nonces or redundancy in plaintexts for efficient cryptography[END_REF] to ensure strong privacy. One thus has to determine which encoding is sufficient to ensure security against CPA. In the context of security "up-to-block," this would require a large overhead, since encoding is then required for every block of a sector (typically 128 bits). However, for schemes that are IND-CPA "up-to-repetition" or "up-to-prefix," it is sufficient to ensure that the beginning of every message is unique. This can be done by prepending either random data or a counter, as suggested by Bellare and Rogaway [START_REF] Bellare | Encode-then-encipher encryption: How to exploit nonces or redundancy in plaintexts for efficient cryptography[END_REF].

In this section, we consider variants of the previous security notions with unique first block (ufb) and we prove IND-CPA security for CBC-ESSIV and IGE-ESSIV under this assumption. An application that is aware of this restriction, can therefore format its input such that the first block of every sector is unique. In Section 3.3.2, we give a concrete example of such an application.

Relation to Previous Security Notions. The only difference between ufb model and the previous model is that for a given sector number s, A cannot make two queries to encrypt plaintexts that have same first block. So if a construction is secure under a security notion described in Section 3.1.2, it is still the case in this model. Furthermore, the IND-CPA up-to-prefix, IND-CPA up-to-repetition and IND-CPA security notions become equivalent. This is easy to see: if the first block of plaintext is not repeated, then this is sufficient to ensure that the plaintext prefix or the entire plaintext is not repeated either.

Security Results. In this paragraph, we analyse the FDE modes of operation described in Section 3.1.1 with respect to these security notions for unique first block. These results are summarized in Table 3.2. ECB and CTR. The attacks described in Section 3.1.2 do not make queries with the same first block and the same sector number, and therefore still apply. CBC-ESSIV. For this mode, in the attack of Section 3.1.2, A makes forbidden queries with the same first block. Theorem 3.2.1 states that CBC-ESSIV achieves IND-CPA-ufb security if the underlying blockcipher E is a Pseudo-Random Function (PRF) [START_REF] Bellare | Introduction to Modern Cryptography[END_REF]. We used the code-based game playing framework [START_REF] Bellare | The security of triple encryption and a framework for code-based game-playing proofs[END_REF] for the security proof in Section 3.

CBC-ESSIV Security Theorem 3.2.1. TheIND-CPA-ufb Security of CBC-ESSIV

Let E : {0, 1} k × {0, 1} n → {0, 1} n be a blockcipher. Let A be an IND-CPA-ufb adversary ECB CTR CBC CBC IGE XTS TC1 TC2/3 WTBC IV → n/a s x s E K (s) E K (s) s s s s IND-CPA-block IND-CPA-prefix IND-CPA-repetition IND-CPA IND-CCA-block IND-CCA-prefix IND-CCA-repetition IND-CCA
online enc./dec. parallelizable enc. parallelizable dec. Table 3.2: The security of FDE modes of operation when no diversifier is used, but the first plaintext block unique for any given sector. Here, means that there is a security proof, and means that there is an attack.

against the FDE scheme obtained from the CBC-ESSIV mode on E such that A runs in time t and makes at most q queries to the Encrypt procedure. There exists an adversary B (attacking the PRF security of E) such that:

Adv ind-CPA-ufb cbc-ESSIV (A) ≤ 8 • Adv prf E (B) + q 2 (nb + 1) 2 2 n-1
where B runs in time at most t = t + O(q + nq(nb + 1)) and makes at most q = q(nb + 1) queries to its oracle.

Proof. Let G 0 be the real-or-random security game as defined in Figure 3.11. In the following, we consider a sequence of modified games G 1 , . . . , G 4 . We wish to upper bound the advantage of an adversary A, which by definition is

Adv ind-CPA-ufb cbc-ESSIV (A) = 2 • P r[G A 0 ⇒ true] -1.
• Game G 1 is identical to game G 0 except that instead of the keyed blockcipher encryption E(K , •) with a key K randomly chosen in the FDE scheme obtained from the CBC-ESSIV, we use a random function F instead. As in the previous security notions, the function F is generated via the lazy sampling method. The game G 1 is given in detail in Figure 3.12.

We consider an adversary B 1 attacking the PRF security of E which runs A and simulates these two games by replacing the evaluation of E or F by its own oracle (so that if B 1 is in the real world, A is in the game G 0 , but if B 1 is in the random world, A is in the game G 1 ). If A makes q queries to the Encrypt procedure then B 1 makes q = q(nb + 1) queries to its own oracle and we have:

P r[G A 0 ⇒ 1] -P r[G A 1 ⇒ 1] ≤ Adv prf E (B 1 ). Game G 1 procedure Encrypt(s, m) if b = 0 then c[0] ← ←{0, 1} n if s ∈ Dom(F ) then c[0] ← F (s) else F (s) ← c[0] for i from 1 to nb X ← c[i -1] ⊕ m[i] c[i] ← E(K, X) c ← c[1]||c[2]|| . . . ||c[nb] else c ← ←{0, 1} nb•n return c Game G 2 procedure Encrypt(s, m) if b = 0 then c[0] ← ←{0, 1} n if s ∈ Dom(F ) then c[0] ← F (s) else F (s) ← c[0] for i from 1 to nb c[i] ← ←{0, 1} n X ← c[i -1] ⊕ m[i] if X ∈ Dom(F) then c[i] ← F(X) F(X) ← c[i] c ← c[1]||c[2]|| . . . ||c[nb] else c ← ←{0, 1} nb•n return c Figure 3.12: Game G 1 and game G 2 for CBC-ESSIV IND-CPA-ufb
• Game G 2 is identical to game G 1 except that instead of the keyed blockcipher encryption E(K, •) with a key K randomly chosen in the FDE scheme obtained from the CBC-ESSIV, we use a random function F instead. As in the previous security notions, the function F is generated via the lazy sampling method. The game G 2 is given in detail in Figure 3.12.

Again we consider an adversary B 2 attacking the PRF security of E which runs A and simulates these two games by replacing the evaluation of E or F by its own oracle (so that if B 2 is in the real world, A is in the game G 0 , but if B 2 is in the random world, A is in the game G 1 ). If A makes q queries to the Encrypt procedure than B 2 makes q = q(nb + 1) queries to its own oracle and we have:

P r[G A 1 ⇒ 1] -P r[G A 2 ⇒ 1] ≤ Adv prf E (B 2 ).
• Game G 3 (see Figure 3.13) is identical to game G 2 except that we add Boolean flags in the pseudo-code for the remainder of the proof (see Figure 3.13). We have

P r[G A 2 ⇒ 1] = P r[G A 3 ⇒ 1].
• Game G 4 : The games G 3 and G 4 (see Figure 3.13) are identical except if the boolean flag bad 2 is set to true. We thus have

P r[G A 3 ⇒ 1] -P r[G A 4 ⇒ 1] ≤ P r[G A 3 sets bad 2 ].
• Game G 5 : In game G 5 (see Figure 3.13), the generated ciphertexts in the Encrypt procedure are independent of the bit b and we have

P r[G A 4 ⇒ 1] = 1/2.
We first evaluate P r[G A 5 sets bad 1 ]. For the i-th request to the Encrypt procedure, the probability to have a collision for the output of the F is at most (i-1) queries:

2 n then for all the q Game G 3 Game G 4 Game G 5 procedure Encrypt(s, m) if b = 0 then c[0] ← ←{0, 1} n if s ∈ Dom(F ) then c[0] ← F (s) else if c[0] ∈ Rng(F ) then bad 1 ← true F (s) ← c[0] for i from 1 to nb X ← c[i -1] ⊕ m[i] X ← ←{0, 1} n c[i] ← ←{0, 1} n if X ∈ Dom(F) then c[i] ← F(X) ; bad 2 ← true F(X) ← c[i] c ← c[1]||c[2]|| . . . ||c[nb] else c ← ←{0, 1} nb•n return c
P r[G A 5 sets bad 1 ] ≤ q i=1 (i -1) 2 n = q(q -1) 2 n+1 .
If the Boolean flag bad 1 is not set to true, then in the security game, the adversary A never queried the Encrypt procedure with two different sector numbers s and s such that F(s) = F(s ). In particular, for each query, the value c[0] is random and not revealed to A and by the unique-first-block assumption, it is never used twice with the same plaintext block m [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]. We thus have:

P r[G A 4 sets bad 2 but not bad 1 ] = P r[G A 5 sets bad 2 but not bad 1 ]
Finally, in game G 5 , we have

P r[G A 5 sets bad 2 ] ≤ (nb+1)q-1 i=1 i 2 n ≤ q 2 (nb + 1) 2 2 n+1 .
Summing up, we obtain that Adv ind-CPA-ufb cbc-essiv (A) is upper-bounded by

2 • Adv prf E (B ) + 2 • Adv prf E (B ) + q 2 (nb + 1) 2 2 n + q(q -1) 2 n .
Considering an adversary B attacking the PRF security of E that simply runs B 1 with probability 1/2 and B 2 with probability 1/2, we have

Adv prf E (B) ≥ 1 2 Adv prf E (B 1 ) and Adv prf E (B) ≥ 1 2 Adv prf E (B 2 )
and we obtain the claimed bound.

Adversary. The following attack shows that CBC-ESSIV does not achieve IND-CCA-ufb up-to-prefix security:

1. A chooses a plaintext m 1 = m 1 [1]||m 1 [2]|| . . . ||m 1 [nb] ∈ {0, 1}
) to obtain c 1 [1]||c 1 [2]|| . . . ||c 1 [nb]. 2. A builds a ciphertext c 2 = c 2 [1]||c 2 [2]|| . . . ||c 2 [nb] with c 2 [1] = c 1 [2], c 2 [2] = c 1 [2]
= m 2 [1]||m 2 [2]|| . . . ||m 2 [nb]. 3. A outputs 0 if m 2 [2] = m 1 [3] and 1 otherwise.
The equality m 2 [2] = m 1 [3] is always satisfied in the real world but this property holds only with probability 2 -n in the random world.

IGE-ESSIV Security

The following theorem states that the mode IGE-ESSIV achieves IND-CPA-ufb security:

Theorem 3.2.

[The IND-CPA-ufb Security of IGE-ESSIV]

Let E : {0, 1} n × {0, 1} n → {0, 1} n be a blockcipher. Let A be an IND-CPA-ufb adversary against the FDE scheme obtained from the IGE-ESSIV mode on E such that A runs in time t and makes at most q queries to the Encrypt procedure. There exists an adversary B (attacking the PRF security of E) such that:

Adv ind-CPA-ufb ige-ESSIV (A) ≤ 8 • Adv prf E (B) + q 2 (nb + 1) 2 2 n-1
where B runs in time at most t = t + O(q + nq(nb + 1)) and makes at most q = q(nb + 1) queries to its oracle.

Proof. This proof is similar to CBC-ESSIV proof. Let G 0 be the real-or-random security game as defined in Figure 3.11. In the following, we consider a sequence of modified games G 1 , . . . , G 5 . We wish to upper bound the advantage of an adversary A which by definition is

Adv ind-CPA-ufb ige-ESSIV (A) = 2 • P r[G A 0 ⇒ true] -1.
• G 1 -G 3 : (see Figure 3.14) The only point that changes between CBC-ESSIV games G 0 to G 4 is that the ciphertext block is not the output of the PRF Π but the output XORed with the previous plaintext block. Adversary. The following attack (inspired by Rohatgi [START_REF] Jutla | Attack on Free-MAC[END_REF]) shows that IGE-ESSIV does not achieve IND-CCA-ufb up-to-prefix security: [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] is always satisfied in the real world, but this property holds only with probability 2 -n in the random world.

Game G 1 procedure Encrypt(s, m) if b = 0 then m[0] ← 0 n c[0] ← ←{0, 1} n if s ∈ Dom(F) then c[0] ← F(s) else F(s) ← c[0] for i from 1 to nb Y ← ←{0, 1} n X ← c[i -1] ⊕ m[i] if X ∈ Dom(F) then Y ← F(X) F(X) ← Y c[i] ← Y ⊕ m[i -1] c ← c[1]||c[2]|| . . . ||c[nb] else c ← ←{0, 1} nb•n return c Game G 2 Game G 3 Game G 4 procedure Encrypt(s, m) if b = 0 m[0] ← 0 n c[0] ← ←{0, 1} n if s ∈ Dom(F ) then c[0] ← F (s) else if c[0] ∈ Rng(F ) then bad 1 ← true F (s) ← c[0] for i from 1 to nb X ← c[i -1] ⊕ m[i] X ← ←{0, 1} n Y ← ←{0, 1} n if X ∈ Dom(F) then Y ← F(X) bad 2 ← true F(X) ← Y c[i] ← Y ⊕ m[i -1] c[i] ← ←{0, 1} n c ← c[1]||c[2]|| . . . ||c[nb] else c ← ←{0, 1} nb•n return c
1. A chooses a plaintext m 1 = m 1 [1]||m 1 [2]|| . . . ||m 1 [nb] ∈ {0, 1}
) to obtain c 1 [1]||c 1 [2]||..||c 1 [nb]. 2. A builds a ciphertext c 2 = c 2 [1] . . . c 2 [2]|| . . . ||c 2 [nb] with c 2 [1] = c 1 [1], c 2 [2] = m 1 [2] ⊕ c 1 [3] ⊕ m 1 [1] and arbitrary c 2 [i] ∈ {0, 1} n for i ∈ {3, . . . , nb} and query the Decrypt procedure with (s, c 2 ) to obtain a plaintext m[] 2 = m 2 [1]||m 2 [2]|| . . . ||m 2 [nb]. 3. A outputs 0 if m 2 [2] = m 1 [3] ⊕ c 1 [2] ⊕ c 1 [1] and 1 otherwise. The equality m 2 [2] = m 1 [3] ⊕ c 1 [2] ⊕ c 1

FDE Security with a Diversifier

Typically, IND-CPA cannot be reached for FDE, as the deterministic nature of FDE means that identical plaintexts will result in identical ciphertexts. We worked around this problem in the previous section by imposing a restriction on the plaintext: the first plaintext block must be unique. Now, we introduce another way to achieve IND-CPA, without restricting the plaintext, but still without storing additional data. Instead, we will use a diversifier j, which will be associated to every sector. To be able to stay within the constraints of FDE, it should somehow be possible to assign a diversifier to every sector without using additional storage. Possible candidates in the particular case of SSDs will be considered in Section 3.3.1. For now, it is enough to consider that for each encryption, a diversifier is picked among {0, 1} d , in such a way this diversifier is never repeated for a particular sector.

Then two identical plaintexts with the same sector number will have different ciphertexts, a property that could previously not be achieved within the context of FDE. The combination of the sector number s and the diversifier j is used instead of the sector number in FDE constructions. The combination proposed is simply the concatenation between these two values s||j such as s ∈ {0, 1} σ , j ∈ {0, 1} d and n = d + σ.

For the analysis in this section, it suffices that the diversifier is never repeated for a particular sector. As such, the security analysis is the same as if the diversifier were a nonce. However, we will explain in Section 3.3.1 that efficiency reasons require that at any particular point in time, all diversifier values should occur roughly the same number of times and that the diversifier must be a rather short value, typically only a few bits.

Security Results. IND-CPA up-to-repetition becomes equivalent to IND-CPA security: the only difference between these notions is that if A asks to encrypt twice the same query (s||j, m) the answer will be the same ciphertext, but these queries are not allowed any more under the diversifier model. Moreover, in IND-CCA game, the adversary is not allowed to query the decryption of a ciphertext what was previously encrypted, or vice versa. It can, therefore, be seen that IND-CCA up-to-repetition becomes equivalent to IND-CCA. Similarly, since the adversary A is not allowed to encrypt twice with the same pair s||j, the IND-CPA up-to-block property is also equivalent to the other IND-CPA security notions.

Table 3.3 summarizes the security properties achieved by the FDE modes of operation when used with a diversifier. The IND-CPA attacks of Remark 3.1.2 still carry over to ECB and CBC with a sector-number IV. However CTR mode becomes secure as the counter value is not repeated [START_REF] Bellare | A concrete security treatment of symmetric encryption[END_REF]. The IND-CPA security of XTS, TC1, TC2, TC3 and WTBC follows from the fact that the tweak is not reused. For CBC-ESSIV and IGE-ESSIV, the IND-CPA security follows from the proof of Sect. 3.2: now the first block may be reused, but the IV is unique.

Let us explain the attacks under IND-CCA in Table 3.3:

• This following attack shows that CTR is not IND-CCA-xx: A encrypts (s||j, m) with m any plaintext and any s||j and receives c then A decrypts (s||j, c ) where As shown in Table 3.3, the diversifier shows how to reach IND-CPA security for most commonly-used FDE encryption modes. It also succeeds in providing IND-CCA security for WTBC constructions, which not achievable in a "classical" FDE model.

c = c ⊕ 0 n-1 1. A. Then, m [1] = m[1] ⊕ 0 n-1

Solid State Drive

We now recall the basics of SSD storage, so that we can explain how to modify only the firmware of SSDs to associate a diversifier to every sector. This diversifier allows us to encrypt the same plaintext in distinct ways for the same sector number.

SSDs are flash memory devices that are gradually replacing the magnetic Hard Disk Drive (HDD) due to their reliability and performance. Just like HDDs, they are sector-addressable devices. They are indexed by a sector number that is also known as a Logical Block Address (LBA). This ensures that the physical details of the storage device are not exposed to the OS, but are managed by the firmware of the storage device. For SSDs, the Flash Translation Layer (FTL) stores the mapping between LBAs and Physical Block Addresses (PBAs). This FTL is necessary to ensure an even distribution of writes to every sector number (wear leveling) and to invalidate blocks so that they can later be recycled (garbage collection). This FTL is necessary due to the physical constraints of flash storage: any physical address can only be written a limited number of times, and rewriting individual sectors is not possible: invalidated sectors can only be recovered in multiples of the erase block size. SSD Components. The flash memory of an SSD is hierarchically organized as a set of flash chips called packages, which are further divided in dies, planes, blocks2 and pages. Every page consists of one or more sectors, and is the smallest unit that can be written. The smallest unit that can be erased is a block. Invalidated blocks must be erased before writing, and the number of erasures and writes to every block is limited for flash storage. To abstract away the notion of packages, dies and planes, the Open NAND Flash Interface (ONFI) standard introduces the notion of Logical Unit Number (LUN) as the minimum granularity of parallelism for flash storage. As operations can be issued to several planes in parallel, a LUN corresponds to a plane.

Introducing a Diversifier. In the context of SSD storage, we will show how to associate a diversifier to every LBA. This diversifier will not be stored, and will not modify the data structures of the SSD. Instead, the diversifier will impose an additional restriction on the FTL, meaning that the diversifier determines which PBAs can store the data corresponding to a particular LBA. The intuition is that if the diversifier is selected "randomly" for every write operation, the data will be spread out evenly over the SSD, and the SSD performance should not be affected too much. We will verify this by implementing and benchmarking our proposed solution in Section 3.3.1. When a write command is issued, there are various ways to specify a diversifier value for a given LBA. We will prefer to transmit this information in one operation. As such, we do not only avoid the performance drawbacks of issuing several operations to write one sector, but we also do not need to worry about inconsistent states when operations are lost, modified, or reordered. In particular, we propose to send the diversifier along with the sector data as part of a "fat" sector that is already supported in SATA (Serial ATA) interface for storage devices. This diversifier value will be returned to the OS when a large sector read command is issued. In an attempt to make the diversifier as long as possible, we may want to consider the optimal (yet completely unrealistic) scenario: the diversifier uniquely specifies the physical page to which the data must be written. But, even then, the size of the diversfier is typically be very short: e.g., only 24 bits in case of an 128 GB SSD with 8 kB pages. We will, in fact, choose the diversifier to be much shorter, so that a practical implementation is possible that minimally modifies the SSD firmware. This diversifier cannot be selected at random, as it would be too short to avoid repetitions for a particular sector. However, it can also not be a counter, as all diversifier values should be used roughly an equal number of times over all sectors to spread the writes over the entire disk layout.

In our solution, we want to avoid that the SSD needs to send data back to the host for decryption and re-encryption under a different diversifier, as this would affect the SSD performance quite drastically. Therefore, wear leveling and garbage collection operations may not change the diversifier. A straightforward solution is then to make the diversifier correspond to the LUN (or a set of LUNs), which is what we will implement and benchmark in the following section. The OS can freely select the diversifier values; however they may not be repeated for any particular sector, and all diversifier values should be used roughly the same number of times. In Section 3.3.2, we give a concrete example of an application where the OS implements such a diversifier. More specifically, we show how the OS can ensure randomness and uniqueness even for very short diversifier values.

EagleTree Benchmarks. In order to confirm that the concept of a diversifier is not just feasible but also efficient to implement, we implemented this feature in the EagleTree SSD simulator [DSB + 13] and performed various benchmarks. Our modified EagleTree simulator is based on the latest commit of EagleTree on GitHub3 of February 23, 2016, to which we made three small modifications. In particular:

• We added an additional diversifier data member to the Event class, which is set to a random value every time the operating system generates a write operation in generate_io().

• The get_free_block_pointer_with_shortest_IO_queue() function in the class Block_manager_parent now has a diversifier argument added to it. It restricts I/O operations to the package that is specified by the value of diversifier.

• In the block manager Block_manager_parallel, the choose_best_address() and choose_any_address() functions were redefined. For write operations that are issued either by the operating system or by the garbage collector, the package will be restricted to the value of the diversifier. This value is passed on when get_free_block_pointer_with_shortest_IO_queue() is called within this function.

No modifications are made for reads and writes to sectors that are not visible to the OS, such as for the mapping information I/O generated by the FTL.

The device that is simulated, consists of eight packages, each containing four dies of 256 blocks. Each block consists of 128 pages of 4096 bytes. EagleTree currently does not support multiple planes per die. The page read, page write, bus ctrl, bus data and block erase delays are 5 µs, 20 µs, 1 µs, 10 µs and 60 µs respectively. We assume that any latencies incurred by the OS (including sector encryption and decryption) are negligible with respect to these numbers. The SSD has an overprovisioning factor of 0.7.

We simulate an SSD configured with DFTL and the greedy garbage collection policy. The base benchmarks use a simple block scheduler that assigns the next write to whichever package is free. We then compare this performance to various choices of the diversifier value, which determines the package for every write.

The workload used in our benchmarks is the same as the example in EagleTree's demo.cpp file: first a large write is made to the entire logical address space. This write is performed in random order, but without writing to the same address twice. Once this large write is finished, two threads are started up: one performs random reads, and the other performs random writes in the address space. After three million I/O operations, the simulation is stopped.

The benchmark results are shown in Table 3.4. They suggest not to choose the number of diversifier values to be equal to the number of packages, as the impact on performance is quite significant. Compared to the benchmarks without diversifier, the throughput of the reads and writes drop by 25 % and 7 % respectively. The average latency increases by 44 % for reads, and 8 % for writes. In this setup, the reads and writes of each garbage collection operation are restricted to one package, and this affects performance quite significantly. Reads suffer more than writes; this is mainly because there is no significant drop in performance for the initial write operations to fill up the SSD. To avoid the large impact on performance, we must, therefore, choose the number of diversifier values to be smaller than the number of packages. When the diversifier is two bits, our simulations show an increase of the average latency of 12 % for reads and 1 % for writes and a reduction of throughput of 9 % for reads and 1 % for writes. The total throughput reduction (reads and writes combined) is at most 4 %. For a diversifier of one bit, latency and throughput are affected by less than 2 %. We also looked into the number of garbage collection and the number of erasures. They worsen by less than 6 % for a diversifier of two bits, but by 16 % for a diversifier of three bits.

Case Studies

We now present three case studies for FDE. They apply the theoretical framework developed in this chapter, in order to obtain novel practical solutions that advance state of the art. For each of the case studies, we explain the advantages of our solutions over existing techniques. The examples are rather concrete for the sake of clarity, but the practical relevance of our results is not limited to these particular examples.

Online Ciphers for FDE

Case Description. We consider an FDE application for which both encryption, and decryption must be online. Off-line modes of operation cannot be implemented due to a practical restriction: the encryption and decryption must be performed by a hardware security module (HSM) that does not have enough memory to store an entire sector. With this consideration in mind, what FDE security notions can be achieved by this application? Solution. As encryption and decryption must be online, we know that two plaintexts with a common prefix will result in ciphertexts that have a common prefix as well. In the "up-to-prefix" setting, Table 3.1 explains that neither the commonly-used CBC (e.g. in Microsoft's BitLocker [START_REF] Ferguson | AES-CBC + Elephant diffuser: A Disk Encryption Algorithm for Windows Vista[END_REF]) nor its "improved" IGE variant (see e.g. Fruhwirth [START_REF] Fruhwirth | New methods in hard disk encryption[END_REF]) provides chosen-plaintext or chosen-ciphertext security. However, these security properties can be achieved by TC2 and TC3.

Advantages. We are unaware of any applications of TC2 and TC3 in FDE. However, when encryption and decryption must be online, these constructions provide up-to-prefix chosen-ciphertext security in a setting where the commonly-used CBC and the often-proposed IGE are insecure.

FDE-Aware Database Applications

Case Description. After intensive benchmarking, a database application was found to achieve an insufficiently high throughput when encryption is enabled. Without encryption, the performance of the database application is within acceptable limits. To avoid the security risks of storing data without encryption, a decision was made to use a hardware-based FDE based on CBC-ESSIV. Database applications are often already aware of the sector size to align read and write operations to sector boundaries, 4 and these operations already contain some wastage. 5 This is also the case for the application that we consider, which additionally also knows whether FDE is enabled for a particular disk volume. For the given application, at least eight bytes of padding are added to the end of every record in order to ensure sector alignment. Is it possible for this application to achieve indistinguishability under chosen plaintexts, which implies that identical sector plaintexts will result in distinct ciphertexts? Solution. CBC-ESSIV is a common solution for FDE, but unfortunately, Table 3.1 explains that it does not achieve any of the IND-CPA notions that are defined in this chapter. However, Table 3.2 shows that IND-CPA can be achieved for CBC-ESSIV if the first plaintext block for every sector is unique. The application can decide to reduce the padding at the end of every record by eight bytes, and instead prepend an eight-byte time stamp. Assuming that this time stamp will not repeat, the first plaintext block of every sector is unique, and indistinguishability under chosen plaintext attacks holds. Of course, the application should detect whether FDE using CBC-ESSIV is enabled for a particular disk, and return an error if this is not the case.

Advantages. To the best of our knowledge, existing solutions would encrypt at the application level, at the disk level using FDE, or would use a combination of both. The FDE is unaware of the application, as it performs encryption at the sector level. However what if the application is aware of the FDE? If that is the case, we explain how the application can generate plaintexts of a particular structure in order to obtain a stronger notion of FDE security, but without performing any encryption at the application level.

On-the-Fly Firmware Updates

Case Description. A medical monitoring system continuously measures the patient's vital signs. The device has an Internet connection, which it uses to transmit its measurements, as well as to install security-critical on-the-fly firmware updates. The firmware is stored in off-chip Flash memory. Hackers could easily read out previous versions of the firmware, as they were stored without encryption. To prevent such attacks, the company has decided to use FDE because there is no space to store additional data such as IVs, nonces or tags. However, the company identifies a problem with FDE: if hackers know which sectors in the Flash memory are modified by a security update, they can compare these sectors with older firmware. These hackers can then sniff around in the same part of the code to quickly rediscover the security vulnerability, and possibly exploit it before the devices in the field are updated. How can this problem be avoided?

Solution. It seems that the company wants to represent sectors with identical plaintexts by different ciphertexts, in order to hide which sectors are affected by a firmware update. Classical FDE does not allow this, as there is no space to store additional data such as an IV or nonce. However, Flash-based storage allows us to achieve security against chosen plaintexts, by modifying the Flash controller to introduce a diversifier. Depending on the security requirements against chosen ciphertexts, Table 3.3 proposes various solutions. Initially, the diversifier will be the most significant d bits of the hash of the sector number, where d is the size of the diversifier in bits. Every firmware update will have a version number, which will be XORed to the diversifier of every sector. Clearly, the number of firmware updates must be less than the number of diversifier values. Under this restriction, all diversifiers will be unique for a particular sector. Note that the diversifier cannot be a counter, as this would result in a significant degradation of performance. However, it can also not be chosen at random, as this will likely result in collisions due to the small size of the diversifier.

Advantages. An alternative solution may be to randomize all the instructions for every firmware update, but this technique is very error-prone and it will be difficult (if not impossible) to ensure that the device remains in a consistent state, in particular if power is lost during an on-the-fly firmware update. Our solution avoids this: for sectors that are unaffected by the update, the ciphertext changes but the plaintext remains the same. Changing the FDE key is not an option for an on-the-fly update: while the device is being updated, there is no non-volatile memory available to store the mapping between encryption keys and sector numbers. However, changing the FDE key is possible during scheduled maintenance, when updates do not need to be performed on the fly. The firmware update counter can then be reset. Therefore, as long as the number of on-the-fly updates before scheduled maintenance is less than d, the small size of the diversifier does not present a problem.

Conclusion.

We presented a theoretical framework for disk encryption, and we analysed several existing constructions against chosen-plaintext and chosen-ciphertext attacks, under different notions of the ideal-world encryption oracle: up-to-repetition, up-to-prefix, or up-toblock. Using this model, we recalled that IGE-ESSIV does not have chosen-ciphertext-security under any of the notions that we consider, which shows that the AREA construction proposed by Fruhwirth [START_REF] Fruhwirth | New methods in hard disk encryption[END_REF] is insecure. Nevertheless, we proved that IGE-ESSIV and even CBC-ESSIV could provide security under chosen-plaintext attacks, under the assumption that the first block of a plaintext is never repeated for the same sector number. We also revisited FDE from an engineering perspective and showed how to modify the firmware of a solid-state drive to associate a short "diversifier" to every sector-plaintext pair (s, m). This diversifier makes it possible to encrypt the same plaintext into different ciphertexts, something that was previously impossible without additional storage.

The seminal paper of Goldwasser and Micali [START_REF] Goldwasser | Probabilistic encryption[END_REF] pointed out early on, that semantic security may not hold if the adversary gets to see an encryption of the secret key. This practice was generally perceived as a dangerous use of an encryption scheme, but several studies have revealed that this security notion is both theoretically and practically important (like in FDE mechanisms such as BitLocker [START_REF] Boneh | Circular-secure encryption from decision Diffie-Hellman[END_REF] where the encryption key may be stored in the page file and thus encrypted along with the disk content). An encryption scheme is said to be Key-Dependent Message (KDM) secure if it is secure even against an attacker who can encrypt messages that depend on the secret key. Formally, security is defined with respect to a set Φ of functions φ mapping keys to messages for which the adversary can obtain key-dependent encryptions. This security notion was first formalized by Black, Rogaway and Shrimpton [START_REF] Black | Encryption-scheme security in the presence of key-dependent messages[END_REF] for symmetric encryption and was subsequently extensively studied for both symmetric and asymmetric cryptosystems (see, e.g., [BRS03, HK07, HU08, MTY11, DS14, App14, LLJ15]).

The Even-Mansour (EM) construction introduced in [EM93] is the simplest blockcipher known based on a single public permutation P on n-bit strings (see Figure 4.1). It uses two independent n-bit keys (K 1 , K 2 ) and on input an n-bit plaintext m, it outputs Its generalization, the iterated Even-Mansour construction (also known as the keyalternating cipher) was proposed by Daemen and Rijmen [START_REF] Daemen | The wide trail design strategy[END_REF] as an abstraction of the design paradigm of substitution-permutation networks. This construction has become the object of abundant analysis and many recent blockciphers follow this design (e.g., Present [BKL + 07] and PRINCE [BCG + 12]). If one models the underlying permutations as random public permutations, it is sometimes possible to prove the nonexistence of generic attacks against the iterated Even-Mansour construction (i.e., attacks that are possible independently of a particular instantiation of the permutations P 1 , P 2 , . . . , P r ). If the adversary is only given black-box oracle access to these random permutations, the iterated Even-Mansour cipher was proved to achieve several security notions such as traditional indistinguishability (see [CLL + 14]), security against related-key attacks [START_REF] Farshim | The related-key security of iterated Even-Mansour ciphers[END_REF][START_REF] Cogliati | On the provable security of the iterated Even-Mansour cipher against related-key and chosen-key attacks[END_REF], security in the multi-user setting [START_REF] Mouha | Multi-key security: The Even-Mansour construction revisited[END_REF][START_REF] Viet | Key-alternating ciphers and key-length extension: Exact bounds and multi-user security[END_REF] or indifferentiability from ideal ciphers1 (see [START_REF] Dai | Indifferentiability of iterated Even-Mansour ciphers with non-idealized keyschedules: Five rounds are necessary and sufficient[END_REF] and references therein).

EM P ((K 1 , K 2 ), m) = K 2 ⊕ P(K 1 ⊕ m) . m K 1 P 1 K 2 c
Another simple construction used to build secure blockciphers is the Feistel Network. The Feistel Network, introduced in the seminal Luby-Rackoff paper [START_REF] Luby | How to construct pseudo-random permutations from pseudo-random functions[END_REF], is a construction that enables to build a (n 1 + n 2 )-bit pseudorandom permutation family from a smaller random function family that takes n 1 -bit inputs and gives n 2 -bit outputs. The network is a repetition of a simple construction (the one-round Feistel network, as shown in Figure 4.2) based on pseudorandom functions that can be the same for all rounds or different. Starting from the Luby-Rackoff result that the 3-round Feistel scheme is a pseudorandom permutation [START_REF] Luby | How to construct pseudo-random permutations from pseudo-random functions[END_REF], Patarin [START_REF] Patarin | Pseudorandom permutations based on the D.E.S. scheme[END_REF] proved that four rounds is indistinguishable from a strong pseudorandom permutation (where strong means that CCA adversary is considered). Other analysis gave better bounds for r rounds [START_REF] Ueli | A simplified and generalized treatment of Luby-Rackoff pseudorandom permutation generator[END_REF][START_REF] Patarin | About Feistel schemes with six (or more) rounds[END_REF][START_REF] Ueli | The security of many-round Luby-Rackoff pseudo-random permutations[END_REF]. Dai and Steinberger [START_REF] Dai | Indifferentiability of 8-round Feistel networks[END_REF] proved that the 8-round Feistel network is indifferentiable from arandom permutation and Barbosa, and Farshim gave the analysis in the related-key model [START_REF] Barbosa | The related-key analysis of Feistel constructions[END_REF].

Some Feistel blockciphers are balanced Feistel networks: the input is split into two equal length values L, R and we have n-bit to n-bit round function (e.g., n 1 = n 2 ). For instance, DES and SIMON [BTCS + 15] are balanced whereas Bear, Lion [START_REF] Anderson | Two practical and provably secure block ciphers: BEARS and LION[END_REF], Misty [START_REF] Matsui | New block encryption algorithm MISTY[END_REF] and RC6 [START_REF] Iwata | On the pseudorandomness of the AES finalists -RC6 and Serpent[END_REF] are unbalanced [START_REF] Viet | On generalized Feistel networks[END_REF]. Usually, the round function of practical blockciphers (non idealized) is instantiated with a random public function and a round key K, as shown in Figure 4.2. This special case of Feistel cipher is known as the Key-Alternating Feistel [START_REF] Lampe | Security analysis of key-alternating Feistel ciphers[END_REF] and is of interest as it is a more practical construction: DES is a 16 rounds balanced KAF where all the public round functions are the same and where each subkey is derived from a master key. More formally, we can say that the Key-Alternating Feistel cipher [START_REF] Lampe | Security analysis of key-alternating Feistel ciphers[END_REF] (KAF) is a Feistel network where the i-th round pseudorandom function F i is instantiated by

L f K R S T L F K R S T
F i (K i , x) = f i (K i ⊕ x)
where the round function f i is a public function. The KAF construction is said to be idealized when the public functions f i are random functions. Lampe and Seurin [START_REF] Lampe | Security analysis of key-alternating Feistel ciphers[END_REF] analysed the indistinguishability of this construction for r rounds (see Figure 4.15) and gave a beyond birthday security bound up to 2 r n r +1 for 6r -round KAF using the H-coefficient technique. In these settings the adversary has to distinguish two systems (KAF, f 1 , . . . , f r ) and (P, f 1 , . . . , f r ) where f i are the public random functions accessible to the adversary and P is a secret random permutation. They also recalled that two rounds of a KAF can be seen as a single-keyed EM cipher (noticed in [START_REF] Daemen | The wide trail design strategy[END_REF] in the first place). Guo and Lin [START_REF] Guo | On the indifferentiability of key-alternating Feistel ciphers with no key derivation[END_REF] proved that the 21-round KAF * construction, which is a variant of the KAF construction where the key K i is XORed after the application of the public random function f i , is indifferentiable from a random permutation. The most recent work [START_REF] Guo | Revisiting key-alternating feistel ciphers for shorter keys and multi-user security[END_REF] is the analysis of the KAF for short keys and in the multi-user setting. In the following, we consider only balanced KAF.

The analysis of the KDM security of Even-Mansour ciphers (section 4.2) and the KDM security of the Key-Alternating Ciphers uses two different methods. The Even-Mansour ciphers are analysed in a new modular framework called the splitting and forgetting technique, which is detailed in Section 4.1. This framework is usable for other blockciphers and possibly also other forms of security under correlated inputs (like Related-Key Attack security) and it is based on a two-stage adversary: an adversary A against the KDM security of any cipher should be able to encrypt messages that depend on the key without knowing this key; that is why an intermediate adversary B which knows the key is used as an intermediate between A and the encryption oracle. We apply this framework to analyse the KDM security of the Ideal Cipher (Section 4.1.2) and the 1 and 2-round Even-Mansour construction. This work was partially published [START_REF] Farshim | Security of even-mansour ciphers under key-dependent messages[END_REF], at IACR Transactions on Symmetric Cryptology in 2018, with Pooya Fashim and Damien Vergnaud.

We offer another method to analyse the KDM security of blockciphers based on the H-coefficient [START_REF] Patarin | The "coefficients H" technique (invited talk)[END_REF] technique. The H-coefficient technique enables to upper bound the advantage of an adversary playing an indistinguishability game between an ideal world and a real world. To do so, the probability distributions of the transcripts resulting from the interactions of an adversary in the ideal world and in the real world are analysed. For the KDM setting, we introduce an intermediate game, the perfect world, where the key is not used and for each different input function the encryption oracle implements a random permutation. We apply twice the H-coefficient technique: first generically (this step is independent of the analysed blockcipher) between the ideal world and the perfect world and then between the perfect world and the real world for a specific blockcipher. The details of this methodology are given in Section 4.3 and it is applied to the Key-Alternating Feistel in Section 4.4. The one-round Even-Mansour cipher is analysed with both techniques.

KDM Security via Splitting and Forgetting Technique

Our approach is to start with a blockcipher and gradually modify its oracles with independent ones until we reach a construction whose outputs are uniformly and independently distributed. In the particular case of Even-Mansour ciphers, we will replace at most two of the underlying permutations (namely P 1 and P r ) with oracles that completely randomize the outputs of the cipher (in both directions for decryption and encryption queries respectively); see Figure 4.3.

We consider a general security game where an adversary A has access to an oracle through two different interfaces. The approach consists in studying the conditions under which the security game can be modified (in an indistinguishable way for A) so that the second interface provides access to an independent instance of this oracle. We also analyse the conditions under which this oracle can further be replaced by a forgetful oracle that completely removes the dependency of outputs on inputs. For KDM security, we then have to prove that this replacement by forgetful oracles (after splitting) can be performed indistinguishably if the set of key-dependent messages functions that the adversary has at its disposal satisfies certain well-defined conditions. These conditions reduce to checking that the adversary A does not query these oracles on the same inputs (in the backward and forward direction in the case of random permutations). This general technique allows us to analyse the r-round iterated EM construction in a unified way. It is potentially applicable for an arbitrary number of rounds r but, here we only apply to three EM cases with r = 1, 2 (the latter with(out) permutation reuse) and also the KDM security of the ideal cipher.

We first show that our "splitting and forgetting" technique is applicable to analyse the KDM security of the ideal cipher. Halevi and Krawczyk [START_REF] Halevi | Security under key-dependent inputs[END_REF] proved that the ideal cipher achieves KDM security if one restricts the function class Φ to be a singleton and containing a function that is independent of the ideal cipher itself. Using our strategy, we proved the KDM security of the ideal cipher against adversaries with significantly larger classes of KDM functions, including functions that may depend on the ideal cipher. In the particular case where the functions are independent of the ideal cipher itself, it is sufficient to assume that the set of functions is claw-free, i.e., when distinct functions disagree on random inputs. We then analyse the KDM security of the 1-round EM construction in the randompermutation model. We consider only sets of functions that are independent of the underlying permutation (but our method can be extended to handle functions that depend on the underlying random permutation). We first present a simple attack that excludes the practically relevant case of KDM security with respect to the identity function (and more generally any offset of the key). On the positive side, we proved using our framework that the 1-round EM construction actually achieves KDM security under chosen-ciphertext attacks if the set of functions available to the attacker is claw-free and offset-free, i.e., when functions do not offset the key by a constant.

m K 1 P 1 K 2 P 2 K 3 c P ± 1 P ± 2 m K 1 P - 1 K 2 P - 2 K 3 c A m K 1 P 1 K 2 $ K 3 c P ± 1 P ± 2 m K 1 $ K 2 P - 2 K 3 c
We apply the above method to study the KDM security of the 2-round EM construction in two configurations. We present a simple slide attack [BW99] on a variant with both permutation and key reuse where K 1 = K 2 = K 3 and P 1 = P 2 are used within the construction. The set of KDM functions considered contains the identity function (or more generally any key offsets). We also present a simple attack with complexity 2 n/2 on the most general version. We then apply the framework to prove that 2-round EM achieves KDM security under chosen-ciphertext attacks if the set of functions available to the attacker is only claw-free as long as different permutations are used. When one reuses the same permutation P 1 = P 2 (because of efficiency reasons or because only one "good" public permutation is available), we proved that EM achieves KDM-CCA security if the set of functions available to the attacker is claw-free and also offset-xor-free, meaning that functions do not output offsets of xor of two of the keys.

Our framework is general enough to be applied to other symmetric constructions and/or other security models. Indeed, we believe this approach can be used to re-derive the RKA security of EM ciphers [START_REF] Farshim | The related-key security of iterated Even-Mansour ciphers[END_REF] or that for Feistel networks [START_REF] Barbosa | The related-key analysis of Feistel constructions[END_REF] in a more modular way.

KDM functions.

A key-dependent-message (KDM) function/circuit for key space K and message space M is a deterministic and stateless circuit φ : K -→ M. A KDM set Φ is simply a set of KDM functions φ on the same key and message spaces. We assume membership in KDM sets can be efficiently decided. An oracle KDM function φ O : K -→ M is a KDM function with oracle gates. KDM security. We now formalize security of blockciphers under Key-Dependent Message and Chosen-Ciphertext Attacks (KDM-CCA). We do this in the O-hybrid model of computation where oracle access to O sampled from some oracle space OSp is granted to all parties. For example, in the context of Even-Mansour ciphers, O(i, x, σ ∈ {±}) := P σ i (x) for some random permutations P ± i . We, therefore, grant access to O to the KDM functions and the adversary. Security is now defined in the standard way via indistinguishability from the ideal cipher under a random key, as shown in Figure 4.4. The adversary can ask for key-dependent encryption for functions φ O ∈ Φ and decryption of ciphertexts of its choice. 2 To allow for expressive KDM sets and rule out trivial attacks; we do not allow decryption of ciphertexts that were obtained from the encryption oracle (as otherwise the key can be recovered by decrypting key-dependent ciphertexts). Given blockcipher BC O and an oracle KDM set Φ, we define the advantage of an adversary A against BC O with respect to Φ as

Game KDM-CCA

A,Φ BC O O ← ← OSp L ← [ ] b ← ←{0, 1} K ← ← K (iE, iD) ← ← Block(K, M) b ← ← A O,KDMEnc,Dec Return (b = b) Proc. KDMEnc(φ O ) If φ O ∈ Φ Return ⊥ M ← φ O (K); C ← E O (K, M ) If b = 1 Then C ← iE(K, M ) L ← L : C ; Return C Proc. Dec(C ): If C ∈ L Return ⊥ If b = 1 Return iD(K, C ) Return D O (K, C )
Adv kdm-cca BC O (A, Φ) := 2 • Pr KDM-CCA A,Φ BC O -1 .
Feasibility of Φ-KDM-CCA security very much depends on the KDM functions available in Φ. For instance, if Φ contains the constant functions only, we recover the standard (strong) PRP notion of security, which is feasible under standard assumptions, in the RPM. On the other hand, the set Φ cannot be arbitrary. Consider, for instance, functions φ i that zero all bits of K except the i-th one. Then using encryptions of φ i (K) as well as those for M b,i := 1 i-1 |b|0 n-i for i = 1, . . . , n and b ∈ {0, 1} once can recover the key one bit at a time. For other sets, however, feasibility may or may not be possible. In the following sections, we study this question for the EM ciphers.

Analysis via Forgetful Oracle Replacement

Our strategy to prove KDM security for blockciphers is to gradually modify their internals until we arrive at constructions whose outputs are uniformly and independently distributed. For instance, in the case of EM ciphers we will replace one or more of their underlying permutations with forgetful random oracles. These will completely randomize the outputs of the cipher. To argue that this replacement can be performed indistinguishably, we will impose certain restrictions on how the adversary can interact with the cipher, and in particular, the set of KDM functions at its disposal will be restricted. Some notations. Throughout $ denotes a forgetful oracle over some domain and range that on each input in the domain (even repeated ones) returns a uniformly chosen random element from the range. For a deterministic oracle machine M O we denote by Q(M O (x)) the list of query/answer pairs made to and received from O when M is run on input x. We recall that, for a list L of pairs (x, y), which may have repeats, we denote by Dom(L) the list of first entries x and by Rng(L) the list of second entries.

In this section we present a more general result that comes with a number of advantages: (1) it allows reusing parts of the analyses across different constructions, (2) it highlights the overall proof strategy and how various assumptions are used with it, and (3) it is potentially applicable to setting beyond KDM security, and/or to other constructions.

A Framework for Security Analyses

The blockciphers that we analyse are constructed in a model of computation where all parties have access to some oracle O. 3 These oracles will be sampled from some oracle space OSp. We start with two assumptions on oracles that are of interest to us. Splittability. Let sp(L 1 , L 2 ) be a binary relation on lists L 1 and L 2 . We say oracle O splits under sp if access to O through two interfaces can be modified in an indistinguishable way so that the second interface provides access to an independent instance O . Formally, we define the advantage of D in the split game as

Adv split OSp (D) := 2 • Pr Split D OSp -1 ,
where game Split D OSp is shown in Figure 4.5. An alternative definition would quantify over all D that do not trigger sp. Although sp is publicly checkable, this does not necessarily mean that every D can be modified to one with comparable advantage that never triggers sp: the relation also depends on oracle outputs, which are outside the control of the distinguisher. Although, relations that we study here have the extra property that D can be modified to avoid triggering sp, not all D will be able 3 Access to multiple oracles can be modeled via domain separation. to perform this check. In particular certain two-stage distinguishers D cannot check for sp as the information needed for this check is spread among its two stages. For such D we need to keep sp in the game description.

Game Split

D OSp O, O ← ← OSp b ← ←{0, 1} b ← ← D O,Chal If sp(L 1 , L 2 ) Then b ← 0 Return (b = b ) Proc. O(x) y ← O(x) L 1 ← L 1 : (x, y) Return y Proc. Chal(x) If b = 0 Then y ← ← O(x) Else y ← O (x) L 2 ← L 2 : (x, y) Return y
Forgetful switching. We define the advantage of an algorithm D in the switch game as

Adv forget OSp (D) := 2 • Pr Forget D OSp -1 ,
where game Forget D OSp is formalized in Figure 4.6. Relation fg in this game will typically check for some form of repetitions in oracle queries. Replacing an oracle with a forgetful one removes any dependency of outputs on inputs. Consider now a modified split game (m-Split) that totally drops the sp check. We have the following result. ]. The analysis of the probability that D sets sp 3 in Game 3 is pushed forward in Game 6 (Game 4 , Game 5 and Game 6 are introduced to analyse this event). Let sp i be the flag analogous to sp 3 in Game i. Note that the probability of sp 3 and that of sp 4 are the same as checking condition fg does not effect on setting these flags. Using the fact that sp is publicly checkable (and hence can be used to define a distinguisher) we get that for some D

Game Forget

D OSp O ← ← OSp; b ← ←{0, 1} b ← ← D Chal If fg(L) Then b ← 0 Return (b = b ) Proc. Chal(x) If b = 0 Then y ← ← O(x) Else y ← $(x) L ← L : (x, y) Return y
Pr[D sets sp 4 |b = 1] -Pr[D sets sp 5 |b = 1] ≤ Adv forget OSp (D ).
Finally, the probability of setting sp 6 is identical to that of sp 5 as, once again, fg has no effect on these flags. The theorem now follows by adding the above inequities.

We now consider a class of two-stage adversaries D = (A, B). Adversary A can access the first oracle interface directly: this models the public availability of the oracle. Its access to the second interface, however, is restricted and is through algorithm B only. This algorithm holds information K unavailable to A. It receives messages z from A and returns an output after interacting with the oracles through two interfaces. Formally, we say D is two-stage if it can be written in the form shown in Figure 4.7 (left) for some algorithms A and B. The operation of D = (A, B) in the split game is shown on the right. Although algorithm A can be typically arbitrary, we will put restrictions on the operation of B. For example, in the KDM setting A will correspond to the KDM adversary and B will model the operation of a blockcipher on key-dependent messages. More concretely, for 1-round EM:

B O,Chal (K = (K 1 , K 2 ), z = φ) := EM O,Chal [K 1 , K 2 ](φ O (K 1 , K 2 )) .
We also assume that algorithm B is stateless; that is, it does not store any local state and each time it is run a on fresh K and the incoming input z. 4 This means each instance of B(K, z i ) can be run independently. We also assume B is deterministic, and hence also that A queries B with distinct inputs z. Finally, we assume that B has simulatable outputs: its outputs on a random K and any z are indistinguishable from $ when it is run with respect to oracles (O, $). We now consider the probability of setting sp or fg in m-Split for D that take the above form. We consider a setting where sp and fg can be expressed as disjunctions of simpler checks on pairs of distinct entries from the lists. More precisely, we assume for some algorithm val:

Algo. D O,Chal K ← ← K b ← ← A O,B Return b Proc. B(z) Return B O,Chal (K, z) O A A O 0 O O B(K) B(K)
sp(L 1 , L 2 ) := i,j val(L 1 [i], L 2 [j]) and fg(L 2 ) := i =j val(L 2 [i], L 2 [j]) ( )
where L[i] denotes the i-th element of the list L (which may contain repeats). Each clause depends on at most 2 elements. Hence a clause can be set by two entries corresponding to one of the following cases.

Sp1 : A direct O query of A and a challenge query of B(K, z 1 ) for some z 1 .

Sp2 : An O query of B(K, z 1 ) and a challenge query of B(K, z 2 ) (possibly with z 1 = z 2 ).

Fg : Two challenge queries made by B(K, z 1 ) and B(K, z 2 ) with z 1 = z 2 .

Therefore, triggering events Sp1 and Sp2 is equivalent to triggering sp and Fg is equivalent to fg. Note, for a B that does not place any O calls, event Sp2 never happens.

Some Concrete Cases

To apply the above theorem to KDM attacks, we start by observing that random oracles H, permutations P ± and ideal cipher E ± can be expressed as a single oracle O via encodings

O(x) := H(x) , O(σ, x) := P σ (x) , O(σ, K, x) := E σ (K, x) .
Using the standard PRP/PRF switching lemma [START_REF] Bellare | The security of triple encryption and a framework for code-based game-playing proofs[END_REF] these oracles enjoy forgetful switching with respect to checks fg ro , fg rp , and fg ic defined via Equations ( ) and

val ro ((x 1 , y 1 ), (x 2 , y 2 )) := (x 1 = x 2 ) , val rp ((σ 1 , x 1 , y 1 ), (σ 2 , x 2 , y 2 )) := (σ 1 = σ 2 ∧ x 1 = x 2 ) ∨ (σ 1 = σ 2 ∧ (x 1 = y 2 ∨ x 2 = y 1 )) , val ic ((σ 1 , k 1 , x 1 , y 1 ), (σ 2 , k 2 , x 2 , y 2 )) := (k 1 = k 2 ) ∧ val rp ((σ 1 , x 1 , y 1 ), (σ 2 , x 2 , y 2 )) .
Note that these conditions are publicly checkable. The advantage terms for q-query adversaries D and domain size 2 n are

Adv forget Perm(n) (D) ≤ q 2 /2 n and Adv forget Block(k,n) (D) ≤ q 2 /2 n .
These oracles also split with respect to sp ro , sp rp , and sp ic associated to their respective val above. This is immediate for random oracles (with advantage zero) as the systems (H, H) and (H, H ) are identical as long as the two interfaces are not queried on the same input. Splitting for ideal ciphers, and random permutations where K = ε, is proved easily. Theorem 4.1.2 (Splitting for the ideal cipher). For any adversary A making at most q 1 queries to its first oracle and q 2 queries to its second oracle we have that

Adv split Block(k,n) (A) ≤ q 1 q 2 2 n .
Proof. Consider an adversary A with oracle access to O 1 and O 2 . Algorithm A cannot ask the same query to its two oracles and, it cannot ask to decrypt or encrypt a query to O 1 that has been queried or obtained to O 2 and inversely. A has to distinguish between two systems (E, E) and (E, Ẽ) where E and Ẽ are two independent ideal ciphers. After the attack A ends up with two lists L 1 and L 2 containing, respectively, the q 1 queries made to O 1 and the q 2 queries made to O 2 . The only event that can enable A to trigger sp is an entry (σ

1 , K 1 , x 1 , y 1 ) ∈ L 1 and another (σ 2 , K 2 , x 2 , y 2 ) ∈ L 2 such that (σ 1 = σ 2 ∧ (x 1 = y 2 ∨ x 2 = y 1 )
). The probability of this event is bounded by q 1 q 2 /2 n .

Relation between splitting and switching. Any oracle with forgetful replacement also allows for splitting: start with (O, O), replace both oracles to get ($, $) and now switch the first oracle back to get (O, $). This reduction, however, restricts the class of attacks that can be considered. Indeed in this reduction we would need to rely on fg(L 1 : L 2 ) ∨ fg(L 1 ) which imposes no repeat queries to the first oracle. This oracle is also used by B, and hence we would have to assume that it does not place repeated queries to it. It might appear that this is not a problem as "without loss of generality" such repeat queries can be dealt with using lists. This, however, is not the case as different instances of B often cannot freely communicate with each other their local lists.

KDM Security of the Ideal Cipher

The KDM security for an ideal cipher is formulated as in Figure 4.4 with respect to an oracle O that implements an ideal cipher and an oracle O that implements an indepedent ideal cipher. A trivial construction BC O that simply uses O to encipher and decipher inputs. We formulate a set of sufficient conditions on a KDM set Φ that allows us to establish KDM security for the ideal cipher.

Definition 4.1.1 (Claw-freeness). We define the (single-try) claw-freeness advantage of A against a KDM set Φ as

Adv cf OSp,Φ (A) := Pr[φ O 1 = φ O 2 ∧ φ O 1 (K) = φ O 2 (K) : O ← ← OSp; K ← ←{0, 1} k ; (φ O 1 , φ O 2 ) ← ← A O ] .
We define the (multi-try) claw-freeness advantage Adv mcf OSp,Φ (A) by considering A that return two lists of sizes q 1 and q 2 and claws are checked for two distinct φ's coming from the two lists. A simple guessing argument shows that for any multi-try A there is a single-try A such that:

Adv mcf OSp,Φ (A) ≤ q 1 q 2 • Adv cf OSp,Φ (A ) .
Informally, Φ is claw-free if the above advantage is "small" for every "reasonable" A. When the KDM function are independent of O we may omit sampling of OSp from the game and notation.

The KDM set corresponding to xoring constants into the key:

Φ ⊕ := {φ i [∆] : (K 1 , . . . , K r+1 ) → K i ⊕ ∆ : ∆ ∈ K} ∪ {(K 1 , . . . , K r+1 ) → ∆ : ∆ ∈ K} .
is claw-free since the probability that

K i ⊕ ∆ 1 = K j ⊕ ∆ 2 is 0 if i = j and ∆ 1 = ∆ 2 , and is negligible if i = j.
Query-independence. We define the query-independence advantage of A against a KDM set Φ with respect to oracle space OSp := Block(k, n) as

Adv qi Block(k,n),Φ (A) := Pr φ O 1 (K) ∈ Q + K (φ O 2 (K)) or C ∈ Q - K (φ O 2 (K)) : O ← ← Block(k, n); K ← ←{0, 1} k ; (C, φ O 1 , φ O 2 ) ← ← A O .
Here we have used the convention O(σ, K, M ) := E σ (K, M ). Note that any oracle-free KDM set is query-independent (i.e. has zero query-independence advantage). We now prove that the ideal cipher is KDM secure for claw-free and query-independent KDM sets. Theorem 4.1.3 (Ideal cipher KDM security). Let Φ be a KDM set for keys of length k and messages of length n. Suppose Φ is claw-free and query-independent as defined above. Then the ideal cipher is Φ-KDM-CCA secure. More precisely, for any adversary A against the Φ-KDM-CCA security of the ideal cipher for Block(k, n), there is an adversary C 1 against the claw-freeness of Φ and an adversary C 2 against the query-independence of Φ such that

Adv kdm-cca Block(k,n),Φ (A) ≤ q 1 q/2 n + 2q 2 /2 n + q 1 q/2 k + q 2 (Adv cf Block(k,n),Φ (C 1 ) + 2/2 n )+ + 2q 2 (Adv qi Block(k,n),Φ (C 2 ) + q φ /2 n ) .
Here q 1 is an upper bound on the number of direct queries of A to the ideal cipher (in either direction), q an upper bound on the number of challenge queries (globally), and q φ an upper bound on the number of oracle queries of KDM functions. Adversaries C 1 and C 2 place at most q 1 queries to their ideal cipher oracles.

Proof. Let A be a KDM-CCA adversary. We consider a two-stage adversary (A, B) against the modified split game as follows. Algorithm A runs A and answers its ideal cipher queries using its own ideal-cipher oracle. It answers a KDM query φ of A by forwarding (+, φ) to its B algorithm that is shown in Figure 4.8. It answers a decryption query C of A by forwarding (-, C ) to B. KDM functions are deterministic and stateless and we assume A does not place repeat queries. Hence neither does A. Recall that according to the rules of the KDM game no ciphertext obtained from encryption can be subsequently decrypted. We also assume, without loss of generality, that if a message M is obtained as a result of a ciphertext, then the constant function mapping keys to M cannot be queried to the encryption oracle (since the result is already known). We note that algorithm B is stateless, deterministic and places a single Chal query. It is also simulatable as when Chal implements $ then so does B.

It is easy to see that when Chal implements the original (non-replaced) oracle (i.e., when b = 0 in the m-Split game), algorithms (A, B) runs A in the KDM game with b = 0. When Chal implements a replaced ideal-cipher oracle, algorithms (A, B) run A in the KDM game with b = 1. We emphasize that we are relying on the modified split game here as the split game performs the sp that does not exist in the KDM game. Hence

Algo. B O,Chal (K, (+, φ)) M ← φ O (K) C ← Chal(+, K, M ) Return C Algo. B O,Chal (K, (-, C )) M ← Chal(-, K, C ) Return M
Adv kdm-cca Block(k,n) (A , Φ) ≤ Adv m-split Block[k,n] (A, B) .
Applying Theorem 4.1.1, it remains to bound the probability that B meets the three validity events Sp1, Sp2 and Fg with respect to sp ic (L 1 , L 2 ) and fg ic (L 2 ) based on val ic defined above.

Let us start with the Fg event: it is triggered with z 1 = z 2 . Suppose σ 1 = σ 2 = +. In this case, adaptivity can be ignored since the event does not depend on the output of the B oracle. Hence C must output φ ? 1 = φ ? 2 such that

(+, K, φ O 1 (K)) = (+, K, φ O 2 (K))
This is equivalent to winning claw-freeness for Φ. When σ 1 = σ 2 = -the event cannot be triggered as the ciphertexts must be distinct. Let us consider now σ 1 = + and σ 2 = -. Then C outputs (+, φ 1 ), receives a random value R, and then outputs (-, C 2 ). Let R be the output for the latter. Now it is either that (1) B(+, φ 1 ) queries forward challenge on R , or (2) B(-, C 2 ) queries backward challenge on R. The former takes place with probability 1/2 n as R is chosen after φ 1 . The latter can be triggered when C 2 = R. But this is a disallowed queried by the rules of the KDM game: no encryption output can be decrypted.

Let σ 1 = -and σ 2 = +. Then C outputs (-, C 1 ), receives a random value R, and then outputs (+, φ 2 ). Let R be the output for the latter. Now it is either that (1) B(-, C 1 ) queries backward challenge on R . This happens with probability 1/2 n . Or that (2) B(+, φ 2 ) queries forward challenge on R. This can be triggered in two ways: (2.1) φ 2 is different from the constant function mapping all inputs to R. In this case a claw is found. (2.2) φ 2 is the constant function mapping to R. But we have disallowed such queries.

Let us now look at Sp1. Since queries always include keys, the value x output by C must also include the key. The probability of guessing the key (given possibly a random value R) is at most 1/2 k .

If the KDM functions are oracle-independent, event Sp2 cannot be triggered and the analysis is done. For oracle-dependent KDM Sp2 can be triggered with z 1 and z 2 which correspond to either two forward or one forward and one backward query. (Since backward queries are oracle-independent, Sp2 cannot be triggered using two backward B queries.

) Suppose i = 1. If z 1 = (-, * ) then L 1 = [ ]. So we assume z 1 = (+, φ 1 )
. In what follows L 1 is formed first and then L 2 .

(1) Suppose z 2 := (+, φ 2 ). Then L 2 consists of a single forward entry. (1.1) A forward entry in L 1 with a forward entry in L 2 trigger Sp2. This violates query-independence with a reduction that simply simulates R for C. (1.2) A backward entry in L 1 with a forward entry in L 2 trigger Sp2. (1.2.1) An input in L 1 matches an output in L 2 . Since the output in L 2 is chosen randomly and independently of inputs in L 1 , this happens with a probability of at most q φ /2 n , assuming the KDM functions make at most q φ oracle queries. (1.2.2) An output in L 1 matches an input in L 2 . The outputs in L 1 are random subject to permutativity. Value R seen by C is simply a random value independent of outputs in L 1 . Hence the probability of the single entry in L 2 matching one of the outputs in L 1 is at most q φ /2 n .

(

) 2
:= {φ 1 (K) := K, φ 2 (K) := K ⊕ MSB(K)} is not claw-free as φ 1 (K) = φ 2 (K)
with probability 1/2. KDM security with respect to this set, however, can be proven along the following lines. Instead of simulatability of B O,$ , demand simulation with the help of a claw-detection oracle. This is an oracle that given φ 1 and φ 2 returns (φ 1 (K) = φ 2 (K)). This means that we can modify the validity game to one which allows C access to a claw-detection oracle. For oracle-free KDM functions this condition boils down to unpredictability of the key in the presence of a claw detection oracle. This results in a characterization that is tight, as predicting the key under claws can be easily used to win the KDM game for ideal cipher (since claws can be read off from the outputs of the cipher).

Security of Even-Mansour Ciphers

This Section 4.2 is dedicated to the study of the iterated Even-Mansour ciphers under key-dependent message attacks.

Even-Mansour ciphers. The (iterated) Even-Mansour ciphers consider the problem of constructing a blockcipher with a large key space from a single, or a small number of, permutations. Formally, the r-round Even-Mansour cipher (see Figure 4.9) in a model of computation with r permutations P ± 1 , . . . , P ± r with domain M = {0, 1} n is a blockcipher with key space K = {0, 1} (r+1)n and enciphering and deciphering algorithms

E P 1 ,...,Pr ((K 1 , . . . , K r+1 ), M ) := P r (• • • P 2 (P 1 (M ⊕ K 1 ) ⊕ K 2 ) • • • ) ⊕ K r+1 , D P - 1 ,...,P - r ((K 1 , . . . , K r+1 ), M ) := P - 1 (• • • P - r-1 (P - r (M ⊕ K r+1 ) ⊕ K r ) • • • ) ⊕ K 1 . m K 1 P 1 K 2 P 2 K 3 K r P r K r+1 c Figure 4
.9: The r-round iterated Even-Mansour cipher.

The EM ciphers can be also considered in configurations where (some of the) keys and/or (some of the) permutations are reused in different rounds. We denote the EM cipher where P i and K i+1 are used in round i by EM P 1 ,...,Pr [K 1 , K 2 , . . . , K r+1 ]. The configuration with independent keys K 1 and K 2 achieves security up to approximatively 2 n/2 queries and Dunkelman, Keller and Shamir [START_REF] Orr Dunkelman | Minimalism in cryptography: The Even-Mansour scheme revisited[END_REF] show that the security bound holds when K 0 = K 1 . The r-iterated EM construction has been deeply studied with r + 1 independent keys and the tight security bound of 2 (rn)/(r+1) has been established in [START_REF] Chen | Tight security bounds for key-alternating ciphers[END_REF].

KDM Attacks on Even-Mansour

In this section, we present KDM attacks on the iterated Even-Mansour ciphers. First, 1-round Even-Mansour is not KDM secure under chosen-plaintext attacks for any set Φ containing functions that offset the key, i.e., with respect to φ(K 1 , K 2 ) := K 1 ⊕ ∆. Indeed, enciphering φ(K 1 , K 2 ) gives P(∆) ⊕ K 2 , and hence, key K 2 can be recovered after computing P(∆). Our result in the next section excludes such Φ.

We next consider 2-round EM in different configurations: the two permutations can be set to be identical or independent, and there are five possible key schedules. The simplest possible (and also the most efficient) construction uses a single random permutation and the same n-bit key in the two rounds. In the resulting scheme EM P,P [K, K, K], only one key needs to be securely stored and a unique random permutation has to be implemented.

Unfortunately, this cipher is vulnerable to a sliding attack 5 [BW99] if the set Φ contains the key offset functions.

Indeed, if the function φ(K) := K ⊕ P -1 (0 n ) belongs to Φ, the attacker can simply query its encryption oracle on it to get C 1 = EM P,P [K, K, K](φ(K)) = P(K) ⊕ K. It also obtains the encryption of 0 n as C 2 = EM P,P [K, K, K](0 n ) = P(P(K) ⊕ K) ⊕ K. The attacker can now recover the key as P(C 1 ) ⊕ C 2 . The adversary A P,EM P,P [K,K,K] , formally described in Figure 4.10 (left), can recover the key and this attack can easily be adapted to any number of rounds if all internal permutations are identical and all keys are equal. We note that A P,EM P,P [K,K,K] can trigger the following event and does not respect fg rp for B P,Chal : (σ 1 , x 1 , y 1 ) = (σ 1 , x 1 , y 1 ) with σ 1 = +;

x 1 = P(∆ ⊕ K) ⊕ K; y 1 = P(P(∆ ⊕ K) ⊕ K) ⊕ K.
This attack can be adapted to the key schedule [K 1 , K 2 , K 2 ] as described by the adversary A P,EM P,P [K 1 ,K 2 ,K 2 ] shown in Figure 4.10 (right). The function φ 2 is now different and aims to cancel the key K 1 and replace it by K 2 to bring the setting back to one where a single key is used.

Adversary A P,EM P,P [K,K,K]
Chooses a value ∆

y 1 ← P(-, ∆) φ 1 (K) := y 1 ⊕ K y 2 ← KDMEnc(φ 1 ) φ 2 (K) := ∆ y 2 ← KDMEnc(φ 2 ) y 1 ← P(+, y 2 ) K ← y 1 ⊕ y 2 y ← ∆ ⊕ K y 1 ← P(+, y) If y 2 = y 1 ⊕ K Return 1 b ← ←{0, 1} Return b Adversary A P,EM P,P [K 1 ,K 2 ,K 2 ]
Chooses a value ∆

y 1 ← P(-, ∆) φ 1 (K) := y 1 ⊕ K 1 y 2 ← KDMEnc(φ 1 ) φ 2 (K) := K 1 ⊕ K 2 ⊕ ∆ y 2 ← KDMEnc(φ 2 ) y 1 ← P(+, y 2 ) K 2 ← y 1 ⊕ y 2 y ← ∆ ⊕ K 2 y 1 ← P(+, y) If y 2 = y 1 ⊕ K 2 Return 1 b ← ←{0, 1} Return b Figure 4
.10: Adversaries A P,EM P,P [K,K,K] and A P,EM P,

P [K 1 ,K 2 ,K 2 ] .
We also show that the iterated Even-Mansour construction cannot achieve KDM-CPA security beyond the birthday bound (for any number of rounds r ≥ 2) if the set Φ contains the key offset functions (even if the random permutations and the keys are different). The adversary can simply query the KDMEnc oracle on q 1 ≥ 1 different messages (independent of the key) m 1 , . . . , m q 1 and store the corresponding plaintext/ciphertext pairs (m i , c i ) for i ∈ {1, . . . , q 1 } in some hash table (indexed by the ciphertext values). The adversary can then query the KDMEnc oracle on q 2 ≥ 1 key offset functions φ i (K) = K 1 ⊕ ∆ j with different offsets ∆ j for j ∈ {1, . . . , q 2 }. For each corresponding ciphertext z j = KDMEnc(φ j ), the adversary then looks for it in the hash table. If there exist c i such that z j = c i for i ∈ {1, . . . , q 1 }, then, since EM is a permutation, the adversary knows that m i = ∆ j ⊕ K 1 and can retrieve K 1 as m i ⊕ ∆ j . If q 1 • q 2 2 n then, with high probability, the adversary will find such a collision and therefore the first round key. The complexity to find the first round key is thus O(2 n/2 ) queries to KDMEnc to find the first key and the attack can be repeated to find the other keys. The overall complexity to recover the full secret key is thus O((r -1) • 2 n/2 ) queries to KDMEnc (since the two keys of the last round can be easily obtained as described above).

KDM Security of Even-Mansour Ciphers

In the following, three configurations of Even-Mansour cipher are analysed:

EM P [K 1 , K 2 ], EM P 1 ,P 2 [K 1 , K 2 , K 3 ] and EM P,P [K 1 , K 2 , K 3 ].

One-round Even-Mansour

We study the KDM security of the basic Even-Mansour cipher with only a single round. We show that this construction achieves nontrivial forms of KDM security. Definition 4.2.1 (Offset-Freeness). We define the offset-freeness advantage of A against a KDM set Φ consisting of functions φ : {0, 1} rn -→ M as

Adv offset Φ (A) := Pr[φ(K 1 , ., K r ) = K i ⊕ X : i ∈ {1, ., r}; (K 1 , ., K r ) ← ←{0, 1} rn ; (φ, X) ← ← A] .
Our next result shows that one-round EM is KDM-secure against oracle-free claw-free and offset-free KDM sets. Note that xor-ing with constants is not offset-free. Theorem 4.2.1. Let Φ be an oracle-free KDM set mapping 2n-bit keys to n-bit messages. Suppose Φ is offset-free and claw-free. Then EM P [K 1 , K 2 ] is Φ-KDM-CCA secure. More precisely, for any adversary A against the Φ-KDM-CCA security of EM P [K 1 , K 2 ], there are adversaries C 1 and C 2 against the offset-free and claw-free properties of Φ such that

Adv kdm-cca EM P [K 1 ,K 2 ],Φ (A) ≤ q 1 q/2 n +2q 2 /2 n +q 1 q(2•Adv offset Φ (C 1 )+4/2 n )+q 2 (2•Adv cf Φ (C 2 )+2/2 n ) ,
where q 1 is the number of queries of A to P ± and q is the number of challenge queries of A in either direction.

Proof. The proof structure is analogous to that for the KDM security of the ideal cipher. For A a KDM-CCA adversary, we consider a two-stage adversary (A, B) against the modified split game as follows. Algorithm A will run A as before forwarding its queries to algorithm B shown in Figure 4.11: the oracle O implements the random permutations (P ± ) and the oracle O implements the random permutation (P' ± ) where P, P' are independent. We assume A does not place repeat queries, respects the rules of the KDM game, and if it obtains a message M as a result of decrypting a ciphertext C , it does not query the constant function mapping to M to encryption. Note that algorithm B is stateless, deterministic, simulatable, and places a single Chal query. This leads to the first two terms in the advantage upper bound.

Since we are only considering oracle-independent KDM functions, we do not need to consider event Sp2. We consider Sp1 next. This event corresponds to finding a collision between a direct query of A and a challenge query of B. The adversary can trigger this event in a number of ways as follows.

(1) Two forward queries (X, φ) are such that φ(K 1 , K 2 ) ⊕ K 1 = X. This violates offsetfreeness. Note that the order of the queries and their adaptivity do not matter as the winning condition is independent of the oracle output.

Algo. B O,Chal (K, (+, φ))

(K 1 , K 2 ) ← K X ← φ(K 1 , K 2 ) ⊕ K 1 Y ← Chal(+, X) C ← Y ⊕ K 2 Return C Algo. B O,Chal (K, (-, C )) (K 1 , K 2 ) ← K Y ← C ⊕ K 2 X ← Chal(-, Y ) M ← X ⊕ K 1 Return M Figure 4
.11: Algorithm B used in the KDM analysis of one-round EM.

(2) Two backward queries (X, C ) are such that C ⊕ K 2 = X. This amounts to guessing K 2 , which happens with probability at most 1/2 n .

(3) A forward X and a backward C are such that: (3.1) X = R ⊕ K 1 for a possibly known R (the output of B). This amounts to guessing K 1 , which happens with probability at most 1/2 n . (3.2) C ⊕ K 2 = P(X). This amounts to guessing K 2 , which happens with probability at most 1/2 n .

(4) A backward X and a forward φ are such that: (4.1) X = R ⊕ K 2 for a possibly known R. This amounts to guessing K 2 , which happens with probability at most 1/2 n . (4.2)

φ(K 1 , K 2 ) ⊕ K 1 = P -(X)
. This violates offset-freeness.

The third term in the advantage bound in the statement of the theorem follows from a union bound.

We now consider the Fg event, which corresponding to finding two collisions between two distinct challenge queries of B. The adversary can trigger this event in a number of ways.

(1) Two forward queries are such that φ 1 = φ 2 and φ

1 (K 1 , K 2 ) ⊕ K 1 = φ 2 (K 1 , K 2 ) ⊕ K 1 .
This violates claw-freeness.

(2) Two backward queries are such that

C 1 ⊕ K 2 = C 2 ⊕ K 2 and C 1 = C 2 .
This is not possible.

(3) A forward φ and a backward C such that C is chosen first and:

(3.1) φ(K 1 , K 2 ) ⊕ K 1 = R ⊕ K 1 where φ can possibly depend on R. If φ(K 1 , K 2 )
is the constant function mapping to R, this query is not allowed by our restriction above. Otherwise, a claw with constant function mapping to R is found.

(3.2) C ⊕ K 2 = R ⊕ K 2 .
Since R is randomly and independently chosen, this happens with probability 1/2 n .

(4) A forward φ and a backward C such that φ is chosen first and: (4.1)

C ⊕ K 2 = R ⊕ K 2 .
Here C can possibly depend on R. This violates the KDM rule that output ciphertexts (R here) are not subsequently decrypted. (4.2)

φ(K 1 , K 2 ) ⊕ K 1 = R ⊕ K 1 .
Since R is randomly and independently chosen, this happens with probability 1/2 n .

The fourth term in the advantage bound follows from a union bound.

Two-round Even-Mansour with independent permutations

As mentioned above, offset-freeness excludes the case of KDM security against key offsets. We ask if by addition of extra rounds to the Even-Mansour ciphers can boost KDM-CCA security against this class. In this section, we show the addition of a single extra round with independent permutations is sufficient for this. (In the next subsection, we will consider using a single permutation.) We consider an oracle O that allows access to two permutations via O(i, σ, x) := P σ i (x). This is simply an ideal cipher oracle with two key values i = 1, 2. Hence splitting and forgetting apply to this oracle. Our proof strategy is as before, but to avoid offset-freeness we only replace the last permutation in forward queries and the first permutation in backward queries. The oracle O implements the random permutations (P ± 1 , P ± 2 ) and the oracle O implements the random permutations (P + 1 , P 1 ' -, P 2 ' + , P - 2 ) where P 1 , P 1 ', P 2 , P 2 ' are independent. These will be sufficient to ensure that the outputs in both directions are randomized. Theorem 4.2.2. Let Φ be a KDM set that is claw-free. Then

EM P 1 ,P 2 [K 1 , K 2 , K 3 ] is Φ- KDM-CCA secure. More precisely, for any adversary A against the Φ-KDM-CCA security of EM P 1 ,P 2 [K 1 , K 2 , K 3 ],
there is an adversary C against the claw-free property of Φ such that

Adv kdm-cca EM P 1 ,P 2 [K 1 ,K 2 ,K 3 ],Φ (A) ≤ 16q 1 q/2 n + 2q 2 • (Adv cf Φ (C) + 1/2 n ) ,
where q 1 is the number of queries of A to P ± i (globally) and q is the number of challenge queries of A in either direction.

Proof. The proof structure is analogous to the previous cases and we describe the associated algorithm B in Figure 4.12. It is easy to verify that this algorithm responds with KDM queries under EM P 1 ,P 2 [K 1 , K 2 , K 3 ] and φ and satisfies the requirements of statelessness, determinism, etc. as before. We emphasize that this algorithm does not make use of queries of the form Chal(1, +, •) or Chal(2, -, •). This means that queries to O(1, +, X 1 ) (i.e., those to P 1 ) and queries to O(2, -, X 1 ) (i.e., those to P - 2 ) can be arbitrary and without any restrictions.

Algo. B O,Chal (K, (+, φ))

(K 1 , K 2 , K 3 ) ← K X 1 ← φ(K 1 , K 2 , K 3 ) ⊕ K 1 X 2 ← O(1, +, X 1 ) X 3 ← Chal(2, +, X 2 ⊕ K 2 ) C ← X 3 ⊕ K 3 Return C Algo. B O,Chal (K, (-, C )) (K 1 , K 2 , K 3 ) ← K X 3 ← C ⊕ K 3 X 2 ← O(2, -, X 3 ) X 1 ← Chal(1, -, X 2 ⊕ K 2 ) M ← X 1 ⊕ K 1 Return M Figure 4
.12: Algorithm B used in the KDM analysis of two-round EM with two permutations.

We start with Sp1. This event can be triggered in one of the following ways corresponding to the choice of an input to an internally replaced oracle and a direct oracle query.

(1) Forward inputs φ and X such that P 1 (φ(K) ⊕ K 1 ) ⊕ K 2 = X. We argue that the probability of this event is upper-bounded by 2q 1 q/2 n . There are two cases to be considered: (1.1a) The value φ(K) ⊕ K 1 has been queried to P 1 . But, this means the adversary can use P 1 (φ(K) ⊕ K 1 ) and X to compute K 2 . For each φ and all q 1 choices of X the probability is q 1 /2 n and thus q 1 q/2 n over all φ. (1.1b) The value φ(K) ⊕ K 1 has not been queried to P 1 and P 1 (φ(K) ⊕ K 1 ) is randomly chosen outside the view of the adversary over a set of size at least (2 n -q 1 ). Hence this case happens with a probability of at most 1/(2 n -q 1 ) which is ≤ 2/2 n for q 1 ≤ 2 n /2. We thus get an overall probability of 2q 1 q/2 n . We will use this line of argument below and other proofs later on. (1.2) For a known random R, P 2 (X) = R ⊕ K 3 . This amounts to guessing K 3 with probability q 1 q/2 n over all φ and X.

(2) Backward inputs C and X such that: (2.1) P - 2 (C 2 ⊕ K 3 ) ⊕ K 2 = X. This amounts to guessing K 2 with probability 2q 1 q/2 n . (2.2) R ⊕ K 1 = P - 1 (X) for a known value R. This amounts to guessing K 1 with probability q 1 q/2 n over all C and X.

(3) Forward φ and backward X such that for a known random R: (3.1) R ⊕ K 3 = X. This amounts to guessing K 3 with probability q 1 q/2 n . (3.2) P 1 (φ(K) ⊕ K 1 ) ⊕ K 2 = P - 2 (X). This amounts to guessing K 2 with probability 2q 1 q/2 n .

(4) Backward C and forward X such that for a known random R:

(4.1) R ⊕ K 1 =
X. This amounts to guessing K 1 with probability q 1 q/2 n over all C and X. (4.2)

P - 2 (C 2 ⊕ K 3 ) ⊕ K 2 = P 1 (X)
. This amounts to guessing K 2 with probability 2q 1 q/2 n .

We now look at event Fg. This event can be triggered in the following ways.

(1) Forward inputs

φ 1 = φ 2 such that P 1 (φ 1 (K) ⊕ K 1 ) ⊕ K 2 = P 1 (φ 2 (K) ⊕ K 1 ) ⊕ K 2 .
This violates claw-freeness.

(2) Backward inputs

C 1 = C 2 such that C 1 ⊕ K 3 = C 2 ⊕ K 3 . This is impossible.
Note that only P 2 in the forward direction and P - 1 in the backward direction are replaced. Hence these are all the collisions that need to be taken care of. The second term in the advantage bound follows.

Since B uses O, we also need to consider Sp2. This event can be triggered in the following ways.

(1) Inputs φ 1 and C 2 such that φ 1 is chosen after seeing a random R and: (1.1) φ 1 (K)⊕K 1 = R⊕K 1 . This is either a repeat query (when φ 1 is constant) or breaks claw-freeness. (1.2)

P 1 (φ 1 (K) ⊕ K 1 ) = P - 2 (C 2 ⊕ K 3 ) ⊕ K 2 .
This amounts to guessing K 2 with probability 2q 1 q/2 n .

(2) Inputs φ 1 and C 2 such that C 2 is chosen after seeing random R and: (2.1)

P 1 (φ 1 (K) ⊕ K 1 ) ⊕ K 2 = P - 2 (C 2 ⊕ K 3 )
. This amounts to guessing K 2 with probability 2q 1 q/2 n . (2.2)

C 2 ⊕ K 3 = R ⊕ K 3 .
This event violates the KDM rule that an output ciphertext is not decrypted.

This concludes the proof of theorem.

Two-round Even-Mansour with a single permutation

We now consider KDM security of two-round EM with permutation reuse.

Definition 4.2.2 (Offset-xor-freeness). We define the offset-xor-freeness advantage of A against a KDM set Φ consisting of functions

φ : {0, 1} rn -→ M as Adv ox Φ (A) := Pr[φ(K 1 , ., K r ) = K i ⊕ K j ⊕ X : (i, j) ∈ {1, ., r} 2 ; i = j; (K 1 , ., K r ) ← ←{0, 1} rn ; (φ, X) ← ← A]
Offset-xor-freeness and claw-freeness are sufficient for the KDM security of two-round EM with a single permutation.

Theorem 4.2.3. Let Φ be a KDM set that is claw-free and offset-xor-free.

The EM P,P [K 1 , K 2 , K 3 ] (with a single permutation) is Φ-KDM-CCA secure. More precisely, for any adversary A against the Φ-KDM-CCA security of EM P,P [K 1 , K 2 , K 3 ], there is an adversary C 1 against the claw-free property of Φ and an adversary C 2 against the offset-xor-free property of Φ such that

Adv kdm-cca EM P,P [K 1 ,K 2 ,K 3 ],Φ (A) ≤ 9q 1 q/2 n + q 2 (2 • Adv cf Φ (C 1 ) + Adv ox Φ (C 2 ) + 9/2 n ) ,
where q 1 is the number of queries of A to P ± and q is the number of challenge queries of A in either direction.

Proof. The proof structure is analogous to that previous case, and we only present the associated algorithm B in Figure 4.13 below.

Algo. B O,Chal (K, (+, φ))

(K 1 , K 2 , K 3 ) ← K X 1 ← φ(K 1 , K 2 ) ⊕ K 1 X 2 ← O(+, X 1 ) X 3 ← Chal(+, X 2 ⊕ K 2 ) C ← X 3 ⊕ K 3 Return C Algo. B O,Chal (K, (-, zC )) (K 1 , K 2 , K 3 ) ← K X 3 ← C ⊕ K 3 X 2 ← O(-, X 3 ) X 1 ← Chal(-, X 2 ⊕ K 2 ) M ← X 1 ⊕ K 1 Return M Figure 4
.13: Algorithm B used in the KDM analysis of two-round EM with a single permutation.

The oracle O implements (P ± ) and O implements (P ± , P' ± ). The adversary can trigger Sp1 in a number of ways as described below.

(1) Two forward queries (φ, X) are such that P(φ 1 (K) ⊕ K 1 ) ⊕ K 2 = X. This amounts to guessing K 2 with probability 2q 1 q/2 n (Recall that in the 1-round construction, we used offset-freeness at this stage.)

(2) Two backward queries (C , X) are such that P -(C ⊕K 3 )⊕K 2 = X. Again, this amounts to guessing K 2 with probability 2q 1 q/2 n .

(3) A backward query C and a forward direct query X are such that: (3.1)

P -(C ⊕ K 3 ) ⊕ K 2 = P(X)
. This amounts to guessing K 2 with probability 2q 1 q/2 n . (3.2) For some random and known R we have R ⊕ K 1 = X. This amounts to guessing K 1 .

(4) A forward query φ and a backward direct query X are such that: (4.1)

P(φ(K) ⊕ K 1 ) ⊕ K 2 = P -(X)
. This amounts to guessing K 2 with probability 2q 1 q/2 n . (4.2) R ⊕ K 3 = X. This reduces to guessing K 3 .

The adversary can trigger Fg in one of the ways described below.

(1) Two forward queries φ 1 = φ 2 are such that P(φ

1 (K) ⊕ K 1 ) ⊕ K 2 = P(φ 2 (K) ⊕ K 1 ) ⊕ K 2 .
This violates claw-freeness.

(2) Two backward queries

C 1 = C 2 are such that P -(C 1 ⊕ K 3 ) ⊕ K 2 = P -(C 2 ⊕ K 3 ) ⊕ K 2 .
This is not possible.

(3) A forward φ and a backward C are such that C is chosen second and: (3.1)

P(φ(K) ⊕ K 1 ) ⊕ K 2 = R ⊕ K 1 .
Here R is a random value chosen after φ corresponding to the output of B on C . This happens with probability 1/2 n . (3.2)

P -(C ⊕K 3 )⊕K 2 = R⊕K 1 .
Here R is a random value corresponding to the output of B on φ. Here C can depend on R. This happens with probability 1/2 n : Even if K 3 is known, this event amounts to guessing K 1 ⊕ K 2 . This event happens with probability 2q 2 /2 n . (Note that here we rely on round keys being different.) (4) A forward φ and a backward C are such that φ is chosen second and: (4.1)

P(φ(K) ⊕ K 1 ) ⊕ K 2 = R ⊕ K 1 .
Here φ can depend on R. This happens with probability 1/2 n : Even if we allow the value P(φ(K)⊕K 1 ) to be chosen, this amounts to guessing

K 1 ⊕K 2 . (4.2) P -(C ⊕ K 3 ) ⊕ K 2 = R ⊕ K 1 .
Here R is chosen after C . This happens with probability 2q 2 /2 n .

We also need to analyse event Sp2 here as B depends on the oracle. This event can be triggered as a result of a collision between two queries to B one of which is to the oracle and the other to the challenge. This can happen in one of the following ways.

(1) Inputs φ 1 and φ 2 such that:

φ 1 (K) ⊕ K 1 = P(φ 2 (K) ⊕ K 1 ) ⊕ K 2 .
If the input to the permutation cannot be guessed, this happens with low probability. Else it violates xor-offset-freeness.

(2) Inputs C 1 and C 2 such that:

C 1 ⊕ K 3 = P -(C 2 ⊕ K 3 ) ⊕ K 2 .
Even given K 3 , this amounts to guessing K 2 .

(3) Inputs φ 1 and C 2 such that: (3.1)

φ 1 (K) ⊕ K 1 = R ⊕ K 1 .
If R is chosen after φ 1 this happens with probability 1/2 n . Else, a constant φ 1 is not allowed, and a non-constant φ 1 violates claw-freeness with the constant function mapping to R.

(3.2) C 2 ⊕K 3 = R ⊕K 3 .
This violates the rules of the KDM game for a C 2 chosen after R and otherwise happens with probability 1/2 n . (3.3) P(φ

1 (K) ⊕ K 1 ) = P -(C 2 ⊕ K 3 ) ⊕ K 2 .
Even given K 3 , this amounts to guessing K 2 . This happens with probability 2q 2 /2 n .

Remark 4.2.1 (Comments on Adversaries)

. The adversary A P,EM P,P [K,K,K] described in Figure 4.10 triggers the following event that does not respect fg rp for B P,Chal : (

σ 1 , x 1 , y 1 ) = (σ 1 , x 1 , y 1 ) with σ 1 = +, x 1 = P(∆ ⊕ K) ⊕ K, y 1 = P(P(∆ ⊕ K) ⊕ K) ⊕ K.
Similarly, the adversary against the scheme EM P,P [K 1 , K

, P r[X A,w 1 = τ ] Pr[X A,w 0 = τ ] ≥ 1 -ε good , then Adv w 0 ,w 1 (A) ≤ ε good + ε bad .
The proof of this lemma is standard [CLL + 14]. The adversary output is a deterministic function of the transcript; its distinguishing advantage is upper bounded by the statistical distance between X A,w 0 and X A,w 1 .

For a given transcript Q F and a function

F denoted F Q F , we say that F extends Q F , if v = F(u) for all (u, v) ∈ Q F .

KDM Security with a Generic Lemma

Consider a blockcipher BC O := (K, E O , D O ) with key space K and message space M based on some ideal primitive O sampled from some oracle space OSp. We formalize the security under key-dependent message and chosen-ciphertext attacks (KDM-CCA) as a distinguishing game between two worlds that we call the real and ideal worlds. Given a KDM set Φ, the adversary A has access to a KDM encryption oracle KDMEnc, which takes as input a function φ ∈ Φ and returns a ciphertext y ∈ M, a decryption oracle Dec which takes as input a ciphertext y ∈ M and returns a plaintext x ∈ M, and oracle O. We do not allow the adversary to ask for decryption of key-dependent ciphertexts as we are not aware of any use cases where such an oracle is available. In the real world, a key K is drawn uniformly at random from K and KDMEnc(φ) returns E O (K, φ(K)) while Dec(y) returns D O (K, y). The ideal world is similar to the real world except that E(K, •) and D(K, •) are replaced by a random permutation P and its inverse. To exclude trivial attacks, we do not allow decryption of ciphertexts that were obtained from the encryption oracle more precisely, such queries are answered with ⊥ in both worlds), as otherwise the key can be recovered by decrypting the encryption of K. The real and ideal world are formally defined in Figure 4.14 (ignore the additional world pw for now). The KDM-CCA advantage of an adversary A against BC with respect to Φ is defined as

Adv kdm-cca BC O (A, Φ) := Adv rw,iw (A).

A Generic Lemma

In order to allow a convenient application of the H-coefficients technique when proving the KDM security of a block cipher BC O , we introduce an intermediate world, called the perfect world (pw), defined in Figure 4.14. Note that this world does not involve any key. The encryption and decryption oracles lazily sample two independent random permutations stored respectively in tables T enc and T dec , except that consistency is ensured for constant functions φ ∈ Φ M : when a decryption query Dec(y) is made with y / ∈ Dom(T dec ), a plaintext x is real world rw

O ← ← OSp K ← ← K L ← [] oracle KDMEnc(φ) if φ / ∈ Φ then return ⊥ x ← φ(K) L ← L : {E O (K, x)} return E O (K, x)
oracle Dec(y)

if y ∈ L then return ⊥ else return D O (K, y) oracle O(x) return O(x) ideal world iw O ← ← OSp K ← ← K; P ← ← Perm(M) L ← [] oracle KDMEnc(φ) if φ / ∈ Φ then return ⊥ x ← φ(K) L ← L : {P(x)} return P(x)
oracle Dec(y)

if y ∈ L then return ⊥ else return P -1 (y) oracle O(x) return O(x) perfect world pw O ← ← OSp Tenc ← []; T dec ← [] oracle KDMEnc(φ) if φ / ∈ Φ then return ⊥ if φ / ∈ Dom(Tenc) then Tenc(φ) ← ← M \ Rng(Tenc) return Tenc(φ)
oracle Dec(y) The following lemma upper-bounds the distinguishing advantage between the ideal and the perfect worlds. It does not depend on the blockcipher at hand (neither the ideal nor the perfect world depends on it) nor on the oracle O (since neither in the ideal nor in the perfect world the encryption/decryption oracle depends on it). For specific block ciphers, it will allow focussing on the distinguishing advantage between the perfect and the real worlds, since by the triangle inequality,

if y ∈ Rng(Tenc) then return ⊥ if y / ∈ Dom(T dec ) then x ← ← M \ Rng(T dec ) T dec (y) ← x Tenc(φ : K → x) ← y return T dec (y) oracle O(x) return O(x)
Adv iw,rw (A) ≤ Adv iw,pw (A) + Adv pw,rw (A). ( 4.1)
Lemma 4.3.2. Let Φ be a KDM set for key space K and message space M. Let A be an adversary making at most q queries to KDMEnc or Dec. Then

Adv iw,pw (A) ≤ q 2 • cf(Φ) + q 2 #M -q .
Proof. We apply the H-coefficients technique with w 0 = pw and w 1 = iw. Fix a distinguisher A making at most q encryption or decryption queries. We assume without loss of generality that

• the adversary never repeats a query;

• the adversary never queries φ : K → x to KDMEnc if it has received x as an answer to some query Dec(y) before (since in both worlds such a query would be answered with y); • the adversary never queries y to Dec if it has received y as an answer to some query KDMEnc(φ) before (since in both worlds such a query would be answered with ⊥).

We will refer to this as the no-pointless-query assumption.

We record the queries of the adversary to oracles KDMEnc or Dec in a list Q BC : it contains all tuples (+, φ, y) such that A queried KDMEnc(φ) and received answer y, and all tuples (-, x, y) such that A queried Dec(y) and received answer x. The queries of the adversary to oracle O are recorded in a list Q O . After the adversary has finished querying the oracles, we reveal the key K in case the adversary interacts with the ideal world, while in the perfect world we reveal a uniformly random key independent of the oracle's answers. Hence, a transcript is a triple (Q BC , Q O , K). Let T be the set of attainable transcripts for A and pw. An attainable transcript τ = (Q BC , Q O , K) is said to be bad iff one of the following conditions holds.

(C-1) there exist (+, φ, y) = (+, φ , y

) ∈ Q BC such that (a) φ(K) = φ (K) or (b) y = y ; (C-2) there exist (+, φ, y), (-, x, y ) ∈ Q BC such that (a) φ(K) = x or (b) y = y ; (C-3) there exist (-x, y) = (-, x , y ) ∈ Q BC such that (a) x = x or (b) y = y .
Let T bad denote the set of bad transcripts and let T good := T \ T bad . We first upper bound the probability to get a bad transcript in the perfect world.

Claim 1. Pr

[X A,pw ∈ T bad ] ≤ q 2 • cf(Φ) + q 2 |M|-q .
Proof. We consider the probability of each condition in turn. Recall that in the perfect world, the key K is drawn at random independently from the oracle answers.

(C-1) Fix two queries (+, φ, y) = (+, φ , y ) ∈ Q BC . (a) By Definition 4.3.1, φ(K) = φ (K) with a probability of at most cf(Φ) over the choice of K. (b) By the no-pointless-queries assumption, φ = φ and hence necessarily y = y . By summing over all possible pairs, (C-1) happens with a probability of at most q 2 /2 • cf(Φ).

(C-2) Fix two queries (+, φ, y), (-, x, y ) ∈ Q BC .

(a) If query (+, φ, y) came first, then x is uniformly random in a set of size at least #M -q and independent of φ(K), and hence φ(K) = x with a probability of at most 1/(#M -q). If query (-, x, y ) came first, then by the no-pointless-query assumption, φ = (K → x), so that φ(K) = x with a probability of at most cf(Φ) (since it constitutes a claw with the constant function). All in all, φ(K) = x with a probability of at most 1/(#M -q) + cf(Φ). (b) If query (+, φ, y) came first, then, by the no-pointless-query assumption, y = y.

If query (-, x, y ) came first, then y is uniformly random in a set of size at least |M| -q and independent of y , hence y = y with a probability of at most 1/(#M -q). By summing over all possible pairs of queries, (C-2) happens with a probability of at most q 2 /2 • (2/(#M -q) + cf(Φ)).

(C-3) Fix two queries (-, x, y) = (-, x , y ) ∈ Q BC . Then, by the no-pointless-queries assumption, y = y and hence x = x , so that condition (C-3) cannot hold.

The result follows by the union bound.

Claim 2. Fix a good transcript τ = (Q BC , Q O , K). Then Pr[X A,iw = τ ] Pr[X A,pw = τ ] ≥ 1 .
Proof. Let q enc , resp. q dec denote the number of queries to KDMEnc, resp. Dec in Q BC , with q enc +q dec = q. In the perfect world, queries to KDMEnc and Dec are answered by lazily sampling two independent injections I enc : [q enc ] → M and I dec : [q dec ] → M (this follows from the no-pointless-queries assumption which implies that for any query KDMEnc(φ) we have φ / ∈ Dom(T enc ) and for any query Dec(y) we have y / ∈ Dom(T dec )). Hence, letting Q enc and Q dec respectively denote the set of encryption and decryption queries in

Q BC we have Pr[X A,pw = τ ] = Pr K ← ← K [K = K] • Pr O ← ← OSp [O Q O ] • Pr Ienc [I enc Q enc ] • Pr I dec [I dec Q dec ] = Pr K ← ← K [K = K] • Pr O ← ← OSp [O Q O ] • 1 (#M) qenc • (#M) q dec .
We now compute the probability of obtaining τ in the ideal world. Consider the modified transcript Q BC containing pairs (x, y) ∈ M 2 constructed from Q BC as follows. For each triplet (+, φ, y) ∈ Q BC , append (φ(k), y) to Q BC and for each (-, x, y) ∈ Q BC , append (x, y) to Q BC . Then, for any (x, y) = (x , y ) ∈ Q BC , we have x = x (as otherwise condition (C-1a), (C-2a), or (C-3a) would be met) and y = y (as otherwise condition (C-1b), (C-2b), or (C-3b) would be met). Hence,

Pr[X A,iw = τ ] = Pr K ← ← K [K = K] • Pr O ← ← OSp [O Q O ] • Pr P ← ← Perm(M) [P Q BC ] = Pr K ← ← K [K = K] • Pr O ← ← OSp [O Q O ] • 1 (#M) q . Thus, Pr[X A,iw = τ ] Pr[X A,pw = τ ] = (#M) qenc • (#M) q dec (#M) q ≥ 1 ,
where the inequality follows from q enc + q dec = q.

Lemma 4.3.2 follows by combining the two claims with Lemma 4.3.1.

Security of Key-Alternating Feistel Ciphers

Key-Alternating Feistel (KAF). For a given public function F ∈ F * ({0, 1} n , {0, 1} n ) and a key K ∈ {0, 1} n , the one-round KAF is the permutation KAF F K ∈ P * ({0, 1} 2n ) defined as:

KAF F [K](LR) = R||F(K ⊕ R) ⊕ L.
The value L and R are respectively the left and right halves n-bits of the input. And, the left and right halves n-bits of the output are usually denoted S and T such that S = R and T = F(K ⊕ R) ⊕ L. The r-rounds version of KAF is specified by r public functions F 1 , F 2 , . . . , F r and r keys K 1 , K 2 , . . . , K r such that:

KAF F 1 ,F 2 ,...,Fr [K 1 , K 2 , . . . , K r ](LR) = P Fr Kr • • • • • P F 1 K 1 (LR).
Usually, the round keys K 1 , K 2 , . . . , K r are written as a key vector

K = (K 1 , K 2 , . . . , K r ). L F 1 K 1 R F 2 K 2 F i K i F r K r S T

KDM Security of Four-Round Key-Alternating Feistel

In this section, we study the 4-round KAF cipher with a single round function

F : {0, 1} n → {0, 1} n and key K = (K 1 , K 2 , K 3 , K 4 ) ∈ ({0, 1} n ) 4
where K 1 and K 4 are uniformly random (our results do not rely on any assumption about the distribution of K 2 and K 3 , which could be both set to 0). Given a KDM function φ with range {0, 1} 2n , we let φ L and φ R to respectively denote the functions that returns the n leftmost and the n rightmost bits of φ. Given a KDM set Φ for message space M = {0, 1} 2n , we define Φ L := {φ L : φ ∈ Φ} and Φ R := {φ R : φ ∈ Φ}.

The theorem below states that the 4-round KAF with the same round function and uniformly random round keys K 1 and K 4 is KDM-CCA secure if the set Φ of key-dependent functions has negligible claw-freeness (cf. Definition 4.3.1) and Φ R has negligible partial offset-freeness and partial offset-xor-freeness (cf. Definition 4.3.2 and Definition 4.3.3). Theorem 4.4.1. Let KAF F be the 4-round key-alternating Feistel cipher based on a single round function F : {0, 1} n → {0, 1} n where the key K = (K 1 , K 2 , K 3 , K 4 ) is such that K 1 and K 4 are uniformly random. Let A be an adversary making at most q ≤ 2 n queries to KDMEnc or Dec and q f queries to F, which is modeled as a random oracle. Then,

Adv kdm-cca KAF F (A, Φ) ≤ q 2 (2 • cf(Φ) + 3/2 • oxf(Φ R ) + 22/2 n ) + qq f (of(Φ R ) + 7/2 n ) .
Proof. Fix an adversary A which must distinguish the real and ideal worlds defined Figure 4.14 where O = F and BC = KAF F , and assume that A makes at most q ≤ 2 n queries to KDMEnc or Dec and q f queries to F. By Equation 4.1 and Lemma 4.3.2, we have

Adv kdm-cca KAF F (A, Φ) ≤ q 2 • cf(Φ) + q 2 /(#M -q) + Adv pw,rw (A) ≤ q 2 • cf(Φ) + q 2 /2 n + Adv pw,rw (A) ,
where we used that #M = 2 2n and 1/(2 2n -q) ≤ 1/2 n . Hence, it remains to upper bound Adv pw,rw (A). We prove below that

Adv pw,rw (A) ≤ q 2 (cf(Φ) + 3/2 • oxf(Φ R ) + 21/2 n ) + qq f (of(Φ R ) + 7/2 n ) , (4.2)
from which the result follows.

The remainder of this session is devoted to the proof of Equation 4.2. Without loss of generality, we make the same no-pointless query assumption that was made in the proof of Lemma 4.3.2. Our proof will use the H-coefficient technique.

A transcript τ is a tuple (Q BC , Q F , K), where Q BC is the list of forward queries (+, φ, ST ) to KDMEnc with φ ∈ Φ and LR ∈ ({0, 1} n ) 2 and ST the answer returned by KDMEnc when called on φ together will all backward queries (-, L R , S T ) to Dec with L R, S T ∈ ({0, 1} n ) 2 and L R the answer of Dec when called on input S T . List Q F contains queries (u, v) ∈ ({0, 1} n ) 2 to the public function F, where v is the answer of the oracle F when called on input u. The key K is only revealed to the adversary after it has finished its queries, and is drawn independently from the oracle answers in the perfect world.

Sketch of proof.

We first give the definition of a bad transcript in Definition 4.4.1 which is a transcript that enables to distinguish the perfect world easily from the real world. A bad transcript is defined according to conditions "C-i": these conditions correspond to possible collisions between the inputs of the first and the last functions of the KAF construction in the transcript Q BC and the input of the public function F in the transcript Q F . These inputs are represented in red in the left part of Figure 4.16. The adversary is able to check the presence of these collisions because the vector key is given in the transcript τ . The probability that A produces a bad transcript in the perfect world is upper-bounded in Lemma 4.4.1 and to make this probability low, note that the KDM set has to be offset-free, offset-xor-free and unsurprisingly claw-free. Then, conditioning in the fact that the transcript is good (condition C-i do not happen), the probability of picking a function F that leaks information is low (upper bounded in Lemma 4.4.4). Conditions "C'-i", as defined in ??, correspond to collisions that can happen between the inputs w i , z i and other inputs of F (inputs of the second and the third internal functions as shown in the left part of Figure 4.16) in case τ is a good transcript.

L F K 1 R F K 2 F K 3 F K 4 S T u v F L F K 1 R F w i K 2 z i F K 3 F K 4 S T u v F
Definition 4.4.1. A transcript τ = (Q BC , Q F , K)with K = (K 1 , K 2 , K 3 , K 4 )
in the perfect world is said to be bad iff one of the following conditions holds.

(C-1) there exist (+, φ, ST

) ∈ Q BC and (u, v) ∈ Q F such that (a) φ R (K) ⊕ K 1 = u or (b) S ⊕ K 4 = u; (C-2) there exist (-, LR, ST ) ∈ Q BC and (u, v) ∈ Q F such that (a) R ⊕ K 1 = u or (b) S ⊕ K 4 = u; (C-3) there exist (+, φ, ST ) = (+, φ , S T ) ∈ Q BC such that (a) φ(K) = φ (K) or (b) S = S ; (C-4) there exist (+, φ, ST ), (+, φ , S T ) ∈ Q BC (not necessarily distinct) such that φ R (K) ⊕ K 1 = S ⊕ K 4 ; (C-5) there exist (-, LR, ST ) = (-, L R , S T ) ∈ Q BC such that R = R ; (C-6) there exist (-, LR, ST ), (-, L R , S T ) ∈ Q BC (not necessarily distinct) such that R ⊕ K 1 = S ⊕ K 4 ; (C-7) there exist (+, φ, ST ), (-, L R , S T ) ∈ Q BC such that (a) φ(K) = L R or (b) ST = S T or (c) φ R (K) ⊕ K 1 = S ⊕ K 4 or (d) S ⊕ K 4 = R ⊕ K 1 .
Let T bad denote the set of bad transcripts and let T good := T \ T bad .

Lemma 4.4.1. Let A be a distinguisher making at most q ≤ 2 n queries to KDMEnc or Dec and q f queries to F. With T bad as defined above, one has

Pr[X A,pw ∈ T bad ] ≤ q 2 (cf(Φ) + 3/2 • oxf(Φ R ) + 6/2 n ) + qq f (of(Φ R ) + 3/2 n ) .
Proof. We compute the probability of each condition in turn. Remember that in pw, the key

K = (K 1 , K 2 , K 3 , K 4
) is drawn at random independently of all oracle answers at the end.

(C-1) Fix an encryption query (+, φ, ST ) ∈ Q BC and a query to the public function

(u, v) ∈ Q F . (a) By Definition 4.3.2, φ R (K) = K 1 ⊕ u with probability at most of(Φ R ); (b) Since k 4
is uniformly random and independent of the query transcript, K 4 = S ⊕ u with probability at most 1/2 n . By summing over all possible pairs, condition (C-1) happens with probability at most

qq f (of(Φ R ) + 1/2 n ). (C-2) Fix a decryption query (-, LR, ST ) ∈ Q BC and a query to F (u, v) ∈ Q F .
(a) Since k 1 is uniformly random and independent of the query transcript, R ⊕ u = K 1 with probability at most 1/2 n . (b) Since k 4 is uniformly random and independent of the query transcript, S ⊕ u = K 4 with probability at most 1/2 n . By summing over all possible pairs, condition (C-2) happens with probability at most 2qq f /2 n . (C-3) Fix two queries (+, φ, ST ) = (+, φ , S T ) ∈ Q BC . Since the adversary never repeats queries, we have φ = φ . (a) By Definition 4.3.1, φ(K) = φ (K) with probability at most cf(Φ) over the choice of K. (b) Since φ = φ , the output S T are uniformly sampled at random in a set of size at least 2 2n -q and independently from ST . Thus, S = S with probability at most 2 n /(2 2n -q) ≤ 1/(2 n -1) ≤ 2/2 n . By summing over all possible distinct pairs, condition (C-3) happens with probability at most

q 2 /2 • (cf(Φ) + 4/2 n ). (C-4) Fix two queries (+, φ, ST ), (+, φ , S T ) ∈ Q BC . By Definition 4.3.3, φ R (K) = S ⊕ K 1 ⊕ K 4
with probability at most oxf(Φ R ) over the choice of K. By summing over all possible pairs, condition (C-4) happens with probability at most q 2 • oxf(Φ R ).

(C-5) Fix two decryption queries (-, LR, ST ) = (-, L R , S T ) ∈ Q BC . The value L R is sampled uniformly at random in a set of size at least 2 2n -q and independently from LR. Thus, R = R with probability at most 2 n /(2 2n -q) ≤ 1/(2 n -1) ≤ 2/2 n . By summing over all possible distinct pairs, condition (C-5) happens with probability at most q 2 /2 n .

(C-6) Fix two decryption queries (-, LR, ST ), (-, L R , S T ) ∈ Q BC . As K 1 and K 4 are randomly sampled, R ⊕ S = K 1 ⊕ K 4 with probability at most 1/2 n . By summing over all possible distinct pairs, condition (C-6) happens with probability at most q 2 /2 n .

(C-7) Fix an encryption query (+, φ, ST ) ∈ Q BC and a decryption query (-, L R , S T ) ∈ Q BC . (a) By Definition 4.3.1, φ(K) = L R with probability at most cf(Φ).

(b) We distinguish two cases. If the encryption query occurs before the decryption query, then necessarily ST = S T according to the no-pointless-query assumption (the adversary cannot ask to oracle Dec to decrypt a value that was received as an answer to the KDMEnc oracle). If the decryption query occurs before the encryption query, then ST is uniformly random in a set of size at least 2 2n -q and independent of S T . Hence, the condition occurs with probability at most

1/(2 2n -q) ≤ 1/2 n . (c) By Definition 4.3.3, φ R (K) = S ⊕ K 1 ⊕ K 4 with probability at most oxf(Φ R ) over
the choice of K. (d) Since k 1 and k 4 are drawn uniformly at random and independently from the query transcript, the probability that K 1 ⊕ K 4 = S ⊕ R is at most 1/2 n . By summing over all possible distinct pairs, condition (C-7) happens with probability at most

q 2 /2 • (cf(Φ) + oxf(Φ R ) + 4/2 n ).
The result follow by the union bound over conditions (C-1) to (C-7).

We now lower bound Pr[X A,rw = τ ]/ Pr[X A,pw = τ ] for a good transcript τ . For this, we introduce the following definition. Informally, given a good transcript τ , a function F is bad with respect to τ if there is a collision in the set of all inputs to the second and third round functions.

Definition 4.4.2. Fix a good transcript

τ = (Q BC , Q F , K). Let Domain(F ) := {u ∈ {0, 1} n : ∃(u, v) ∈ Q F } Domain (F ) :=          u ∈ {0, 1} n : ∃(+, φ, ST ) ∈ Q BC , u = φ R (K) ⊕ K 1 ∨ ∃(+, φ, ST ) ∈ Q BC , u = S ⊕ K 4 ∨ ∃(-, LR, ST ) ∈ Q BC , u = R ⊕ K 1 ∨ ∃(-, LR, ST ) ∈ Q BC , u = S ⊕ K 4          .
A function F is said to be bad with respect to τ , denoted bad(F, τ ), if one of the following conditions is fulfilled:

(C -1) there exists (+, φ, ST ) ∈ Q BC such that (a) φ L (K) ⊕ F(φ R (K) ⊕ K 1 ) ⊕ K 2 ∈ Domain(F) ∪ Domain (F) or (b) T ⊕ F(S ⊕ K 4 ) ⊕ K 3 ∈ Domain(F) ∪ Domain (F); (C -2) there exists (-, LR, ST ) ∈ Q BC such that (a) L ⊕ F(R ⊕ K 1 ) ⊕ K 2 ∈ Domain(F) ∪ Domain (F) or (b) T ⊕ F(S ⊕ K 4 ) ⊕ K 3 ∈ Domain(F) ∪ Domain (F); (C -3) there exist (+, φ, ST ) = (+, φ , S T ) ∈ Q BC such that (a) φ L (K) ⊕ F(φ R (K) ⊕ K 1 ) = φ L (K) ⊕ F(φ R (K) ⊕ K 1 ) or (b) T ⊕ F(S ⊕ K 4 ) = T ⊕ F(S ⊕ K 4 ); T ⊕ F(S ⊕ k 4 ) ⊕ k 3 with probability at most 1/2 n . (d) By ¬(C-7d), S ⊕ K 4 = R ⊕ K 1 so that F(S ⊕ K 4
) and F(R ⊕ K 1 ) are uniformly random and independent and thus

T ⊕ F(S ⊕ K 4 ) ⊕ K 3 = L ⊕ F(R ⊕ K 1 ) ⊕ K 2
with probability at most 1/2 n . By summing over all possible pairs, condition (C -7) happens with probability at most 2q 2 /2 n . The result follows by the union bound over all conditions.

= (Q BC , Q F , K). Then Pr[F ← ← F * ({0, 1} n , {0, 1} n ) : KAF F K Q BC | F Q F ∧ ¬bad(F, τ )] = 1 (2 n ) 2q .
Proof. Let q enc and q dec respectively denote the number of queries to KDMEnc and Dec in Q BC , with q enc + q dec = q. Using an arbitrary order, let

Q BC = (+, φ 1 , S 1 T 1 ), . . . , (+, φ qenc , S qenc T qenc ), (-, L qenc+1 R qenc+1 , S qenc+1 T qenc+1 ), . . . , (-, L q R q , S q T q ) .
For a given function F, let w i and z i be the i-th input to F in the second and third rounds respectively, i.e.,

w i = φ i,L (K) ⊕ F(φ i,R (K) ⊕ K 1 ) ⊕ K 2 for 1 ≤ i ≤ q enc = L i ⊕ F(R i ⊕ K 1 ) ⊕ K 2 for q enc + 1 ≤ i ≤ q z i = T i ⊕ F(S i ⊕ K 4 ) ⊕ K 3 for 1 ≤ i ≤ q . Then event KAF F K Q BC is equivalent to F(w i ) = φ i,R (K) ⊕ T i ⊕ F(S i ⊕ K 4 ) F(z i ) = S i ⊕ φ i,L (K) ⊕ F(φ i,R (K) ⊕ K 1 ) for 1 ≤ i ≤ q enc (4.3) F(w i ) = R i ⊕ T i ⊕ F(S i ⊕ K 4 ) F(z i ) = S i ⊕ L i ⊕ F(R i ⊕ K 1 ) for q enc + 1 ≤ i ≤ q . ( 4.4)
Conditioned on event ¬bad(F, τ ), we have that w 1 , . . . , w q , z 1 , . . . , z q are 2q distinct values as otherwise one of the conditions (C -3)-(C -7) would be fulfilled. Moreover, all these 2q values are distinct from values in Domain(F) ∪ Domain (F), as otherwise condition (C -1) or (C -2) would be fulfilled, which implies that, even conditioned on F Q F , the 2q random values F(w 1 ), . . . , F(w q ), F(z 1 ), . . . , F(z q ) are uniform and independent of

F(φ i,R (K) ⊕ k 1 ) for 1 ≤ i ≤ q enc , F(R i ⊕ k 1 ) for q enc + 1 ≤ i ≤ q, and F(S i ⊕ k 4 ) for 1 ≤ i ≤ q. Hence, Equations (4.3) and (4.4) hold with probability (1/2 n ) 2q . Lemma 4.4.4. Fix a good transcript τ = (Q BC , Q F , K). Then Pr[X A,rw = τ ] Pr[X A,iw = τ ] ≥ 1 -4 • qq f /2 n -15 • q 2 /2 n . Proof. Let τ = (Q BC , Q F , K) with K = (k 1 , k 2 , k 3 , k 4
) be a good transcript, and let q enc , resp. q dec denote the number of queries to KDMEnc, resp. Dec in Q BC , with q enc + q dec = q.

builds the values

∆ L := F 2 (x) ⊕ x, ∆ R := F(x), ∆ L := F 2 (x ) ⊕ x , ∆ R := F(x ) .
• A then calls the KDMEnc oracle twice on inputs φ = (φ L , φ R ) and φ = (φ L , φ R ) where

φ L (K) := K 2 ⊕ ∆ L and φ R (K) := K 1 ⊕ ∆ R , φ L (K) := K 2 ⊕ ∆ L and φ R (K) := K 1 ⊕ ∆ R .
Note that a set Φ R containing φ R and φ R is not partially offset-free. The adversary receives ST and S T as the respective answers.

• A returns 1 iff S ⊕ S = x ⊕ x .
The adversary returns 1 with probability 1 in the real world whereas it returns 1 with probability 1/2 n in the ideal world. To see the former, note that the input

[K 2 ⊕∆ L , K 1 ⊕∆ R ]
is processed though the first three rounds as follows.

→[K 1 ⊕ ∆ R , F(∆ R ) ⊕ K 2 ⊕ ∆ L ] → [F(∆ R ) ⊕ K 2 ⊕ ∆ L , F(F(∆ R ) ⊕ ∆ L ) ⊕ K 1 ⊕ ∆ R ] → →[F(F(∆ R ) ⊕ ∆ L ) ⊕ K 1 ⊕ ∆ R , S = F(F(F(∆ R ) ⊕ ∆ L ) ⊕ K 1 ⊕ ∆ R ⊕ K 3 ) ⊕ F(∆ R ) ⊕ K 2 ⊕ ∆ L ] . Since ∆ L = F(∆ R ) ⊕ x and ∆ R = F(x)
, the expression for S simplifies to

F(K 1 ⊕ K 3 ) ⊕ K 2 ⊕ x .
A similar expression holds for S and thus S ⊕ S = x ⊕ x . (Observe also that K 1 ⊕ K 3 is the colliding input to the third-round F.)

Sliding attack for r-round

In this section, we analyse the simplest KAF configuration where all functions are the same, and all keys are identical. This construction, for any number of rounds, is already insecure in the CPA model: using two encryption queries, we have KAF(LR) = ST and KAF(T S) = LR (the adversary can recover the plaintext LR). In the KDM security model, we give a stronger attack, namely a key-recovery attack, using only one query. For the 4-round KAF, the adversary A does the following:

• A chooses a value ∆ ∈ {0, 1} n and calls the encryption oracle KDMEnc giving as input the function φ such that

φ R (K) = K⊕F(∆)⊕F[F 2 (∆)⊕∆] and φ L (K) = K⊕F 2 (∆)⊕∆⊕F[F(∆)⊕F(F 2 (∆)⊕∆)].
It receives the value ST .

• If S ⊕ T = ∆ then A returns the value T (which is the key K in the real world).

For this attack, one encryption query is sufficient to extract the key K. The details of this attack are shown in Figure 4.17. This attack can be generalized for any number of rounds. We can give a generic expression for the function φ for any number of rounds r but we believe that it will be hard to read. Instead, we give the following method. The idea is that, for a r-round KAF, the output ST has to be equal to S = L 0 and T = R 0 where L 0 = K ⊕ ∆ and R 0 = K. We define the following recursive sequences ∀i ∈ N, (LR

φ L (K) F K φ R (K) K ⊕ F 2 (∆) ⊕ F[F 2 (∆) ⊕ ∆] F K K ⊕ F 2 (∆) ⊕ ∆ K ⊕ F 2 (∆) ⊕ ∆ F K K ⊕ F(∆) K ⊕ F(∆) F K K ⊕ ∆ S = K ⊕ ∆ T = K
) i :=      L 0 = K ⊕ ∆ and R 0 = K L i+1 = F(L i ⊕ K) ⊕ R i R i+1 = L i
∀i ∈ N, the values L i and R i can be written such that

L i = K ⊕ ∆ L and R i = K ⊕ ∆ R
where ∆ L and ∆ R are constants independent of K then choosing such functions (L i and R i ) as inputs is allowed. Then the previous adversary A can be used to recover the key in the CPA-KDM model of the r-round KAF (same round functions and same keys) with φ L (K) = L r and φ R (K) = R r . The outputs ST will always be the same (equal to L 0 R 0 as shown in Figure 4.18).

Even in the r-round KAF, where the keys of all odd rounds are equal to the same key K 1 and all the keys of even rounds are equal to the same K 2 the keys K 1 and K 2 can be extracted using one query in the KDM model. The previous attack can be adapted by choosing L 0 = K 2 ⊕ ∆ and R 0 = K 1 when r is even and L 0 = K 1 ⊕ ∆ and R 0 = K 2 when r is odd. More formally, we have the following recursive sequences:

L 1 F K R 1 L 0 R 0 L 2 F K R 2 L 1 F K R 1 L 0 R 0 L 3 F K R 3 L 2 F K R 2 L 1 F K R 1 L 0 R 0
∀i = 2j with j ∈ N, (LR) i :=      L 0 = K 1 ⊕ ∆ and R 0 = K 2 L i+1 = F(L i ⊕ K * ) ⊕ R i R i+1 = L i
When computing the internal value L i+1 , the key K * is equal to K 1 if i is odd and to K 2 otherwise.

∀i = 2j + 1 with j ∈ N, (LR) i :=      L 0 = K 2 ⊕ ∆ and R 0 = K 1 L i+1 = F(L i ⊕ K * ) ⊕ R i R i+1 = L i
When computing the internal value L i+1 , the key K * is equal to K 1 if i is even and to K 2 otherwise.

To recover the two keys, K 1 and K 2 , the adversary computes S ⊕ ∆, which corresponds to one key (K 1 or K 2 depending on the number of rounds) and the other key is the output T .

Even-Mansour KDM security with H-coefficients

The KDM-security of the 1-round Even-Mansour cipher has been analysed in Section 4.2.2.1 with the splitting and forgetting framework. In the following, we apply the method based on the H-coefficient technique to compare this two methods.

Bellare, Goldreich and Goldwasser initiated the study on incremental cryptography in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF] and then refined it in [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF]. Cryptographic incremental constructions are meant to provide efficient updates compared to classical algorithms. Usually, the result of a cryptographic algorithm (such as encryption or authentication) over a document has to be re-computed entirely if any change is applied to the document (and this regardless of the modification size). Incremental cryptography enables to update a signature, a message authentication code (MAC) or a ciphertext in time proportional to the number of modifications applied to the corresponding document. This attractive feature leads to build many incremental cryptographic primitives such as encryption schemes [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF][START_REF] Atighehchi | Towards fully incremental cryptographic schemes[END_REF][START_REF] Atighehchi | Space-efficient, byte-wise incremental and perfectly private encryption schemes[END_REF], signatures [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF][START_REF] Fischlin | Lower bounds for the signature size of incremental schemes[END_REF][START_REF] Mironov | Incremental deterministic public-key encryption[END_REF], MACs [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF][START_REF] Fischlin | Lower bounds for the signature size of incremental schemes[END_REF][START_REF] Micciancio | Oblivious data structures: Applications to cryptography[END_REF], hash functions [GSC01, BM97] and authenticated encryption constructions [START_REF] Buonanno | Incremental unforgeable encryption[END_REF][START_REF] Atighehchi | Towards fully incremental cryptographic schemes[END_REF][START_REF] Sasaki | A new mode of operation for incremental authenticated encryption with associated data[END_REF]]. An algorithm is incremental regarding specific update operations such as inserting, deleting or replacing a data block inside a document. A desirable incremental algorithm should support all these operations for any position: it should be possible to insert, delete or replace a data block of the document for all positions without breaking the security of the cryptographic algorithm. Most known algorithms only support replacement of data blocks and the algorithms that support insertion, deletion and replacement1 are deemed strongly incremental. Protection against virus is the first application of incremental cryptography quoted in the seminal paper [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF]. They consider the usage scenario where a processor accesses files on a remote host and a virus can alter these files. A simple idea is to compute authentication tags for all files with a key stored securely by the processor and any modification by a virus will be detected by verifying the corresponding tag. Knowing that these files will be updated often enough, using an incremental authentication algorithm preserves the processor by performing a lighter computation. Bellare et al. also introduced in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF] the corresponding security notions. In the basic security model, the adversary can obtain a valid authentication tag for any message he wanted (as in classical MAC security) and it can also update (with the supported update operations) valid message/tag pairs. This is a first security level but it is reasonable to consider a stronger adversary that can alter files and tags before applying update operations; it corresponds to the tamper-proof security notion introduced in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF]. Nowadays, this use case can be extended to the "digital world". Large amount of data [START_REF] Gantz | The digital universe in 2020: Big data, bigger digital shadows, and biggest growth in the far east[END_REF][START_REF] Mihajloska | Reviving the idea of incremental cryptography for the zettabyte era use case: Incremental hash functions based on SHA-3[END_REF] are processed every day by different services like cloud services, distributed networks and distributed storage. It is clear that all these data require integrity and/or privacy at a low computational cost otherwise going through gigabytes of data for minor changes without incremental primitives is really demanding in term of time and energy. A concrete example is the Cloud Bigtable by Google [START_REF] Bershad | 7th Symposium on Operating Systems Design and Implementation (OSDI '06)[END_REF] that stores petabytes of data across thousands of commodity servers. This Bigtable has a particular data structure that links a unique index number to each block. In this case an incremental hashing that supports replacement and insertion operations is suitable as mentioned in [START_REF] Mihajloska | Reviving the idea of incremental cryptography for the zettabyte era use case: Incremental hash functions based on SHA-3[END_REF]. A more critical usage is storage services in mobile cloud computing where a mobile client device is in addition limited in term of energy consumption. To solve this issue, Itani, Kayssi and Chehab provide an energy-efficient protocol in [START_REF] Itani | Energy-efficient incremental integrity for securing storage in mobile cloud computing[END_REF] that guarantees data integrity based on incremental MACs. Another use case is sensor networks and more specifically environmental sensors [START_REF] Hart | Environmental sensor networks: A revolution in the earth system science?[END_REF][START_REF] Mihajloska | Reviving the idea of incremental cryptography for the zettabyte era use case: Incremental hash functions based on SHA-3[END_REF]: several sensors are deployed at different physical positions and they record continuously data. At some point, all the data end up in a big public database that has to be publicly checkable. The database is updated (insertion operation mainly) at a high frequency and if the hash value over all the database is entirely re-computed for each insertion it will be very consuming. All these use cases are examples among many others. Incremental cryptography is clearly an area to explore to solve practical issues. For now incrementality is mainly investigated for hashing and signing even if it was also considered for encryption in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF][START_REF] Atighehchi | Towards fully incremental cryptographic schemes[END_REF]. It is not surprising regarding all the practical use cases that need incremental authenticated constructions. Recently, the CAESAR2 competition stimulated research on authenticated encryption algorithms. Sasaki and Yasuda analysed several candidates and found that none of them performed incrementality. That is why they designed their own authenticated encryption mode with associated data [START_REF] Sasaki | A new mode of operation for incremental authenticated encryption with associated data[END_REF] based on existing constructions. This new mode is incremental for the replace, insert and delete operations, but the insert and delete operations of this mode concern only the last block of the authenticated data or the last block of the message (and it remains open to design a strongly incremental authenticated encryption algorithm).

In Chapter 2, we define a strong model where the authenticity of the disk sectors is guaranteed. Incremental MAC can be a possibility to enhance the disk performance by reducing the read and write operation delays as the update and verify operations should be done in constant time. A first scenario is to use a regular MAC scheme to compute the local tags and an incremental MAC to ensure the authenticity of the local tags. Then for each data sector modification (e.g. each write operation), the corresponding local tag is recomputed from scratch and the global tag is updated quickly in the secure memory according to the local tag. And each time, a sector is read, the authenticity of the local tag has to be verified quickly (using the incremental MAC) before the verification of the data sector integrity (using the MAC). Another possibility is to use the incremental MAC for the data sector authenticity with a key K 1 and for the local tag integrity with a different key K 2 . But for each sector modification, even only one bit, the sector is re-written entirely then if the local tag computation with a regular MAC takes less time than a read/write operation (without data authenticity) then using an incremental MAC for the sector data does not enhance the read or write operations. As the number of sectors is fixed and it is better to guarantee the whole disk integrity, the incremental MAC set of operations can be reduced to the replace operation. The initialisation of the disk will take some time due to the encryption and the local tag computation of each sector and the global tag in the FADE model (described in Section 2.3.2) but this is only the case for the first disk usage.

One can also consider encryption "on the fly" where each sector are encrypted and tagged only when it is used for the first time. In this chapter, we introduce a specific framework to analyse incremental MACs for different security notions. Then we give an attack against the basic security of the Xor-Scheme which is a strongly incremental MAC. We also give different ways to patch this construction and a security proof for one of them. Then we introduce a new incremental MAC scheme that achieves the strong security notion IUF2 and the corresponding security proofs.

Incremental MACs and Security notions

In this section, we give a formal definition for an incremental MAC scheme and the corresponding security notions using security games. We recall that the game rules and the game notations are described in Section 1.2. We follow the line of papers oriented on incremental MACs (like in [START_REF] Fischlin | Incremental cryptography and memory checkers[END_REF]) by using the word "document" instead of message but both can be used. Examples of operations are given in Figure 5.1. The figure shows three common edit operations, namely insert, replace and delete, whose operation codes are denoted respectively by insert, replace and delete. The insert operation allows inserting a block x at position i in the document D, the delete operation allows deletion of the i-th block of D, and the replace operation allows replacement of the i-th block of D by the block x. Note that a scheme which is incremental for the insert and delete operations is also incremental for the replace operation: replace can be implemented by using insert and delete. But in some cases we will consider only replace.

Incremental Authentication Scheme Framework

Incremental message authentication schemes. In the following, we define two types of incremental schemes: probabilistic or randomized and nonce-based incremental schemes.

A nonce-based incremental message authentication scheme iMA for a document editing system DES is specified as follows: iMA = (KS, BS, DS, NS, IS, kg, init, tag, upd, ver).

There is a block space iMA.BS = {0, 1} iMA.n where iMA.n ≥ 1 is the block length; the document space iMA.DS is then defined as the set of all vectors over iMA.BS and iMA.DS ⊇ DES.DS, so that all documents of the document editing system may be tagged. There are a document identity space iMA.IS, a nonce space iMA.NS and a key space iMA.KS defined for the scheme.

• The iMA scheme has to be initialized by calling the probabilistic key generation algorithm iMA.kg that takes no inputs and returns a key K ∈ iMA.KS.

• The initialization algorithm iMA.init takes an identifier id ∈ iMA.IS and returns an initial state st id for id. It can be probabilistic.

• The tagging algorithm iMA.tag takes a key K ∈ iMA.KS, a nonce N ∈ iMA.NS, an identifier id ∈ iMA.IS, a document D ∈ iMA.DS and current state st id , and deterministically returns a tag t and updated state st id .

• There is an update algorithm iMA.upd that takes the key K ∈ iMA.KS, a nonce N ∈ NS, an identifier id ∈ iMA.IS, a document D ∈ iMA.DS, an operation code op ∈ DES.OpCodes, arguments arg for the operation, a tag t and the current state st id and deterministically returns an updated tag t and updated state st id .

• The verification algorithm iMA.ver takes a key K ∈ iMA.KS, an identifier id ∈ iMA.IS, a document D ∈ iMA.DS, the state st id and a candidate tag t to deterministically return either true or false.

• An iMA scheme may take other parameters and if it is the case, it will be explicitly underlined in its specifications.

For nonce-based incremental schemes, the tagging, update and verify algorithms are deterministic.

A probabilistic incremental scheme iMA such that iMA = (KS, BS, DS, RS, IS, kg, init, tag, upd, ver), has similar specifications except that 1. Instead of a nonce space NS, it has as a parameter a random value space RS, 2. The tagging and update algorithms are probabilistic and do not take a nonce as input.

Update time. The update time of an incremental MAC should be proportional to the modification. This property makes an incremental MAC more efficient that a standard MAC where for each modification, the tag is recomputed from scratch. More formally, for a couple document/tag where the document is composed by nb blocks, if the size of the modification in the document is m blocks, the update operation should be done in time O(m). For the Xor-MAC, the replace operation for one document block costs 2 evaluations of the underlying PRF which makes it incremental but the replace operation of one document block for the Merkle tree costs O(m log 2 nb) evaluations of the underlying PRF. However, the incrementality of the tag verification is not required.

In the following, the security games are written regarding nonce-based incremental authentication schemes. The corresponding games for probabilistic schemes are similar except that (1) for all procedures, the nonces are ignored (the corresponding noncespace NS too); (2) the internal iMA.tag and iMA.upd are probabilistic. For instance, the code line (t id , st id ) ← iMA.tag(K, N, id, D, st id ) in the nonce-based setting is replaced by (t id , st id ) ← ← iMA.tag(K, id, D, st id ) in the probabilistic setting. Stateless incremental MACs. We say that the scheme iMA is stateless if iMA.init always returns st = ε, and the tagging and update algorithms also always return ε as the updated state. In this scenario, we may omit the state st as an input or output to all algorithms.

Single-Document setting. We say that iMA is a Single-Document (SD) incremental MAC scheme if the identity space iMA.IS = {ε} consists of a single identity namely the empty string ε. As for stateless schemes, in this setting we may omit the document identity id as an input or output to all algorithms. When we say that iMA is a Multi-Document (MD) incremental MAC scheme, we are simply emphasizing that, as per the definition of an incremental MAC scheme, the identity space could have any non-zero size. If a scheme iMA achieves a security notion in the multi-document setting, it implies that it readily achieves the same security notion in the single-document setting (see Figure 5.9).

Correctness. Correctness requires that tags generated under a certain key and state, for a certain document, are correct, meaning accepted by the verification algorithm, for the same key, the updated state and the same document. It also requires that update of correct tags results in correct tags. A formal correctness condition is simple to state for stateless schemes, but the stateful case requires more care. We do it via a game, formally asking that Pr[G corr iMA,DES (A)] = 0 for all adversaries A regardless of their running time, where game G corr iMA,DES is shown in Figure 5.2 and Figure 5.3, the boxed code excluded.

For the correctness and the consistency games (below), the adversary must query once the Initialize procedure and then the Reset procedure in this order. The Reset procedure

Security Notions for Incremental MACs

In the following, we will present several security notions for incremental MACs that correspond to different types of Incremental UnForgeability (IUF). Two security notions, namely the basic security and the tamper-proof security, were introduced in previous works [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF][START_REF] Fischlin | Incremental cryptography and memory checkers[END_REF] but the formal security definition of the latter was unclear. As mentioned above, in the basic security scenario, the adversary can obtain authentication tags for any messages of its choice and it can also update valid message/tag pairs. The corresponding security game can be easily described (see Figure 5.4). The tamper-proof security considers much stronger adversaries that can modify documents and tags arbitrarily before applying update operations. In this setting, it is quite complex to define the notion of forgery since the list of messages that are actually authenticated is difficult to define. We define several new notions that try to capture this tamper-proof security notion. In order to do so, for each security notion, we will consider both Single-Document (SD) and Multi-Document (MD) settings, except for basic security as it was defined without it.

In the multi-document setting, the adversary can get signatures to multiple documents of its choice by using the Tag procedure with different document identities. The single document setting is the special case where the document identity id is fixed as the empty string ε then each value X id can be read as X in the single document setting. After calling the Initialize procedure, the Reset procedure has to be called to initialize the state; after that it can be called at any moment. Then the Tag procedure has to be called at most once for each document (i.e. with a fixed identity document). After that, the adversary can make an arbitrary number of queries to the Update and the Verify procedures. The adversary A has access to a Reset procedure that erases the document and the state st in the SD setting or a specific document in the MD setting if A gives the document identification number id as input to the oracle. Finally, the last call of A is a call to Finalize. The security game of IUF-BS is defined for any document: there is no distinction between single and multiple document settings. The adversary A playing this security game has to follow the rules defined above except that he can call many times the Tag oracle (otherwise only one document can be updated).

Basic Security (IUF-BS). This security notion is the basic security as defined in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF]. In this setting, the documents are not identified (and as in the single-document setting we omit the document identity id as an input or output to all algorithms) and we assume that the documents and tags are stored securely. Hence, the update operations have to be done on authentic documents D and tags t that is why the update operations are done on pairs (D, t) where iMA.ver(., D, t, .) returns true. The corresponding security game is given in Figure 5.4. Another specificity is that here the adversary can call many times the Tag oracle as mentioned previously. Let iMA be a message authentication scheme that is incremental for the document editing system DES. The advantages of an adversary A playing the IUF-BS security game is defined as

Adv IUF-BS iMA = Pr[G IUF-BS iMA ].
Incremental UnForgeability 1 (IUF1). IUF1 security notion is close to the IUF-BS, the main difference is that in IUF1 the adversary is allowed to call the Tag oracle only once per identification number. In other words, a document, identified with the number id, can be tagged only once. Then he can update all of them as he wants to. Each update operation has to be applied to the previous versions of the document and the tag: A cannot ask to update a specific version of the document but only the latest one that will be called in the following the current document and the current tag. Hence, the update oracle does not take as input a document D and a tag t, these values are global variables and are updated in the game. It also means that for each update query the document D and a tag t are authentic as A cannot tamper with them. Let iMA be a message authentication scheme that is incremental for the document editing system DES. The advantages of an adversary A playing against the IUF1 security game in the single-document setting IUF1-SD and the multi-document setting IUF1-MD are defined respectively as Adv IUF1 As mentioned in Chapter 2, for disk authentication a specific tampering attack is what we can call a "downgrade attack" or a "replay attack": the adversary snapshots the entire disk at some specific time and waits for a specific moment to restore it. A desired property to thwart this is a so-called temporal data authentication: at any moment, a user wants to be sure that the data he is manipulating now is the data stored during the previous legitimate manipulation. The security notions IUF1-SD and IUF1-MD does not provide such security guarantee since the list DL contains all documents/tags generated by the procedures Tag and Update. We thus define two stronger security notions where the document list DL contains only the last version of the document authenticated (for each document identification number). These security notions are described in Figure 5.6 and are called IUF1R-SD and IUF1R-MD (where the letter R stands for "Replay attack").

Incremental UnForgeability 2 (IUF2). This security notion tries to capture what was called tamper-proof security in [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF]. The adversary is given the power to tamper with documents and authentication tags stored in the system, and thus obtain the result of the incremental scheme on document-tag pairs which need not be valid. This is modeled by allowing the adversary to choose the document and tag given as input to the update However, assuming the existence of a secure MAC, there exist incremental MAC secure in the IUFxy-SD model which are not secure in the IUFxy-MD (for x ∈ {1, 2} and y ∈ {R, }). It suffices to construct an incremental MAC in the multi-document setting from the IUFxy-SDsecure incremental MAC in the single-document setting which produces MAC independent of the document identification numbers. This scheme still achieves IUFxy-SD security but does not achieve IUFxy-MD (since a valid tag for a document with identification number id is a valid forgery for the same document with an identification number id = id).

Games G IUF2-SD iMA G IUF2-MD iMA procedure Initialize K ← ← iMA.kg() id ← ε procedure Reset( id ) st id ← ← iMA.init( id ) S ← S ∪ {id} D id ← ⊥ procedure Tag(N, id , D) if ( id / ∈ S or N ∈ N id ) then return ⊥ (t id , st id ) ← iMA.tag(K, N, id , D, st id ) D id ← D; N ← N ∪ {N } DL ← DL ∪ {( id ,
Let y ∈ {R, } and z ∈ {SD, MD}. Since the capabilities of an adversary in game G IUF2y-z iMA are stronger than those of an adversary in game G IUF1y-z iMA , we get readily the following proposition: Proposition 5.1.2. Let y ∈ {R, } and z ∈ {SD, MD}. Let iMA be an incremental authentication scheme for the document editing system DES in the multi-document setting. If we have an adversary A against the IUF1y-z security of iMA which makes no more than q queries to the Tag procedure and runs in time t, then we can construct an adversary B which makes no more than q ≤ q queries to the Tag procedure and runs in time t ≤ t against the IUF2y-z security of iMA such that Adv IUF1y-z iMA (A) ≤ Adv IUF2y-z iMA (B).

Let y ∈ {R, } and z ∈ {SD, MD}. Assuming the existence of a secure MAC, there exist incremental MAC secure in the IUF1y-z model which are not secure in the IUF2y-z. It suffices to construct an incremental MAC from the IUF1y-z-secure incremental MAC by modifying only the update algorithm such that it outputs the key when executed on a public specific tag τ * (for any nonce, document and operation). Since the original scheme is IUF1y-z-secure, this tag is unlikely to be output by a tag or update algorithm and the modified scheme remains IUF1y-z-secure (since an adversary cannot query τ * to the update algorithm in the IUF1y-z security game). However, the modified scheme is not IUF2y-z-secure since the query of τ * (for any nonce, document and operation) to the update algorithm (legitimate in this game) reveals immediately the authenticating key.

Games G IUF2R-SD iMA G IUF2R-MD iMA procedure Initialize K ← ← iMA.kg() id ← ε procedure Reset( id ) st id ← ← iMA.init( id ) S ← S ∪ {id} D id ← ⊥ procedure Tag(N, id , D) if ( id / ∈ S or N ∈ N id ) then return ⊥ (t id , st id ) ← iMA.tag(K, N, id , D, st id ) D id ← D; N ← N ∪ {N } DL ← {( id , D)} return t id procedure Update(N, id , D, op, arg, t) if ( id / ∈ S or D id = ⊥ or N ∈ N id ) then return ⊥ (t id , st id ) ← iMA.upd(K, N, id , D, op, arg, t, st id ) D id ← DES.Edit(D id , op, arg) DL ← {( id , D id )} N id ← N id ∪
Let x ∈ {1, 2} and z ∈ {SD, MD}. Since the games G IUFxR-z iMA and G IUFx-z iMA are identical except that the document list DL in the former game is a subset of the document list in the latter game, we get readily the following proposition: Proposition 5.1.3. Let x ∈ {1, 2} and z ∈ {SD, MD}. Let iMA be an incremental authentication scheme for the document editing system DES in the multi-document setting. If we have an adversary A against the IUFx-z security of iMA which makes no more than q queries to the Tag procedure and runs in time t, then we can construct an adversary B which makes no more than q ≤ q queries to the Tag procedure and runs in time t ≤ t against the IUFxR-z security of iMA such that Adv IUFx-z iMA (A) ≤ Adv IUFxR-z iMA (B).

However, a stateless incremental MAC cannot achieve the security notions IUFxR-z (since an adversary can simply output a previous tag as its forgery that would be accepted as valid). This gives a simple separation with the security notions IUFx-z and IUFxR-z that can be achieved with stateless schemes (assuming the existence of classical MACs or one-way functions). Remark 5.1.2 (From IUFx-z security to IUFxR-z security). If a scheme iMA 1 achieves IUFx-z security then an IUFxR-z secure scheme iMA 2 can be built as follows: let t be the tag produced by iMA 1 , with the tag or update queries, it is sufficient to xor the value MAC(ctr), where MAC is a standard authentication scheme and ctr is a counter incremented for each tag and update queries, with the tag t. This resulting construction iMA 2 is stateful and the state contains the counter value ctr.

The following proposition states that if an incremental MAC is IUF-BS then it is also IUF1-SD: Proposition 5.1.4. Let iMA be an incremental authentication scheme for the document editing system DES in the multi-document setting. If we have an adversary A against the IUF1-SD security of iMA which makes no more than q queries to the Tag procedure and which runs in time t, then we can construct an adversary B which makes no more than q ≤ q queries to the Tag procedure that runs in time t ≤ t against the IUF-BS security of iMA such that Adv IUF1-SD iMA (A) ≤ Adv IUF-BS iMA (B).

Proof. This proposition follows readily from the fact that an adversary A for the IUF1-SD security notion is also a valid adversary for the IUF-BS security (with possibly several document identifiers id) which succeeds in the game G IUF-BS iMA if A succeeds in game G IUF1-SD iMA (within the same time bound). We can therefore simply consider B = A and the result follows.

Finally, generalizing the previous examples, we can see that there exist an incremental MAC which is IUF-BS-secure but not IUF2-SD-secure (with a construction similar to the counter-example following Proposition 5.1.2) and an an incremental MAC which is IUF-BSsecure but not IUF1R-SD-secure (with a construction similar to the counter-example following Proposition 5.1.3).

Figure 5.9 presents a synthetic view of the relations among security notions for incremental MACs.

From Single-Document to Multi-Document Security

In the previous subsection, after Proposition 5.1.1, we explain that there exist incremental MAC secure in the IUFxy-SD model which are not secure in the IUFxy-MD (for x ∈ {1, 2} and y ∈ {R, }). In this section, we show a generic construction of a scheme in the multi-document setting with the latter security property from a scheme in the single document setting with the former security property.

Suppose we have an incremental message authentication scheme iMA1 for the singledocument setting for the editing system DES. We show how to transform this into an incremental message authentication scheme iMA2, iMA2 = SDtoMD 1 (iMA1, F), for the multi-document setting (also for the same document editing system DES) such that: if iMA1 is IUFxy-SD secure and F is a pseudorandom function, then iMA2 is IUFxy-MD secure, for x ∈ {1, 2} and y ∈ {R, }. The description is given in Figure 5.10 and is denoted as

iMA2 = SDtoMD 1 (iMA1, F). IUF-BS IUF1-SD IUF1-MD IUF2-SD IUF2-MD IUF1R-SD IUF1R-MD IUF2R-SD IUF2R-MD Figure 5
.9: Relations among security notions for incremental MACs. A black arrow is an implication, and in the directed graph given by the black arrows, there is a path from security notion A to security notion B if and only A implies B. The red arrows represent separations (i.e. if there is a red arrow from security notion A to security notion B, then -assuming the existence of one-way functions -there exist a scheme which achieves A but does not achieve B). All other relations follow automatically.

Theorem 5.1.1. Let x ∈ {1, 2} and y ∈ {R, }. Let iMA1 be an incremental authentication scheme for the document editing system DES in the single-document setting and let F denote a pseudorandom function F : F.KS × iMA2.IS → iMA1.KS. Let iMA2 be the incremental authentication scheme for the same document editing system in the multi-document setting that is generated by the transform given in Figure 5.10, as iMA2 = SDtoMD 1 (iMA1, F). If we have an adversary A against the IUFxy-SD security of iMA2 which makes no more than q queries to the Tag procedure and which runs in time t, then we can construct an adversary B that runs in time t ≤ t + q • T (iMA.init) (where T (iMA.kg) denotes the running time of the algorithm iMA.kg) against the IUFxy-SD security of iMA1 and a distinguisher D that runs in time t ≤ t for the PRF F such that

Adv IUFxy-MD iMA2 (A) ≤ q • Adv IUFxy-SD iMA1 (B) + Adv prf F (D)
Proof. We proceed via a series of games. The game G 0 is exactly the IUFxy-MD game for the transform iMA2 = SDtoMD 1 (iMA1, F) defined in Figure 5.12. We define the game G 1 in Figure 5.12 by replacing the PRF used to generate a key for each document in the tagging, update and verification oracles with a random function.

The advantage of an adversary A distinguishing G 0 from G 1 is reduced to an adversary D against the underlying PRF such that Pr

[ G 0 ] -Pr [ G 1 ] ≤ Adv prf F (D). We built an adversary iMA2.init(id) st id ← ← iMA1.init(ε) return st id iMA2.ver(K, id, D, t id , st id ) K id ← F(K, id) return iMA1.ver(K, ε, D, t, st id ) iMA2.kg() K ← ← F.KS return K iMA2.tag(K, N, id, D, st id ) K id ← F(K, id) (t, st id ) ← iMA1.tag(k id , N, ε, D, st id ) N id ← N id ∪ {N } return (t, st id ) iMA2.upd(K, N, id, D, op, arg, t id , st id ) K id ← F(K, id) (t, st id ) ← iMA1.upd(K, N, ε, D, op, arg, t id , st id ) N id ← N id ∪ {N } return (t, st id )
Figure 5.10: Transform SDtoMD 1 from a single-document scheme to a multi-document scheme, denoted as iMA2 = SDtoMD 1 (iMA1, F).

D using the adversary A as shown in Figure 5.11. D simulates all the oracles of G 0 /G 1 for A as follows: in all the simulated oracles, to compute K id , D uses it own oracle F from PRF game (see Figure 1.1 for more details). The game G 2 is exactly the IUFxy-SD game for iMA1. We construct an adversary B for the IUFxy-MD game in Figure 5.13. This gives us Pr

[ G 2 ] ≥ 1 q Pr [ G 1 ].
The adversary A has no information about which id i was chosen by B. This means the view of A must be independent of the choice of i. Further, since B picks i at random from {1, 2, . . . q}, we get the factor of q.

Putting together these equations, along with the facts that Pr , we get the required inequality.

Incremental MACs with IUF1 Security

In this section, we give the description of two incremental MACs, the Xor-MAC [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF] and the chaining Xor-Scheme [BGG94] constructions, and their analysis in the IUF1 and IUF-BS security models.

XMAC Constructions

The Xor-MAC scheme XMAC is an incremental scheme regarding the replace operation and regarding the insert and delete operations for the last message block only. A randomized version XMACR and a "counter-based" (or nonce-based) version XMACC of this scheme was given in [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF] by Bellare, Guérin and Rogaway (see Figure 5.14). The Xor-MAC structure inspires different scheme designs such as the incremental signature [START_REF] Fischlin | Incremental cryptography and memory checkers[END_REF] given by Fischlin, the PMAC constructions [START_REF] Black | A block-cipher mode of operation for parallelizable message authentication[END_REF][START_REF] Rogaway | Efficient instantiations of tweakable blockciphers and refinements to modes OCB and PMAC[END_REF][START_REF] Yasuda | A new variant of PMAC: Beyond the birthday bound[END_REF]. Then XMAC is a stateless scheme defined as follows XMAC-C/R = (KS, BS, DS, NS/RS, kg, tag, upd, ver).

F K F K F K F K F K τ 0||v 1||1||D[1] 1||2||D[2] 1||3||D[3] 1||nb||D[nb] h 0 h 1 h 2 h 3 h nb . . .
• XMAC is based on a pseudorandom function family F = (KS, Dom, Rng, eval) such that F : F.KS × F.Dom → F.Rng. It follows that F.Dom = {1} × {0, 1} p × XMAC.BS where {0, 1} p is the position space and F.Rng = {0, 1} t where t is the tag size.

• The key generation algorithm XMAC.kg is a (probabilistic) algorithm that takes no input and returns a key K ∈ XMAC.KS such that XMAC.KS = F.KS.

• The tagging algorithm XMAC.tag 1 takes as inputs the key K ∈ XMAC.KS, a document D ∈ XMAC.DS and outputs a tag τ . A value v prepended by the bit 0, such that v ∈ XMACR.RS for the randomized version and such that v ∈ XMAC.NS for the counter-based version, is given as input to F and each document block D[i] ∈ XMAC.BS prepended by 1||i is given as input to the pseudorandom function F K then the sum of the corresponding outputs τ and the value v is returned as the tag t = (v, τ ).

• The Verification algorithm XMAC.ver takes as inputs the key K ∈ XMAC.KS, the document D and the tag t = (v, τ ). It re-computes the value τ from the inputs D and v then it returns true if this value is equal to the input τ and false otherwise.

• The Update algorithm XMAC.upd1 takes as inputs the key K ∈ XMAC.KS, the document D, the operation op ∈ OpCodes where OpCodes = {R, I, D}, the set of argument arg and the tag t. The argument arg is composed by the position i where Chapter 5

5.2 Incremental MACs with IUF1 Security 125 the block value has to be inserted, deleted or replaced and the new document block x ∈ XMAC.BS for the insert and delete operations or ε if it is a delete operation: arg = i, x . The insert and delete operations can be performed only for the last position: as each document block is processed with it block position, it is not possible to insert or delete a block efficiently.

In [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF], Bellare et al. showed that XMACC (Theorem 5.2.1) and XMACR (Theorem 5.2.2) are IUF-BS secure. Theorem 5.2.1. Let A be any (computationally unbounded) an IUF-BS-adversary making a (q t , q v , q upd )-attack against the MACC with a function picked uniformly at random from

F * (D, R) such that D = {0, 1} 2 and R = {0, 1} L . The probability that A is successful is at most q v • 2 -L .
Here, q t is an upper bound on the number of tagging queries, q upd is an upper bound on the number of update queries (such that q = q t + q upd ), q v is an upper bound on the number of verification queries.

Theorem 5.2.2. Let A be any (computationally unbounded) an IUF-BS-adversary making a (q t , q v , q upd )-attack against the MACR with a function picked uniformly at random from

F * (D, R) such that D = {0, 1} 2 and R = {0, 1} L . The probability that A is successful is at most q 2 • 2 n-+ q v • 2 -L .
Here, q t is an upper bound on the number of tagging queries, q upd is an upper bound on the number of update queries (such that q = q t + q upd ), q v is an upper bound on the number of verification queries.

XS Construction

Until this thesis work, the only strongly incremental authentication scheme was the Xor-Scheme, denoted XS in the following. It uses fresh random value for each processed block and was designed by Bellare, Goldreich and Goldwasser in [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF] (see Figure 5.15). This strong property comes with a cost: only basic security is claimed in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF] and this algorithm needs to generate and store a lot of randomness. The tag algorithm generates a random value for each document block and these random values are part of the tag because they are necessary for the verification and the update operations. The Xor-Scheme is based on a pseudorandom function and a pseudorandom permutation and the incremental algorithms for (single block) insert and delete operations require only two applications of the underlying PRF and two applications of the underlying PRP. The Xor-Scheme relies on the concept of pair block chaining (which was later used in [START_REF] Goi | Incremental hash function based on pair chaining & modular arithmetic combining[END_REF] which involves taking each pair of two consecutive blocks of a message and feeding them into a pseudorandom function before chaining all the outputs of the PRF into the final hash. This scheme extends the XMAC schemes from [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF] which are incremental only for replacement. Even if they share a similar name, these two algorithms are different: XMAC is not based on a pair block chaining structure and requires actually much less randomness.

Description of the Xor-Scheme

The Xor-Scheme XS as defined in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF] is an incremental authenticated algorithm based on pair-wise chaining. The XS scheme is based on a pseudorandom function F K 1 and a pseudorandom permutation P K 2 as shown in Figure 5.15. The incremental algorithms for (single block) insert and delete operations require only two applications of F K 1 and two applications of the P K 2 . The XS scheme generates an authentication tag for a document D by repeatedly applying F K 1 to pairs of data blocks -each made of a document block D[i] from the document D and random block r i (pick uniformly at random and independently for each block). The Xor-Scheme is probabilistic scheme and not nonce based then instead of a nonce space XS.NS, we have a random space XS.RS from which the random data blocks are randomly sampled. XS is stateless then the Initialisation algorithm XS.init is omitted (e.g. the state st is empty). It is defined as follows: XS = (KS, BS, DS, RS, kg, tag, upd, ver).

F K 1 F K 1 F K 1 F K 1 F K 1 P K 2 τ D[0] r 0 || R 0 D[1] r 1 || R 1 D[2] r 2 || R 2 D[3] r 3 || R 3 D[nb -2] r nb-2 || R nb-2 D[nb -1] r nb-1 || R nb-1 . . . . . .
The detail of each algorithm is given in Figure 5.16.

• XS is based on a pseudorandom function family F = (KS, Dom, Rng, eval) and a pseudorandom permutation family P = (KS, Dom, eval, inverse) such that F : F.KS × F.Dom → F.Rng and P : P.KS × P.Dom → P.Dom. It follows that F.Dom = XS.RS 2 × XS.BS 2 and F.Rng = P.Dom = {0, 1} t where t is the tag size.

• The key generation algorithm XS.kg is a probabilistic algorithm that takes no input and returns a key K ∈ XS.KS such that XS.KS = F.KS × P.KS.

• The tagging algorithm XS.tag takes as inputs the key K ∈ XS.KS, a document D ∈ XS.DS and outputs a tag t := (r, τ ). For each document block D[i] ∈ XS.BS, a random block value r i ∈ XS.RS of size rl bits is randomly sampled and the concatenantion of all these random blocks r i is denoted r. The concatenation of these values is denoted

R i := D[i]||r i . Each couple (R i-1 , R i
) is processed by the function F and outputs a value denoted h i then the bitwise XOR (eXclusive OR) of all the values (denoted Σ) is processed by the permutation P to give the value τ .

• The Verification algorithm XS.ver takes as inputs the key K ∈ XS.KS, the document D and the tag t := (r, τ ). It re-computes the value τ from the inputs r and D. It returns 1 if this value is equal to the input τ and 0 otherwise.

• The Update algorithm XS.upd takes as inputs the key K ∈ XS.KS, the document the operation op ∈ OpCodes where OpCodes = {I, D}, the set of argument arg and the tag t . The argument arg is composed by the position i where the block value has to be inserted or deleted and the new document block x ∈ XS.BS to insert or ε if it is a delete operation: arg = i, x . To be more specific:

- In the description given in Figure 5.16, we give the description of the original Xor-Scheme defined for basic security (IUF-BS security game). In this work, these specifications (prefix and postfix) are not taken into account: it does not prevent our attack and the repaired scheme is proven secure without it.

Xor-Scheme limits. Supporting insert, delete and consequently replace operations should make the Xor-Scheme very efficient in term of update time running. The fresh random values r i generated by this scheme for each new document block are necessary for security. But generating so much randomness is time-consuming: for an nb-block document D, a nb • rl-random bits value r is generated. Random generation also slows down the insertion operation. Another drawback is the tag expansion: the random value r is part of the tag and needs to be stored. For a nb-block document, random storage costs nb • rl bits. Even if today storage is not an issue, having short tags is desirable.

Remark 5.2.1.

A counter-based version of the Xor-Scheme can be defined: instead of having a random value space XS.RS, it has as a parameter a nonce space NS. In this version, a counter can be used and it has to be a stateful algorithm to store this value in order to assure that it never repeats. It has the advantage to save all the random value generation that can be very consuming from a practical point of view but instead the price to pay is to store the counter. If an adversary has access to any tag t (such that t = (r, τ )) returned by the tag algorithm on a document D (for example D[0]||D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D [2]), it can forge a different document D * having the same value τ . The value τ is computed as follows:

τ = P(K 2 , F(K 1 , D[0]||r 0 || D[1]||r 1 ) ⊕ F(K 1 , D[1]||r 1 || D[2]||r 2 )] (5.1) Σ = F(K 1 , R 0 ||R 1 ) ⊕ F(K 1 , R 1 ||R 2 ) = h 1 ⊕ h 2 (5.2)
A can build a document D * = D and a value r * such that the corresponding Σ * value collides with Σ even if there is no weakness in F. A way to do so consists of inserting a specific block chain in document D in order to cancel all the new values h i introduced by these repetitions as shown in Figure 5.17. It seems that the chaining structure of the Xor-Scheme should prevent this behaviour because changing or inserting a block value will affect two values h i then the tag τ will be different. These modifications have to be compensated: the values h i introduced have to be canceled by xoring the same value and all the original values h i that are deleted have to be re-introduced. We use this trick to break the claimed basic security. Adversary A Tag,Update,Verify,Reset 1 A calls Initialize.

(R 0 , R 1 ) (., .) (., .) (R 1 , R 2 ) ↓ ↓ ↓ ↓ h 1 ⊕ . . . ⊕ . . . ⊕ h 2 = Σ = 0
2 A calls the Tag oracle with a document D as input such that D = D[0]||D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D [2] and receives the corresponding authentication-tag t = (r, τ ).

(R 0 , R 1 ) (R 1 , R 2 ) ↓ ↓ h 1 ⊕ h 2 = Σ
(R 0 , R 1 ) (R 1 , R 2 ) (R 2 , R 1 ) (R 1 , R 2 ) (R 2 , R 1 ) (R 1 , R 2 ) ↓ ↓ ↓ ↓ ↓ ↓ h 1 ⊕ h 2 ⊕ h 2 ⊕ h 2 ⊕ h 2 ⊕ h 2 = Σ
D * = D[0] . . . D[i -1]|| D[i]||x||D[i]||x||D[i] ||D[i + 1] . . . D[nb] r * = r 0 . . . r i-1 || r i ||x ||r i ||x ||r i || r i+1 . . . r nb .
A variant of this forgery is to insert only a repeated document block D[i] (and r i ) is the following:

D * = D[0] . . . D[i -1]|| D[i]||D[i]||D[i] ||D[i + 1] . . . D[nb]. r * = r 0 . . . r i-1 || r i ||r i ||r i || r i+1 . . . r nb .
A more powerful forgery can be built from (D, t) by inserting any values x and y in D (and any values x and y in r ) such that:

D * = D[0] . . . D[i -1]|| D[i]||x||y||x||y||x||D[i]||x||D[i] ||D[i + 1] . . . D[nb]. r * = r 0 . . . r i-1 || r i ||x ||y ||x ||y ||x r i ||x ||r i || r i+1 . . . r nb .
For all these attacks, the underbraced chains can be repeated many times. These three attacks are some of the possible attacks, following this canceling strategy, some exotic chains can be inserted in order to end with a value τ that corresponds to a legitimate tag. A first observation is that all these attacks are performed by inserting blocks and providing a forgery D * that has the same length that the original one looks impossible or at least harder. Remark 5.2.2. It is worth noticing that this attack also breaks the IUF1-X security notions (in the SD and MD settings). Indeed, in our attack, the Tag oracle is called once, the Update oracle is not called and all the other oracles are the same in the IUF-BS and the IUF1-X security games.

Modification of the Xor-Scheme

The previous section described an attack that breaks IUF-BS and IUF1-MD securities of the Xor-Scheme by producing a document D * using a MAC query (D, t) where τ = τ * and |D| n = |D * | n . All the forgeries D * produced are longer that the original document D. One can notice that if the adversary A is only allowed to tag and verify documents that have the same length nb then the attack presented in Section 5.2.2.2 will fail. A first naive idea is to force all documents to have the same length (documents that are too small can be padded in the MAC algorithm) but this solution is not realistic and the incremental property will be lost. A natural way to fix this flaw is to use the document length nb for the computation of the value τ in order to make it size dependent. The size can be expressed according to any units: number of bits, bytes, blocks. Choosing the number of blocks nb is sufficient. A suffix block containing the number of blocks nb can be added at the end of the document then the computation of the value Σ will become:

F K 1 F K 1 F K 1 F K 1 F K 2 τ nb D[0] D[1] D[2] D[3] D[nb-1] h 1 h 2 h 3 h 4 h nb r 0 || R 0 r 1 || R 1 r 2 ||
Σ = F(K 1 , D[0]||r 0 || D[1]||r 1 )⊕F(K 1 , D[1]||r 1 || D[2]||r 2 )⊕• • •⊕F(K 1 , D[nb-1]||r nb-1 || r nb ||nb)
The last block works as a mask for each value τ : incremental operation will refresh the last random value r nb in order to have a different mask value for any modification. As a consequence, the pseudorandom permutation P is not necessary anymore (τ = Σ), it is removed in the modified scheme (Figure 5.20).

The last random block value r nb (concatenated with the document length nb) is necessary otherwise the corresponding h nb value can be canceled. If it is omitted, the following attack is indeed possible:

1. A calls the Initialize oracle. The couple (D * , r * ) is a forgery: it is not in the list DL of tagged document and it has a valid tag. To avoid such attacks, for incremental operations the last random block (concatenated with the document length) needs to be always refreshed. To be sure that none of the previous attacks are practical, an independent key is used to process the last couple (R nb-1 , R nb ). That way, it would be hard for an adversary to make a forgery from a linear combination of tagged documents. This version of the Xor-Scheme is the subject of the next section.

MXS Construction

We give here the description of the patched XS, called in the following Modified Xor-Scheme MXS, and we prove its security in the IUF-BS security model.

Description of MXS

The MXS is a probabilistic scheme, we have a random space MXS.RS from which the random data blocks are randomly sampled. MXS is stateless then the Initialisation algorithm MXS.init is omitted (e.g. the state st is empty). It is defined as follows: MXS = (KS, BS, DS, RS, kg, tag, upd, ver).

• MXS is based on a pseudorandom function family F = (KS, Dom, Rng, eval) such that F : F.KS × F.Dom → F.Rng. It follows that F.Dom = MXS.RS 2 × MXS.BS 2 and F.Rng = {0, 1} t where t is the tag size.

• The key generation algorithm MXS.kg is a probabilistic algorithm that takes no input and returns a key K ∈ MXS.KS such that MXS.KS = F.KS 2 .

• The tagging algorithm MXS.tag takes as inputs the key K ∈ MXS.KS, a document D ∈ MXS.DS and outputs a tag t := (r, τ ). Similarly to the XS scheme, for each document block D[i] ∈ MXS.BS, a random block value r i ∈ MXS.RS is randomly sampled and its bit length is denoted MXS.rl. The concatenation of these values is denoted R i := D[i]||r i . Each couple (R i-1 , R i ) is processed by the function F K 1 . The concatenation of the last value R nb and the number of blocks nb encoded as an -bit block is processed by a pseudorandom permutation function F K 2 with a different key K 2 . Then the output values denoted h i are bitwise Xored to give the value τ .

• The Verification algorithm MXS.ver takes as inputs the key K ∈ MXS.KS, the document D and the tag t := (r, τ ). It re-computes the value τ from the inputs r and D. It returns 1 if this value is equal to the input τ and 0 otherwise.

• The Update algorithm MXS.upd takes as inputs the key K ∈ MXS.KS, the document the operation op ∈ OpCodes where OpCodes = {I, D}, the set of argument arg and the tag t. The argument arg is composed by the position i where the block value has to be inserted or deleted and the new document block x ∈ MXS.BS to insert or ε if it is a delete operation: arg = i, x .

Contrary to XS, the MXS scheme is based on two pseudorandom functions F K 1 and F K 2 with independent keys but it does not rely on a pseudorandom permutation. The details of the MXS scheme is given in Figure 5.16.

Complexity. The modified Xor-Scheme is slightly slower than the original one. For the tag and the incremental operations the P call is removed but a call to the function F K 2 is added as shown in Figure 5.21. The delete D and insert I operations are slightly slower because of the last block update: the last value R i depending on the document length has to be removed and the a new value R i with the new document length nb is added.

Other Solutions. In the original Xor-Scheme (Figure 5.15), the document length can be added differently in the algorithm (but still with a random value r nb ):

1 Before the last operation P 2 (K 2 , Σ), an intermediate operation P

Security Proof

The security proof follows the proof strategy used in [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF] for proving the security of XMAC.

Information theoretic case. As in [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF], we first consider the case where the two underlying PRFs F K 1 and F K 2 are replaced by two truly random functions f 1 and f 2 from {0, 1} 2 to {0, 1} L . We consider an unbounded adversary and the following theorem claims the security of this modified scheme in the information theoretic case. More precisely, it provides an absolute bound on the success of the adversary in terms of the number of oracle queries it makes.

Theorem 5.2.3. Let A be any (computationally unbounded) an IUF-BS-adversary making a (q t , q v , q upd )-attack against the Modified Xor-Scheme with two functions picked uniformly at random from F * (D, R) such that D = {0, 1} 2 and R = {0, 1} L . The probability that A is successful is at most

Adv IUF-BS MXS (A) ≤ q 2 • 2 n-+ q v • (nb 2 • 2 n-+ 2 -L ).
Here, q t is an upper bound on the number of tagging queries, q upd is an upper bound on the number of update queries (such that q = q t + q upd ), q v is an upper bound on the number of verification queries and nb denotes the maximal block-length of the documents authenticated in the security game.

We will compute the probability of the event that A's forgery is valid conditioned on the event that the authentication queries made by A are on the documents D 1 , . . . , D q , use the random coins (r 1 , . . . , r q ) and result in the tags (τ 1 , . . . , τ q ). More precisely, we will show that this probability is upper-bounded by nb 2 • 2 n-+ 2 -L (and since the bit-strings (D 1 , . . . , D q ), (r 1 , . . . , r q ) and (τ 1 , . . . , τ q ) are arbitrary, we will get the result by standard conditioning arguments).

We consider a possible forgery output by A and we denote D q+1 the corresponding document, r q+1 the used randomness and τ q+1 the tag. It is worth noting that the pair (D q+1 , r q+1 ) is different from all pairs (D i , r i ) for all i ∈ {1, . . . , q} (since otherwise, this is not an actual forgery) but we cannot assume that the last block of r q+1 is different from the last blocks of all previous random values r i for all i ∈ {1, . . . , q} (since A may choose it arbitrarily and it can reuse a value obtained in a previous authentication query).

For i ∈ {1, . . . , q + 1}, we denote D i [j] for all j ∈ {1, . . . , nb i }, the j-th block of the document D i and similarly r i [j] for all j ∈ {1, . . . , nb i + 1}, the j-th block of the randomness r i . As in [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF], we consider the matrix B with q + 1 rows and 2 2 +1 columns over F 2 = {0, 1} where the entry in row i ∈ {1, . . . , q + 1} and column j ∈ {1, . . . , 2 2 +1 } is defined as follows:

• for j ∈ {1, . . . , 2 2 }, the entry is equal to 1 if j is the index of the 2 -bit string

(D i [nb i ]||r i [nb i ]||nb i ||r i [nb i + 1]
) in lexicographic order (and 0 otherwise).

• for j ∈ {2 2 +1, . . . , 2 2 +1 }, the entry is equal to 1 if j-2 2 is the index of the 2 -bit string

(D i [k]||r i [k]||D i [k + 1]||r i [k + 1]
) in lexicographic order for some k ∈ {1, . . . , nb i -1} (and 0 otherwise).

In other words, the matrix B contains a 1 on the row i for i ∈ {1, . . . , q + 1} only at positions corresponding to bit-strings of length 2 used as inputs to the random functions f 1 and f 2 in the modified Xor-Scheme (where the left part consisting of the first 2 2 columns of the matrix corresponds to the unique input of f 2 and the right part corresponds to all inputs to f 1 ).

We have the following lemma: ) is different from all (nb i , r i [nb i + 1]) for i ∈ {1, . . . , q}, then the matrix B is in echelon form (in its left part) and is thus trivially of full rank. Otherwise, we assume that r q+1 [nb q+1 + 1] is equal to some r i [nb i + 1] and if nb q+1 = nb i (the last block of randomness of A's forgery is equal to the last block of randomness of the i-th authenticated message and the block-length of these two messages are equal). It is worth noting that there exists only one index i ∈ {1, . . . , q} such that this is the case (since we assume that these last blocks of randomness are all different). For this i-th document, the random blocks r i [j] for j ∈ {1, . . . , nb i } are all different with a probability of at least 1 -nb 2 i • 2 n-≥ 1 -nb 2 • 2 n-by Lemma 5.2.2. Since the pair (D q+1 , r q+1 ) is different from (D i , r i ) and since the pairs (D i [k], r i [k]) are all different for k ∈ {1, . . . , nb i } (with a probability of at least 1 -nb 2 • 2 n-), we can apply Lemma 5.2.1 to the sets (of the same length nb i = nb q+1 ):

{D i [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||r i [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D i [2]||r i [2], D i [2]||r i [2]||D i [3] ||D [2] is added to the list. The document D * is not in the list DL. A game where the tag and the document can be tampered with is a strong security game that is hard to achieve.

MXS Construction

In this section we prove that the MXS scheme achieves IUF2-SD-security. The security proof follows closely the IUF-BS-security proof of MXS (Theorem 5.2.3 and Theorem 5.2.4).

Information theoretic case. As above, we first consider again the case where the two underlying PRFs F K 1 and F K 2 are replaced by two truly random functions f 1 and f 2 from {0, 1} 2 to {0, 1} L . We consider an unbounded adversary and the following theorem claims the security of this modified scheme in the information theoretic case. Theorem 5.3.1. Let A be any (computationally unbounded) IUF2-SD-adversary, in the single-document setting, making a (1, q v , q upd )-attack against the MXS with two functions picked uniformly at random from F * (D, R) such that D = {0, 1} 2 and R = {0, 1} L . The probability that A is successful is at most

Adv IUF2-SD MXS (A) ≤ q 2 • 2 n-+ q v • (nb 2 • 2 n-+ •2 -L ).
Here the number of tagging queries is exactly 1 (single-document setting), q upd is an upper bound on the number of update queries (such that q = 1 + q upd ), q v is an upper bound on the number of verification queries and nb denotes the maximal block-length of the documents authenticated in the security game. Theorem 5.3.1 (Sketch.) As in the proof of Theorem 5.2.3, since the adversary A is computationally unbounded we may assume without loss of generality that it is deterministic. The probabilistic choices in A's attack on the scheme are thus the initial choice of f 1 and f 2 of the random functions in F * ({0, 1} 2 , {0, 1} L ) and the choices of random coins made by the authentication oracles in the security game. We assume (again without loss of generality) that A makes exactly q = q t + q upd authentication queries (either as a direct tagging query or as an update query with the insert or the delete operations). Again, there is no loss of generality to assume that A makes all its authentication queries and then makes exactly one verify query (for its purported forgery). We prove that in this case the probability of the event (denoted Succ) A's forgery is valid is upper-bounded by

q 2 • 2 n-+ nb 2 • 2 n-+ 2 -L .
We consider again the event (denoted Distinct) where all the random coins used in the last block of each authenticated document are different. We have Pr[Succ] ≤ Pr[Succ|Distinct] + q 2 • 2 n-. and it remains to upper-bound Pr [Succ|Distinct].

A priori, we cannot consider a sequence of q documents D 1 , . . . , D q corresponding to all documents authenticated in the security game by some authentication queries since the adversary can query the Update oracle on invalid tags and therefore obtain invalid tags. However, we can adapt the previous argument in the IUF2-SD setting.

After querying the Tag oracle on a first document D 1 , the adversary will query the Update oracle times on several documents D * 2 , . . . , D * q (where D * j is made of nb j blocks of n bits for j ∈ {2, . . . , q}), with corresponding claimed tags t * 2 , . . . , t * q and some operation (deletion or insertion) on the blocks i 2 , . . . , i q (respectively) with t * j = (r * j , τ * j ) and i j ≤ nb j for j ∈ {2, . . . , q}.

The documents D * 2 , . . . , D * q , the randomness r * 2 , . . . , r * q and the tags τ * 2 , . . . , τ * q are chosen arbitrarily by the adversary. After the query to the Update oracle, the adversary will obtain a new tag t j = (r j , τ j ) such that r j is modified in its last block and one block of randomness is added or removed (depending of the performed operation) and τ j = τ * j ⊕ X j where X j depends (at most) on the documents blocks D * j [i -1], D * j [i], D * j [i + 1] and D * j [nb j ], the random blocks r * j [i -1], r * j [i] and r * j [i + 1] and r * j [nb j ] and the new last block of r j . Since the queried tags are not verified, we can assume without loss of generality that the adversary queries always use values τ * i = 0 L for j ∈ {2, . . . , q} (and thus that it gets τ j = X j as a part of the response to its query). The value τ j is then equal to XOR of at most five values of the underlying random functions, namely two values of f 2 and one or three values of f 1 :

• If the j-th query for j ∈ {2, . . . , q}, corresponds to insertion at the first position of D * j of the block D , the Update will pick uniformly at random two blocks of randomness r and r , compute

τ j = f 1 (D r || D * j [0] r * j [0]) ⊕ f 2 (D * j [nb j ] r * j [nb j ] || nb r * j [nb j + 1]) ⊕ f 2 (D * j [nb j ] r * j [nb j ] || nb j + 1 r )
and output (r ||r * j [0]|| . . . ||r * j [nb j ]||r , τ j ) as the new authentication tag.

• If the j-th query for j ∈ {2, . . . , q}, corresponds to insertion at the p-th position of D j of the block D , the Update will pick uniformly at random two blocks of randomness r and r , compute By our assumption on the distinctness of the random values in the last block, we have the following lemma whose proof is identical to the one of the corresponding lemma in in the proof of Theorem 5.2.3: Lemma 5.3.1. The matrix B has full rank with a probability of at least 1 -nb 2 • 2 n-.

τ j = f 1 (D * j [p] r * j [p] || D r ) ⊕ f 1 (D r || D * j [p + 1] r * j [p + 1]) ⊕ f 1 (D * j [p]
The claimed bound follows from this lemma for general adversaries as in the proof of Theorem 5.2.3.

Computational case. If we replace the (truly) random functions by pseudorandom functions in the previous result, we obtain readily the following computational security result: Theorem 5.3.2. Let F = (KS, Dom, Rng, eval) be a pseudorandom function family such that F.Dom = {0, 1} 2• and F.Rng = {0, 1} L . Let A be any adversary making a (1, q v , q upd )-attack against the modified Xor-Scheme with two functions picked uniformly at random from F and running in time λ. There exist an adversary B against the pseudorandomness property of F that makes q = q • t queries to F, runs in time λ = λ + O(q ( + L)) such that

Adv IUF2-SD MXS (A) ≤ Adv prf F (B) + (q 2 + nb 2 ) • 2 n-+ 2 -L .
Here, the number of tagging queries is exactly 1, q upd is an upper bound on the number of update queries (such that q = 1 + q upd ), q v is an upper bound on the number of verification queries and nb denotes the maximal block-length of the documents authenticated in the security game.

Proof. (Theorem 5.2.4) The proof is identical to the proof of [BGR95, Theorem 4.2] and is left to the reader.

Remark 5.3.2 (Multi-document security). The MXS scheme is IUF2-SD and combining it with the transform SDtoMD 1 given in Section 5.1.4, we have a IUF2-MD secure scheme.

Remark 5.3.3 (Compressed version of MXS).

The MXS is a strongly incremental MAC that achieves IUF-BS and IUF2-SD security but it requires to generate an MXS.rl-bit random value per document block and it has an impact on the tag length which is equal to nb • MXS.rl + t bits for a an nb-block document. We can modify MXS in order to have smaller tag by using a counter ctr. Let consider a MXS scheme where each block value r is equal to F K 3 (ctr) where ctr is the counter and has a smaller bit-length (|ctr| ≤ |r|) and F = (KS, Dom, Rng, eval) a pseudorandom family such that F .Dom = {0, 1} |ctr| and F .Rng = {0, 1} MXS.rl . In practice, the length MXS.rl should be at least 128 bits whereas a counter of 32 bits in reasonable8 . Then the tag contains the values of the counter used to process each block (the tag length becomes nb • |ctr| + t ). However, this change make the MXS stateful (the counter has to be in the state to be sure that the adversary cannot tamper with it) and requires a third key for F .

Conclusion.

In this chapter, we revisit incrementality for MACs by first, giving a definition of an incremental MAC with a specific syntax in order to encompass their variety and their complexity. The security notions present in the literature, namely the basic security and the tamper-proof security, are analysed: a security game is provided for the first one whereas tamper-security proof seems to be a more vague and complex notion. This is the reason why we define the security notion IUF2-X, inspired by the tamper-proof security, that is close, in the single (X = SD) and multi-document (X = MD) setting. Another security notion IUF2R-X, were replay attacks are taken into account, reinforces the IUF2-X security notion.

The relationships between all those security notions, represented in Figure 5.9, help to analyse the security of incremental MACs. Moreover, we showed that the XS [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF] does not provide the claimed basic security: a forgery can be easily built from any tag by inserting specific document block chains to a legitimate document and the corresponding random value chains to the legitimate random value. We proposed the MXS that is not vulnerable to these attacks and we proved its security not only in the IUF-BS model but also in the IUF2-SD models. From this scheme, a IUF2-MD-secure scheme using the transform SDtoMD 1 can be built 9 . Still from the MXS, a stateful scheme IUF2R-X-secure against replay attack can be built using a counter 10 . The XMAC is also analysed but it provides only basic security; we give attacks in the IUF2-X security model.

The MXS scheme is the only secure strongly incremental algorithm and it is secure in a strong security model but unfortunately it has drawbacks that make it unpractical: it needs to generate a lot of randomness (around one random block for one document block) which slows down the algorithm; and the tag length is much bigger than standard MACs due to the storage of all the random blocks essential for the tag verification (even if it can be modified to have a smaller tag by using a counter as explained in Remark 5.3. 3). An open problem is to find an incremental MAC producing smaller tags and achieving the same security notion. Obviously, the MXS is not suitable as a global MAC (as defined in 2.3.2) due to those drawbacks.

Conclusion

The work presented in this thesis aims at analyzing the security of blockciphers in the context of Full Disk Encryption. In order to go beyond the barrier of deterministic algorithms, in the very constrained model of Full Disk Encryption, we introduced the concept of diversifier which is, in a word, a random value or a nonce provided by the systems for free, in the sense that it was not meant to be used for data protection and it is not stored.

In addition, we gave the analysis of blockciphers in a strong security model, the Key-Dependent Message security model, where it is possible to encrypt the encryption key itself or more generally a function of this key. This model is of interest in the FDE context where the encryption key, a part of it or a more complex function of the key may be stored in the disk. We also introduced two techniques to analyse blockciphers security in the KDM setting: the Splitting and Forgetting technique and a KDM adaptation of the well known H-coefficient technique. We most notably showed that the Even-Mansour and Key-Alternating Feistel ciphers with the same key and same permutation/function will never achieve the same security level that the ideal cipher in this context (namely, KDM security for a claw-free set of functions) and this holds for any number of rounds. Therefore, if the keys are independent, the KDM set is less and less constrained when increasing the number of rounds as shown by the analysis of the 1-and 2-round Even-Mansour ciphers (we conjectured the KDM security of the 3-round version).

Observing the limits of the FDE model, we took into account two models where metadata storage is possible: the ADE model which does not prevent replay attacks, and the stronger model FADE that does. These ideas are natural and an ADE mechanism is already implemented in the Linux kernel for instance (dm-integrity tool). However, using standard MACs to achieve FADE security has a huge impact on performances. The read and write delays on the disk are crucial as they have a direct impact on the whole system and cryptographic operations, encryption/decryption and tag generation/verification, has to be as fast as possible. This is the reason why the incremental MACs were investigated: we revisit existing security notions and give new ones (some of them consider replay attacks) to understand how much incremental MACs can be secure. We also gave a basic security attack on the Xor-Scheme [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF] which was the only strongly incremental MAC and we proposed a patched version. Unfortunately, achieving strong incremental security (stronger than basic security) has a cost in terms of storage.

-145 -

Definition 1 . 3 . 1 .

 131 (Functions) The set of all functions D → R is denoted F * (D, R) where the domain D and the range R are non-empty sets.

Figure 1 . 1 :Definition 1 . 3 . 5 .

 11135 Figure 1.1: (Right) Game for defining the prf-advantage of pseudorandom family functions F.(Left) Game for defining the strong prp-advantage of pseudorandom permutation family P.

Figure 2 . 1 :

 21 Figure 2.1: Simplified view of components involved in disk encryption.

  Figure 2.1, a dedicated protocol conveys read and write commands at the physical layer level. Such commands are limited to a fixed size data unit called a sector. The low-level driver is consequently in charge of sector-based read and write operations. The Parallel ATA (PATA) and Serial ATA (SATA[Del09]) standards are examples of such protocols, and are commonly used as classical disk interfaces.

Figure 2 . 2 :

 22 Figure 2.2: Simplified logical levels: from files to sectors. MD stands for Meta-data.

Figure 2 . 3 :

 23 Figure 2.3: HDD tracks and view of a sector.

Figure 2 . 4 :

 24 Figure 2.4: Hierarchically organized SSD memory

Figure 2 . 5 :

 25 Figure 2.5: Disk where memory is on platters for HDD and are flash cells for SSD.

Figure 2 . 9 :

 29 Figure 2.9: Disk Encryption and local authentication tag within each sector. Dashed boxes represent encrypted data and hatched boxes tags. AE stands for Authenticated Encryption.

Figure 2 .

 2 Figure 2.10: Interleaved Meta-data. Large dashed boxes represent encrypted data and small dashed boxes meta-data.

Figure 3 . 3 :

 33 Figure 3.3: Description of the CBC-ESSIV and IGE-ESSIV modes of operation where E is a blockcipher and the keys K and K are independent.

Figure 3 . 4 :

 34 Figure 3.4: Description of the XEX mode of operation where E is a blockcipher and K and K are independant keys.

Figure 3 . 6 :

 36 Figure 3.6: Description of the TC3 mode of operation where Ẽ is a tweakable blockcipher.The tweak can be the sector number s.

Definition 3 . 1 . 1 (

 311 ||...||m[nb] where || denotes concatenation of strings. IND-CPA-xx corresponds to IND-CPA up-to-block, IND-CPA up-to-prefix, IND-CPA up-to-repetition and IND-CPA. FDE scheme). A blockcipher-based FDE scheme is a 7-tuple of parameters and algorithms FDE = (KS, SS, BS, MS, kg, enc, dec) such that:

Figure 3 .

 3 Figure 3.10: Game "up-to-repetition" for the IND-CPA-repetition security notion.

Figure 3 .

 3 Figure 3.11: Game "up-to-prefix" for the IND-CCA-prefix security notion.

  2.1. IGE-ESSIV. Theorem 3.2.2 states that the mode IGE-ESSIV achieves IND-CPA-ufb security and the security proof is given in Section 3.2.2. The TC1, TC2, TC3 and WTBC constructions become IND-CPA with the ufb restriction because TC1/2/3 were IND-CPA up-to-prefix and WTBC constructions were IND-CPA up-to-repetition as explained in Section 3.1.2.

Figure 3 .

 3 Figure 3.13: Games G 3 , G 4 and G 5 CBC-ESSIV IND-CPA-ufb. The framed statement is included in game G 3 only. The statement overlined in gray is included in game G 5 only.

Figure 3 .

 3 Figure 3.14: Games G 1 to G 4 for IGE-ESSIV IND-CPA-ufb

Figure 4 . 1 :

 41 Figure 4.1: The Even-Mansour cipher (1-round).

Figure 4 . 2 :

 42 Figure 4.2: Descriptions of the round function of Feistel Network (Left) and the one round KAF (Right).

Figure 4 . 3 :

 43 Figure 4.3: KDM-CCA analysis for 2-round Even-Mansour.

Figure 4 . 4 :

 44 Figure 4.4: Game defining KDM-CCA security for a blockcipher.

Figure 4 . 5 :

 45 Figure 4.5: Game defining oracle splittability with respect to relation sp.

Figure 4 . 6 :

 46 Figure 4.6: Game defining forgetful switching property.

Theorem 4 . 1 . 1 .Game 1 :Game 2 :

 41112 Let OSp be a lazily samplable oracle. Let fg (resp. sp) be, by slight abuse of notation, the event that D triggers the check fg (resp. sp) in the m-Split game. Then for any D in the modified split game we have a D such that Adv m-split OSp (D) ≤ Adv split OSp (D)+2•Adv forget OSp (D )+Pr[D sets fg|b = 1]+Pr[D sets sp|b = 1] . Proof. The proof follows 6 games hops and applies the fundamental lemma of game playing as follows. Below, we let G i be the event that D outputs b = 0 in game i: Pr[G D i ] = Pr[b = 0]. Game 0 : This is the m-Split D OSp game with b = 0 (i.e., with respect to oracles (O, O)): Pr[G D 0 ] = Pr[m-Split D OSp |b = 0]. In this game we introduce the sp check. This only increases the probability that b = 0: Pr[G D 0 ] -Pr[G D 1 ] ≤ 0. In this game we use an independent oracle O for the challenge oracle. A direct reduction shows that: Pr[G D 1 ] -Pr[G D 2 ] ≤ Adv split OSp (D).

Game 3 :Game 4 :Game 5 :

 345 In this game, we drop the sp check. Note that this game is identical to m-Split D OSp game with b = 1. This game and the previous one are identical until a flag sp 3 corresponding to check sp is set: Pr[G D 2 ] -Pr[G D 3 ] ≤ Pr[D sets sp 3 |b = 1]. In this game, we introduce the fg check. This only increases the probability that b = 0: Pr[G D 3 ] -Pr[G D 4 ] ≤ 0. In this game, we use a forgetful oracle $ for the challenge oracle. Since O is assumed to be lazily samplable (and O and $ are independent of O ) via a direct reduction and simulation of O we get that for some D : Pr[G D 4 ] -Pr[G D 5 ] ≤ Adv forget OSp (D ). Game 6 : Finally, we drop the fg check. This game and the previous one are identical until a flag fg 6 is set: Pr[G D 5 ] -Pr[G D 6 ] ≤ Pr[D sets fg 6 |b = 1

Figure 4 .

 4 Figure 4.7: Two-stage adversaries and their operation in the split game.

Figure 4 .

 4 Figure 4.8: Algorithm B used for KDM analysis of the ideal cipher.

Figure 4 .

 4 Figure 4.14: Real world rw and ideal world iw defining KDM-CCA-security and perfect world pw used in Lemma 4.3.2.

Figure 4 .

 4 Figure 4.15: The r-round Key-Alternating Feistel (KAF).

Figure 4 .

 4 Figure 4.16: (left) In red, collisions giving a bad transcript (Condition C-i). (Right) In red,for a good transcript τ , F is bad if the inputs w i and z i collide with any other input of F (conditions C'-i).

Lemma 4 . 4 . 3 .

 443 Fix a good transcript τ

Figure 4 .

 4 Figure 4.17: Details of the Sliding attack on 4-round KAF (same keys and same round function).

Figure 4 .

 4 Figure 4.18: Notations for Sliding attack.

Figure 5 . 1 :

 51 Figure 5.1: Examples of edit operations.

Figure 5 . 2 :

 52 Figure 5.2: Games defining Correctness and Consistency for nonce-based incremental authentication scheme iMA for the single-document setting.

Figure 5 . 4 :

 54 Figure 5.4: Games defining IUF-BS security of an incremental authentication scheme iMA.

  corresponding security games are given in Figure5.5.

Figure 5 . 7 :

 57 Figure 5.7: Game defining IUF2 security of an incremental authentication scheme iMA in the Single-Document (SD) and in the Multi-Document (MD) settings. The boxes are excluded from the SD game.

Figure 5 . 8 :

 58 Figure 5.8: Game defining IUF2R security of an incremental authentication scheme iMA in the Single-Document (SD) and in the Multi-Document (MD) settings. The framed boxes are excluded from the SD game.

  [ G 0 ] = Pr G IUFxy-MD iMA2 and Pr [ G 2 ] = Pr G IUFxy-MD iMA1

Figure 5 .

 5 Figure 5.14: Description of the XMAC where v is a random value for XMACR and v is a nonce for XMACC.

Figure 5 .

 5 Figure 5.15: Description of the Xor-Scheme

Figure 5 . 4 ,

 54 Figure 5.4, the adversary A wins the game if it finds a new pair (D * , t * ) such that the verification operation returns 1. If an adversary has access to any tag t (such that t = (r, τ )) returned by the tag algorithm on a document D (for example D[0]||D[START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D[2]), it can forge a different document D * having the same value τ . The value τ is computed as follows:

Figure 5 .

 5 Figure 5.17: Xor cancellation strategy in the Xor-Scheme

Figure 5 .

 5 Figure 5.18: Σ computation for 3 block document

Figure 5 .

 5 Figure 5.19: Attack on the Xor-Scheme. Here R i = D[i]||r[i].

Figure 5 .

 5 Figure 5.20: Description of the fixed Xor-Scheme

2 .Figure 5 .

 25 Figure 5.21: Complexity of the Xor-Scheme XS and the Modified Xor-Scheme MXS.

2

  3 (K 3 , r nb ||nb || Σ) can be added such that τ = P 2 [K 2 , P 3 (K 3 , r nb ||nb || Σ)].The block length can be processed individually as a last block such thatτ = P 2 [K 2 , P 3 (K 3 , r nb ||nb) ⊕ Σ].

Lemma 5 . 2 . 3 .

 523 The matrix B has full rank with a probability of at least 1 -nb 2 • 2 n-. Lemma 5.3.1. The proof is similar to the proof of[START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF] Lemma A.3]. If the pair (nb q+1 , r q+1 [nb q+1+ 1]

2 = 3 =

 23 ||r i [3], . . . , D i [nb i -1]||r i [nb i -1]||D i [nb i ]||r i [nb i ]}4. B calls the Update oracle giving as inputs the document D 1 , the operation R, the argument D[START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] , 1 and the tag t 2 . It receives the tag t 3 .5. B calls once again the Update oracle giving as input the document D 1 , the operation R, the argument D[2] , 2 and the tag t 3 . It receives the tag t 4 .6. B calls the Finalize oracle giving as input the document D * such that D * = D[START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] ||D[2] and the tag t 4 .The document list DL is filled as follows:[2] during Tag call, the documentD DL 1 = D[1]||D[2];[3] during the first Update call the document D DL D[START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] ||D[2];[4] during the second Update call, the document D DL D[START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] ||D[2] and[5] during the last Update call, the document D DL 4 = D[START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]

9

  Details given in Remark 5.3.2 10 Details given in Remark 5.

  . Disk sectors are now dedicated to store actual data (D d sectors) and local tags (D la sectors) for solution (3) but this additional data estimation cost is applicable for all solutions. We have D s = D d + D la where D s is the total number of sectors. Let τ s be the tag size and S s the sector size. The maximum number of tags a sector can store is T S = S s /τ s . Then we have D la = D d /T S and D d = (T S × D It is important to keep in mind that this estimation does not consider journals.

	the disk. AE(k, i, p i ) p 0 p 1	c 0 c 1	t 3 t 0
	p i		c i
	pn
			cn
				tn
	Plain sectors	Encrypted and tagged sectors
				s )/(T S + 1) which means that
	the data sectors represent (100 × T S)/(T S + 1) percent of the disk and local tags represent
	100/(T S + 1) percent. For a disk with a sector size of 4096 bytes (S s = 2 12 Bytes) where
	1 Terabyte (2 40 Bytes) of actual data are stored, we have D d = 2 40-12 sectors. Let's take
	the example of the following generic composition: the encryption primitive is AES-XTS
	encryption where the tweak is the sector number and the MAC primitive is HMAC-SHA-256.
	The HMAC is computed over the concatenation of the ciphertext and the sector number to
	avoid reordering attacks. The local tag size per sector data is 32 Bytes which corresponds to
	the tag produced by HMAC-SHA-256 (τ s = 2 5 Bytes). Then a sector stores 128 local tags
	(T S = 2 7 ) which gives D la = 2 28-7 sectors (8 GB). Additional data represent only 0,8% of

Table 2 .

 2 1: Operation and Storage costs of incremental MACS for n-block input. The column L is for Locality property.

		Tag Replace Verify Storage L
	Chaining XS	n	4	n	1	N
	Xor-MAC	n + 1	2	n + 1	1	N
	Merkle tree	n	log(n) log(n)	n	Y

  13 of the concatenation of its children. In the following, Merkle trees are binary trees which means that each node is the MAC of its two children. This construction is used to ensure data authenticity at block level [OR05, HGX + 09, HWF15, dm-19b], in cloud storage context [OR07, HPPT08, CJK + 17] and at file level[START_REF] Rogers | Using address independent seed encryption and bonsai merkle trees to make secure processors os-and performance-friendly[END_REF] due to its incremental and locality properties. For a disk of n sectors, Merkle tree leaves are the n local tags where

	0
	m
	n
	Figure 2.12: Perfect Merkle tree of n levels. Nodes of level m only are stored (m ≤ n ).

Table 2 .

 2 2: Estimation of Stand-alone storage of Merkle tree with n actual data sectors where n = 2 n . Up/Ver stands for update and verify cost.

Table 2 .

 2 5: Evaluation of the Hybrid storage of Merkle tree with n = 2 28 , m = 15, L = 32 Bytes.

		H1	H2	H3	H4	H5
	Up/Ver 8207	8191	13	13	28
	RAM	-	-	8 GB	-	8 GB
	Disk	2 MB	0	0	8 GB 2 MB
	SM	32 B 1 MB 1 MB 1 MB 32 B

Table 2 .

 2

		H1	H2	H3	H4	H5
	Up/Ver	32	7	3	3	28
	RAM	-	-	6 GB	-	6 GB
	Disk	2 GB	0	0	6 GB 2 GB
	SM	32 B 1 GB 1 GB 1 GB 32 B

6: Evaluation of the Hybrid storage of Merkle tree with n = 2 28 , m = 25, L = 32 Bytes.

2 FDE Security with Unique First Block

  . . . . . . . . . . . . . . . .

Contents 3.1 Disk encryption methods and Security notions . . . . . . . . . . . . 3.1.1 Disk Encryption Methods . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 Security Notions for FDE . . . . . . . . . . . . . . . . . . . . . . . 3.3.2.1 CBC-ESSIV Security . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 IGE-ESSIV Security . . . . . . . . . . . . . . . . . . . . . . . . . . 3.

3 FDE Security with a Diversifier

  . . . . . . . . . . . . . . . . . . . . .

3.3.1 Solid State Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 Case Studies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Table 3 .

 3 1: The security of FDE modes of operation when no diversifier is used. Here, means that there is a security proof, and means that there is an attack. Proofs of the security results can be found in Section 3.1.1. XTS: see[START_REF]IEEE Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices. IEEE Std 1619-2007[END_REF]. TC1, TC2 and TC3[START_REF] Rogaway | Online ciphers from tweakable blockciphers[END_REF] are generalizations of the HCBC1 [BBKN12], HCBC2[START_REF] Bellare | and Chanathip Namprempre. On-line ciphers and the hash-CBC constructions[END_REF] and MHCBC[START_REF] Nandi | Two new efficient CCA-secure online ciphers: MHCBC and MCBC[END_REF] constructions. WTBC: wide tweakable blockcipher. The symbol indicates that the property holds for some constructions, but not for others. Here, x ≥ log 2 ( ) where x is the bit-size of the counter.

	ECB CTR CBC CBC IGE XTS TC1 TC2/3 WTBC
	IV → n/a s	x s E K (s) E K (s) s	s	s	s
	IND-CPA-block
	IND-CPA-prefix
	IND-CPA-repetition
	IND-CPA
	IND-CCA-block
	IND-CCA-prefix
	IND-CCA-repetition
	IND-CCA
	online enc./dec.
	parallelizable enc.
	parallelizable dec.
	rized in

Table 3 .

 3 1. The properties shown in the three last lines of Table 3.1 are relevant implementation properties but are not taken into account in the security proofs. ECB mode. Unsurprisingly, ECB is not IND-CPA for any of our three security notions. CTR mode. CTR is not IND-CPA for any of our three security notions. An adversary can simply query the encryption of m[1] = 0 n ||m[2]||..||m[nb] and m[2] = 1 n ||m[2]||..||m[nb] for the same sector number s (where m

  and 1 otherwise.The equality c 3[2] = c 1[2] is always satisfied in the real world but holds only with probability 2 -n in all three random worlds. IGE-ESSIV mode. The previous attack on the CBC-ESSIV mode can easily be adapted to show that IGE-ESSIV is not IND-CPA for any of our three security notions. The attack is identical except that the adversary A checks whether the equality c 3[2] = c 1 [2] ⊕ 1 n holds or not. XTS mode. As explained above, in XTS every plaintext block is encrypted separately using a tweakable blockcipher, where the tweak is derived from the sector number and index of the block within the sector. As argued by Rogaway[START_REF] Rogaway | Evaluation of Some Blockcipher Modes of Operation[END_REF], XTS is IND-CPA up-to-block secure. For syntactic reasons, it is not IND-CPA up-to-prefix nor IND-CPA up-to-repetition. TC1, TC2, TC3 modes. Rogaway and Zhang[START_REF] Rogaway | Online ciphers from tweakable blockciphers[END_REF] showed that TC1 is IND-CPA up-to-prefix secure but not IND-CCA up-to-prefix. They also proved that TC2 and TC3 are IND-CCA up-to-prefix (and thus also IND-CPA up-to-prefix) secure. For syntactic reasons, they are not IND-CPA up-to-block nor IND-CPA up-to-repetition. WTBC modes. Halevi and Rogaway showed that EME is IND-CCA up-to-repetition (and thus IND-CPA up-to-repetition) secure in[START_REF] Halevi | A parallelizable enciphering mode[END_REF]. For syntactic reasons, these modes are not IND-CPA up-to-block nor IND-CPA up-to-prefix.

procedure Initialize b ← ←{0, 1}; K ← FDE.kg() ; t ← 0 procedure Encrypt(s, m)

  nb•n and a sector number s and queries the Encrypt procedure with (s, m 1

  and arbitrary c 2 [i] ∈ {0, 1} n for i ∈ {3, . . . , nb} and query the Decrypt procedure with (s, c 2 ) to obtain a plaintext m 2

Table 3 .

 3 1 is always satisfied in the real world but holds only with probability 2 -n in the ideal world. 3: The security of FDE modes of operation when a diversifier is used. Here, means that there is a security proof, and means that there is an attack.

	• CBC-ESSIV and IGE-ESSIV are not secure: the attacks of Section 3.2 still apply, as
	they did not perform two encryptions with the same sector number.

• For syntactical reasons, an encryption scheme can only be IND-CCA up-to-block, IND-CCA up-to-prefix, or IND-CCA up-to-repetition. XTS is only IND-CCA up-toblock, TC2 and TC3 are only IND-CCA up-to-prefix, and WBTC are only IND-CCA up-to-repetition.

Table 3 .

 3 4: EagleTree Benchmarks for various diversifier sizes.

			diversifier size (bits)
		0	1	2	3
	read latency (µs)	28.292	28.862	31.619	40.640
	write latency (µs)	32.009	32.070	32.470	34.560
	read throughput (IOPS)	20860	20493	19050	15634
	write throughput (IOPS)	31240	31181	30797	28935
	garbage collector reads	1284043 1295530 1356043 1489623
	garbage collectorwrites	1284043 1295530 1356041 1489622
	erasures	18569	18765	19661	21634

  Suppose z 2 := (-, C). Then L 2 consists of a single backward entry. (2.1) A forward entry in L 1 with a backward entry in L 2 trigger Sp2. (2.1.1) An input in L 1 matches an output in L 2 . Since the output in L 2 is random and independent of L 1 , this happens with probability q φ /2 n . (2.1.2) An output in L 1 matches an input in L 2 . Since the outputs in L 1 are random subject to permutativity and R is random and independent of these values, this happens with probability q φ /2 n . (2.2) A backward entry in L 1 with a backward entry in L 2 trigger Sp2. This violates query-independence.

Suppose now i = 2. If z 2 = (-, * ) then L 1 = [ ]. So we assume z 2 = (+, φ 2 ). In what follows L 2 is formed first and then L 1 .

(3) Suppose z 1 := (+, φ 1 ). Then L 2 consists a single forward entry.

(

3.1) A forward entry in L 1 with a forward entry in L 2 trigger Sp2. This violates query-independence with a reduction that simply simulates R for C. (3.2) A backward entry in L 1 with a forward entry in L 2 trigger Sp2. (3.2.1) An input in L 1 matches an output in L 2 . Note that the KDM function can be chosen based on R, the output in L 2 . This violated query-independence. (3.2.1) An output in L 1 matches an input in L 2 . Since the outputs in L 1 are random subject to permutativity, and L 2 is chosen before L 1 , this happens with probability q φ /2 n . (4) Suppose z 1 := (-, C). Then L 2 consists of a single backward entry. (4.1) A forward entry in L 1 with a backward entry in L 2 trigger Sp2. (4.1.1) An input in L 1 matches an output in L 2 . Note that the KDM function can be chosen based on R, the output in L 2 . This violated query-independence. (4.1.2) An output in L 1 matches an input in L 2 . Since the outputs in L 1 are random subject to permutativity, and L 2 is chosen before L 1 , this happens with probability q φ /2 n . (4.2) A backward entry in L 1 with a backward entry in L 2 trigger Sp2. This violates query-independence. Only one of the above cases need to be considered, which justifies the final term in the advantage upper bound. Remark 4.1.1. The converse of the above theorem does not hold. The set Φ

  2 , K 2 ] uses KDM functions without xor-offsetfreeness. It is however not clear if xor-offset-freeness is indeed necessary for the general key schedule EM P,P [K 1 , K 2 , K 3 ]. (Open question and conjecture). The simplest Even-Mansour configuration, where the internal permutations are the same and keys are equal, is not KDM-secure under a claw-free KDM set. The open question is, what is the minimal configuration where the Even-Mansour Cipher is KDM secure under a KDM set that is only claw-free? We conjecture that the 3-round Even-Mansour cipher with the same permutations and independent keys is KDM-secure under a claw-free set.subsets of T such that T = T good ∪ T bad . If there exist ε bad such that Pr[X A,w 0 ∈ T bad ] ≤ ε bad and ε good such that for all τ ∈ T good

	Remark 4.2.2

  D)} return t id procedure Update(N, id , D, op, arg, t) if ( id / ∈ S or D id = ⊥ or N ∈ N id ) then return ⊥ (t id , st id ) ← iMA.upd(K, N, id , D, op, arg, t, st id ) D id ← DES.Edit(D id , op, arg) DL ← DL ∪ {( id , D id )} N id ← N id ∪ {N } return t id procedure Verify( id , D, t id ) return iMA.ver(K, id , D, t id , st id ) procedure Finalize( id , D, t id ) if ( id , D) ∈ DL then return false return iMA.ver(K, id , D, t id , st id )

  {N } return t id procedure Verify( id , D, t id ) return iMA.ver(K, id , D, t id , st id ) procedure Finalize( id , D, t id ) if ( id , D) ∈ DL then return false return iMA.ver(K, id , D, t id , st id )

  If op = I, the update algorithm enables to insert a block value in a document. It takes as argument the position i where the block value has to be inserted, the document D (the previous block value D[i -1] 5 and the block value D[i] 6 are necessary), the new block value x and the tag t. It outputs the new tag. -If op = D, the update algorithm enables to delete a block from the document. It takes as inputs the position i where the block as to be deleted, the document D (the block value to delete D[i], the previous and next block values D[i -1] and D[i + 1] are necessary) and the tag t.Specific features. The update algorithm is intuitive and given in Figure5.16 for update operations at a position different from the first block position. They can be adapted to be applied to the first block. In the original version, it is specified that a prefix and postfix are added to the document.

For a document D = D[1] . . . D[nb], the authentication tag is computed on D[0]||D[1] . . . D[nb]||D[nb + 1] where D[0] and D[nb + 1] are specific prefix and postfix values.

  r * j [p] || D * j [p + 1] r * j [p + 1]) ⊕ f 2 (D * j [nb j ] r * j [nb j ] || nb j r * j [nb j + 1]) ⊕ f 2 (D * j [nb j ] r * j [nb j ] || nb j + 1 r )and output (r * j [1]|| . . . ||r * j [p]||r ||r * j [p + 1]|| . . . ||r * j [nb]||r , τ j ) as the new authentication tag.

1.4 Our contributions

The strategy used for the initial encryption step depends on the FDE tool.

From "Evil Maid goes after TrueCrypt"

2.1 Data Protection and Data Storage

These blocks should not be confused with the blocks of the blockcipher, nor with the "block" (actually "sector") in the term Logical Block Address (LBA).

It is different from SSD pages.

iOS implements file based encryption and not full disk encryption

2.2 Full Disk Encryption

This mode is called ECB.

At the cost of extra computations over GF(2 128 ).

This is not straightforward as explained in[START_REF] Namprempre | Reconsidering generic composition[END_REF], some care must be taken.

This element usually embeds a small and persistent memory.

2.3 Data Authentication

To be more precise, Merkle tree uses a pseudo-random function which is the case of MACs.

Two distinct keys are needed: the message is encrypted with key K, and the IV is encrypted with key K = K (see Figure3.3), in order to avoid an attack by Rogaway[START_REF] Rogaway | Nonce-based symmetric encryption[END_REF].

These blocks should not be confused with the blocks of the block cipher, nor with the "block" (actually "sector") in the term Logical Block Address (LBA).

https://github.com/ClydeProjects/EagleTree

https://blogs.msdn.microsoft.com/psssql/2011/01/13/sql-server-new-drives-use-4k-sector-size/

https://docs.oracle.com/cd/E18283_01/server.112/e17120/onlineredo002.htm

This security notion roughly ensures that the construction "behaves" in some well-defined sense as an ideal cipher.

Note that we do not allow for key-dependent ciphertexts (KDC) in this work as the practical motivations are somewhat limited.

Any (A, B) with a stateful B can be modified to (A , B ) with stateless B and an A that sends the entire history of previous messages to B . This allows B to recompute the state of B. This modification, however, increases the query complexity of B, and might not preserve other properties required from B.

This attack can be generalized readily for iterated r-rounds EM construction if it uses a single random permutation and the same n-bit key for all rounds (irrelevant of the value r ≥ 2).

In all the following, we will argue using the fact that the transcript is good by referring to which specific condition defining a bad transcript would hold, saying e.g., "By ¬(C-ix), . . . ".

Actually supporting insertion and deletion is sufficient as replacement can be obtain by combining these two update operations.

Competition for Authenticated Encryption: Security, Applicability, and Robustness.

In the following DES refers to this notion and not to the Data Encryption Standard.

We consider a simple definition where the tag of the updated document belongs to the set of tags produced by the algorithm iMA.tag using the same key, the same nonce and the same state. For probabilistic incremental MACs, we could have considered a stronger consistency definition where the tag of the updated document is uniformly distributed over this set of tags.

This algorithm is probabilistic for the randomized version and deterministic for the counter-based version.

For the first position, there is no previous block.

For the last position, there is no next block.

Of course here, the number of processed blocks has to be smaller than 232

Acknowledgments

Acknowledgments vii

KDM Security using the H-coefficient technique

KDM functions. In the following, we do not consider KDM functions φ O that depend on an oracle O; we consider only oracle-free functions. Nonetheless, the adversary can have direct access to an oracle O, and he can use the answer from this oracle to build function φ. We (re)-define the KDM sets from a statistical point of view and without any adversary which is useful when using H-coefficient technique. But the underlying properties (claw-freeness, offset-freeness, offset-xor-freeness), on the KDM set remains the same. Definition 4.3.1 (Claw-freeness). Let Φ be a KDM set for key space K and message space M. The claw-freeness of Φ is defined as cf(Φ) := max

Definition 4.3.2 (Offset-Freeness). Fix integers n, > 0. Let Φ be a KDM set for key space K = ({0, 1} n ) and message space M = {0, 1} n . The offset-freeness of Φ is defined as

Definition 4.3.3 (Offset-Xor-Freeness). Fix integers n, > 0. Let Φ be a KDM set for key space K = ({0, 1} n ) and message space M = {0, 1} n . The offset-xor-freeness of Φ is defined as oxf(Φ) := max

H-coefficient Technique and KDM Security

H-coefficients. The H-coefficients technique [START_REF] Patarin | The "coefficients H" technique (invited talk)[END_REF] was introduced by Patarin and is widely used to prove the security of block cipher constructions such that Even Mansour [CLL + 14] or Feistel schemes [START_REF] Patarin | Security of random Feistel schemes with 5 or more rounds[END_REF]. Consider a deterministic adversary A which takes no input, interacts with a set of oracles w (informally called a world), and returns a single bit b, which we write A w ⇒ b. Given two worlds w 0 and w 1 (offering the same interfaces), the advantage of A in distinguishing w 0 and w 1 is defined as

The interaction between the adversary A and the oracles is recorded in a transcript τ . The transcript is the list of all query/answer pairs respectively made by the adversary and returned by the oracles. Let X A,w be the random variable distributed as the transcript resulting from the interaction of A with world w. A transcript τ is said to be attainable for A and w if this transcript can be the result of the interaction of A with world w (i.e., Pr[X A,w = τ ] > 0). Lemma 4.3.1 (H-Coefficients). Let w 0 and w 1 be two worlds and A be a distinguisher. Let T be the set of attainable transcripts for A and w 0 , and let T good and T bad be two disjoint (C -4) there exist (+, φ, ST ), (+, φ , S T ) ∈ Q BC (not necessarily distinct) such that φ L (K) ⊕ F(φ R (K) ⊕ K 1 ) ⊕ K 2 = T ⊕ F(S ⊕ k 4 ) ⊕ K 3 ;

(C -5) there exist (-, LR, ST ) = (-, L R , S T ) ∈ Q BC such that (a) L ⊕ F(R ⊕ K 1 ) = L ⊕ F(R ⊕ K 1 ) or (b) T ⊕ F(S ⊕ K 4 ) = T ⊕ F(S ⊕ K 4 );

(C -6) there exist (-, LR, ST ), (-, L R , S T ) ∈ Q BC (not necessarily distinct) such that

(C -7) there exist (+, φ, ST ), (-, L R , S T )

Lemma 4.4.2. Fix a good transcript τ = (Q BC , Q F , K). Then

Proof. First, note that |Domain(F)| = q f and |Domain (F)| ≤ 2q. We consider each condition in turn. 6 (C -1) Fix an encryption query (+, φ, ST ) ∈ Q BC . (a) By ¬(C-1a), φ R (K)⊕K 1 is a fresh input for the function F and hence F(φ R (K)⊕K 1 ) is uniformly random. Thus, φ L (K)⊕F(φ R (K)⊕K 1 )⊕K 2 ∈ Domain(F)∪Domain (F) with probability at most (q f + 2q)/2 n . (b) By ¬(C-1b), S ⊕ K 4 is a fresh input for the function F and hence F(S ⊕ K 4 ) is uniformly random. Thus, T ⊕ F(S ⊕ K 4 ) ⊕ K 3 ∈ Domain(F) ∪ Domain (F) with probability at most (q f + 2q)/2 n . By summing over all encryption queries, condition (C -1) happens with probability at most 2q(q f + 2q)/2 n . (C -2) Fix a decryption query (-, LR, ST ) ∈ Q BC .

(a) By ¬(C-2a), R ⊕ K 1 is a fresh input for the function F and hence F(R ⊕ K 1 ) is uniformly random. Thus, L ⊕ F(R ⊕ K 1 ) ⊕ K 2 ∈ Domain(F) ∪ Domain (F) with probability at most (q f + 2q)/2 n . (b) By ¬(C-2b), S⊕K 4 is a fresh value for the function F and hence T ⊕F(S⊕K 4 )⊕K 3 ∈ Domain(F) ∪ Domain (F) with probability at most (q f + 2q)/2 n . By summing over all encryption queries, condition (C -2) happens with probability at most 2q(q f + 2q)/2 n . ), S = S , so that F(S ⊕ K 4 ) and F(S ⊕ K 4 ) are uniformly random and independent; hence, T ⊕ F(S ⊕ k 4 ) = T ⊕ F(S ⊕ k 4 ) with probability at most 1/2 n . By summing over all possible pairs of distinct encryption queries, condition (C -3) happens with probability at most q 2 /2 n .

(C -4) Fix two (possibly equal) encryption queries (+, φ, ST ), (+, φ , S T )

with probability at most 1/2 n . By summing over all possible pairs, condition (C -4) happens with probability at most q 2 /2 n .

∈ Domain(F) and S ⊕ K 4 / ∈ Domain(F ). We distinguish two cases. If S = S then F(S ⊕ K 4 ) and F(S ⊕ K 4 ) are uniformly random and independent and hence T ⊕ F(S ⊕ K 4 ) = T ⊕ F(S ⊕ K 4 ) with probability at most 1/2 n . If S = S then necessarily T = T since the adversary does not repeat queries and hence the condition cannot hold. In all cases, the conditions hold with probability at most 1/2 n . By summing over all possible pairs of distinct decryption queries, condition (C -5) happens with probability at most q 2 /2 n . (C -6) Fix two (possibly equal) decryption queries (-, LR, ST ), (-, L R , S T ) ∈ Q BC . By ¬(C-2a), R ⊕ k 1 / ∈ Domain(F) and by ¬(C-2b), S ⊕ k 4 / ∈ Domain(F); moreover, by ¬(C-6), R ⊕ K 1 = S ⊕ K 4 so that F(R ⊕ K 1 ) and F(S ⊕ K 4 ) are uniformly random and independent; hence, L ⊕ F(R ⊕ K 1 ) ⊕ K 2 = T ⊕ F(S ⊕ K 4 ) ⊕ K 3 with probability at most 1/2 n . By summing over all possible pairs, condition (C -6) happens with probability at most q 2 /2 n . (C -7) Fix an encryption query (+, φ, ST ) ∈ Q BC and a decryption query (-, L R , S T ) ∈ Q BC . By respectively ¬(C-1a), ¬(C-1b), ¬(C-2a), and

and F(R ⊕ K 1 ) are uniformly random and independent and thus

uniformly random and independent and thus

Exactly as in the proof of Lemma 4.3.2, on can show that

where K denotes the key generation algorithm. We now lower bound the probability that

Combining Equation 4.6 and Equation 4.5 we get

where all probabilities are over F ← ← F * ({0, 1} n , {0, 1} n ). Using Lemma 4.4.3 and Lemma 4.4.2, we obtain

Combining Lemma 4.

Necessity of partial offset-freeness

We show that the condition that Φ R is partially offset-free is necessary for the KDM-CPA security of 4-round KAF (with the same round function F and independent keys K = (K 1 , K 2 , K 3 , K 4 )). 7 This attack takes advantage of a collision at the inputs to the third-round F within two encryption queries:

• Adversary A chooses two values x and x and obtains F(x), F(x ), F 2 (x) and F 2 (x ) and 7 Note that if Φ is partially offset-free then so is ΦR, but not necessary the other way round.

Security of 1-round Even-Mansour

Theorem 4.5.1. Let Φ be a KDM set that is claw-free and offset-xor-free. Then EM

where q is the number of challenge queries of A in either direction and q p is the number of queries of A to P.

Proof. By Equation 4.1 and Lemma 4.3.2, we have Adv kdm-cca

Applying H-coefficient technique between the perfect world and the real world with Lemma 4.5.1 and Lemma 4.5.2 gives

Then combining the two above inequations gives the result. This analysis gives the same result with

Real vs Perfect. In the following, we give the analysis that gives the advantage of an adversary distinguishing the perfect world pw and the real world rw.

We define the bad transcripts for 1-round Even-Mansour as transcripts that contain queries where trivial collisions exist. By trivial collisions, we mean collisions that enable the adversary to distinguish the perfect world and the ideal world with high probability. (C-2) there exist (+, φ, y) = (-, x , y

Lemma 4.5.1. For the settings BC := EM K 1 ,K 2 and O := P, let A be a distinguisher making at most q ≤ 2 n queries to KDMEnc or Dec and q p queries to P. With T bad as defined above, one has

Proof. We analyse the probability of each condition given in Definition 4.5.1 in the perfect world pw where the keys K 1 and K 2 are sampled at random independently from the oracle answers.

(C-1) For two encryption queries in Q EM .

(a) By the no-pointless-queries assumption, φ = φ and hence necessarily y = y . (b) By Definition 4.3.1, the probability of condition (C-1) is at most cf(Φ). Summing over all the possible distinct pairs, condition (C-1) happens with a probability of at most q 2 /2 • cf(Φ).

(C-2) Fix an encryption query (+, φ, y) ∈ Q EM and a decryption query (-, x , y

The decryption query has to before the encryption query in the transcript otherwise the encryption query is a pointless query. Then the value y is sampled in a set of size 2 n -q independently from the value y . Then the probability of having

(b) Here the function φ is not constant otherwise it violates the rule of KDM game. As the key vector K is sampled uniformly at random after all encryption/decryption query, the probability to have

Summing over all the possible distinct pairs, condition (C-2) happens with a probability of at most

(C-3) Fix a query to the encryption oracle (+, φ, y) ∈ Q EM and a query to the public permutation (u, v) ∈ Q P .

(a) By Definition 4.3.2, φ(K) ⊕ K 1 = u with a probability of at most of(Φ).

(b) As the key K 2 is sampled uniformly at random and independently from all the queries, the collision y ⊕ K 2 = v happens with a probability of at most 1/2 n . Summing over all the pairs gives qq p /2 n .

Summing over all the possible pairs, condition (C-3) happens with at most probability qq p • of(Φ) + qq p /2 n .

(C-4) Fix a query to the decryption oracle (-, x, y) ∈ Q EM and a query to the public permutation (u, v) ∈ Q P . The keys K 1 and K 2 are uniformly at random and are independent of all the queries, each collision happens with a probability of at most 1/2 n . By summing over all the possible pairs, condition (C-4) happens with a probability of at most 2qq p /2 n .

The result follows by the union bound.

Lemma 4.5.2. Let τ be a good transcript. Then

Chapter 4

4.5 Even-Mansour KDM security with H-coefficients 103

) be a good transcript, and let q enc , resp. q dec denote the number of queries to KDMEnc, resp. Dec in Q EM , with q enc + q dec = q.

Recall that one has

where K := ({0, 1} n ) 2 denotes the key space of the 1-round Even-Mansour scheme.

In the real world, one obtains the queries transcript (Q EM , Q P ) iff P satisfies q + q p distinct and "compatible" equations and

where all probabilities are over P ← ← P * ({0, 1} n ). Combining Equation 4.7 and Equation 4.8 gives the result.

Conclusion. This analysis of the 1-round Even-Mansour cipher, using the H-coefficient technique, gives the same security result as the splitting and forgetting framework (the advantages are very close). Moreover, this analysis, using H-coefficient technique, is shorter and more readable but the intuition of the security proof is more hidden. We think that if the reader is familiar with the H-coefficient technique, this second technique is easier to apply. It can be interesting to prove the KDM-security for different schemes and configurations (EM, KAF or others) with both techniques to see if, for some cases, one of these methods gives a better result.

Generally, this analysis shows that KDM security under a claw-free KDM set is not achievable for the simple EM and KAF configurations, where the keys are equal, and the internal primitives (functions or permutations) are the same; and no matter the number of rounds due to the slide attacks. But, some level of KDM security, for a more constrained KDM set (offset-free and/or offset-xor-free), is achievable when the underlying primitives of the EM/KAF constructions are different or the keys are independent. The most interesting configurations, from an implementation point of view, is where the internal primitives are the same; it is implemented once and can be used many times. We noticed that, when the keys are independent, the KDM security level increases: the 1-round Even-Mansour is proved secure under a KDM set that is offset-free, offset-xor-free and claw-free; the KDM set for the 2-round Even-Mansour is expanded by removing the offset-freeness restriction, and we believe that adding one round will give KDM security with a claw-free set (for 3-round EM). For the KAF, with the same configuration, giving a conjecture is less straightforward but we believe that 6-round KAF cipher (same functions and independent keys) should be secure under a claw-free KDM set. initializes the state for a specific identification number. Then the adversary is allowed to query the Tag procedure once per document identification number, which implies once in the single-document setting; many times the Update and Verify procedures and he finishes with a query to the Finalize procedure.

Chapter 5 Incremental Authentication Schemes

Consistency. We introduce a notion called consistency. It asks that tags returned by the update algorithm are the same as if the updated document had been tagged directly 4 (i.e. all pairs (t id , st id ) obtained by running iMA.upd(K, N, id, D id , op, arg, t id , st id ) belong to the set [iMA.tag(K, N, id, D id , st id )] of tags generated by the algorithm iMA.tag on input (K, N, id, D id , st id ) where D id = DES.Edit(D id , op, arg)). The formalization must consider that the algorithms may be randomized and stateful, so that the actual condition is more general. Namely we say that the update algorithm has the consistency property if Pr[G corr iMA,DES (A)] = 0 for all adversaries A regardless of their running time, where game G corr iMA,DES is as in Figure 5.2 and Figure 5.3 but with the boxed code now included. We do not mandate consistency, but it is a strong and nice property that will be possessed by some of our schemes. For greater clarity, we gave the games for the single-document setting in Figure 5.2 and for the multi-document setting in Figure 5. algorithm (as seen in the games Figure 5.7). In order to formally define what is a forgery, in IUF2, the adversary is allowed to apply update operations on any tags and any documents; and the list of authenticated documents DL is constructed by performing the same update operation to the current document. The adversary succeeds in producing a forgery if it is able to output a valid pair tag/document where the document does not belong to DL. Let iMA be a message authentication scheme that is incremental for the document editing system DES. The advantages of an adversary A playing against the IUF2 security game in the singledocument setting IUF2-SD and the multi-document setting IUF2-MD are defined respectively as

]. The corresponding security games are given in Figure 5.7.

In order to achieve temporal data authentication and prevent "replay attacks", we also introduce the security notions described in Figure 5.8 which are called IUF2R-SD and IUF2R-MD (where the letter R stands for "Replay attack") which differs only to IUF2-SD and IUF2-MD by the fact that the document list DL contains only the last version of the document authenticated (for each document identification number).

Remark 5.1.1. (Relations with other incremental security notions) In [START_REF] Fischlin | Incremental cryptography and memory checkers[END_REF], Fischlin mentioned three security models where the single and multi-document settings are not defined (e.g. the adversary is not restricted to one Tag query):

• basic attack: the adversary plays in the basic security game IUF-BS as defined above;

• message substitution attack: the adversary A is allowed to tamper with the document

procedure Finalize( id , D, t id ) if ( id , D) ∈ DL then return false return iMA.ver(K, id , D, t id , st id ) Figure 5.6: Games defining IUF1R security of an incremental authentication scheme iMA for both the Single-Document (SD) and the Multi-Document (MD) settings. The framed boxes are excluded from the SD security game.

but not the tag. This model is close to IUF2-MD but weaker: the tag has to be kept in the state (then A cannot tamper with it). Moreover, the Update oracle has to use the non tampered tag then either the tag given as input by the adversary is compared to the one stored in state or either the Tag oracle does not take as input a tag and the tag from state is directly used.

• total substitution attack: the adversary is allowed to tamper with the documents and the tags but the notion of forgery is not formally defined.

Relations among Security Notions for Incremental MACs

In this subsection, we analyse the relations among the different security models defined in the previous subsection.

If one restricts, an incremental MAC secure in the multi-document setting, to authenticate a single document, one gets trivially the following proposition: Proposition 5.1.1. Let x ∈ {1, 2} and y ∈ {R, }. Let iMA be an incremental authentication scheme for the document editing system DES in the multi-document setting. If we have an adversary A against the IUFxy-SD security of iMA (restricted to one document identification number) which makes one query to the Tag procedure and which runs in time t, then we can construct an adversary B which makes one query to the Tag procedure, that runs in time t ≤ t against the IUFxy-MD security of iMA such that Adv IUFxy-SD iMA (A) ≤ Adv IUFxy-MD iMA (B).

Figure 5.11: Adversary D against the PRF game using the adversary A playing the indistinguishability game between G 0 and G 1 (see Figure 5.12) used in in the proof of Theorem 5.1.1.

Figure 5.12: Games for proof of security of the SDtoMD 1 transform (Theorem 5.1.1).

Chapter 5

Incremental MACs and Security notions 123

Adversary B Tag,Update,Verify

then return Verify(D, t id ) K id ← f (id) return iMA1.ver(K id , ε, D, t id , st id ) Figure 5.13: Construction of an adversary B against the IUFxy-MD security game using A playing the indistinguishability G 1 and G 2 in the proof of Theorem 5.1.1.

Chapter 5 Incremental Authentication Schemes

XS.kg()

Forgery Attacks against the Xor-Scheme

An analysis on some incremental hash functions was provided by Phan and Wagner [START_REF] Raphael | Security considerations for incremental hash functions based on pair block chaining[END_REF]. They give, inter alia, patterns that could give collisions on a hash function based on pair block chaining. Two cases are of interest for the Xor-Scheme: non-distinct blocks and cycling chaining. The first one considers repeated blocks messages like A||B||C||B||A and B||C||B||A||B that would have the same sum value if no randomness was used (cf. Figure 5.15) but as underlined by the authors the random values appended to each message block prevents these repetitions. The second one considers a variant of the Xor-Scheme [START_REF] Goi | Incremental hash function based on pair chaining & modular arithmetic combining[END_REF] where the first and the last block are chained so that some repeated patters like A||B||A and B||A||B would have the same sum value but it not the case in the original version from [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF]. Therefore, until this thesis work, no attacks were known against the original strongly incremental Xor-Scheme proposed in [START_REF] Bellare | Incremental cryptography and application to virus protection[END_REF].

According to the IUF-BS security game (named basic security in [START_REF] Bellare | Incremental cryptography: The case of hashing and signing[END_REF]) described in Theorem 5.2.3 (Sketch.) The proof follows closely the proof from [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF]. The main difference is that we use two different random functions in the modified scheme and that we need the following simple lemma to prove that some specific matrix (close to the one used in [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF]) is full-rank. For the reader familiar with [BGR95], we use similar notations in the following.

Lemma 5.2.1. Let X be some finite set and let nb ∈ N.

Lemma 5.2.1. This lemma can be easily proved by induction over nb. Let us denote S nb the first set

} where all R i are distinct. In particular, the set S nb contains exactly nb different couples. One can notice that the first member of each couple is the second member of the previous couple except the first and the last couples. In others words a value R i appears in two couples: once as a first member and once as a second member except the first one R 0 and the last one R nb .

The case nb = 1 is trivial. We consider the case nb = 2 that provides greater clarity. Let assume that there exists (R *

As there are exactly two couples in each set, we have the following two cases:

. The first equality implies R * 1 = R 0 and the second equality implies R * 1 = R 2 and thus R 0 = R 2 which contradicts the statement R 0 = R 2 .

Suppose now that Lemma 5.2.1 holds for all integers k ≤ nb -1 for some positive integer nb. We will show that it holds for nb.

Let us suppose that there exists (R *

Again, as all the values R i are different in S nb then the n couples are different. The equality of these two sets S nb and S * nb implies that they contain exactly the same nb couples and that in each set a couple appears only once. We have the following two cases:

and according to the structure of these sets, there is a couple in S * nb that has a first member equal to R * i = R nb ) and it has to be the case in S nb . But as mentioned above, R nb is a value that appears only in one couple of S nb and we get a contradiction.

We will use this lemma with X = {0, 1} at the end of the proof to show that different messages of the same block-length involve different input pairs for the underlying PRF F K 1 .

Since the adversary A is computationally unbounded we may assume without loss of generality that it is deterministic. The probabilistic choices in A's attack on the scheme are thus the initial choice of f 1 and f 2 of the random functions in F * ({0, 1} 2 , {0, 1} L ) and the choices of random coins made by the authentication oracles in the security game. We assume (again without loss of generality) that A makes exactly q = q t + q upd authentication queries (either as a direct tagging query or as an update query with the insert or the delete operations). As in [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF], there is no loss of generality to assume that A makes all its authentication queries and then makes exactly one verify query (for its purported forgery). We prove that in this case the probability of the event (denoted Succ) A's forgery is valid is upper-bounded by

and using a classical argument (see e.g. [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF]) we get the claimed bound for general adversaries.

We consider the simple case where all the random coins used in the last block of each authenticated document are different. Note that in all authentication queries (from a tagging query or an update query), this random block is picked uniformly at random and independently of the previous blocks. To analyse the probability of this event (denoted Distinct), we can therefore use the following simple lemma:

Lemma 5.2.2 ([BGR95, Fact A.1]). Let P (m, t) denote the probability of at least one collision in the experiment of throwing t balls, independently at random, into m buckets.

Then P (m, t) ≤ t 2 /m.

We thus have Pr

and it remains to upper-bound Pr [Succ|Distinct].

Let us fix a particular sequence of q documents D 1 , . . . , D q (each made of at most nb blocks of n bits) corresponding to all documents authenticated in the security game by some authentication queries (either as a tagging query or as an update query with the insert or the delete operations). We also fix r 1 , . . . , r q some bit-strings possibly used as random values in the modified Xor-Scheme for these documents (i.e. r i consists in 1 ≤ nb i ≤ nb blocks of n bits if D i is made of nb i blocks of n bits) and we assume that the last blocks of all of them are all different. Finally we fix τ 1 , . . . , τ q some possible corresponding tags in {0, 1} L for these documents. We consider only bit-strings (D 1 , . . . , D q ), (r 1 , . . . , r q ) and (τ 1 , . . . , τ q ) for which the probability that there exists two functions f 1 and f 2 such that t i = (r i , τ i ) is a valid tag for D i (for all i ∈ {1, . . . , q}) for f 1 and f 2 is non-zero. and {D q+1 [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||r q+1 [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D q+1 [2]||r q+1 [2], D q+1 [2]||r q+1 [2]||D q+1 [3]||r q+1 [3]

We thus obtain that there exists an index k ∈ {1, . . . , nb i -1} such that

Therefore in this case the left part of the last row (consisting of the first 2 2 columns) is identical to the left part of the i-th row but these rows differ in at least one position in the right part of the matrix B. By elementary operations on the rows, one can easily transform the matrix B in echelon form and it is therefore of full rank (with a probability of at least 1

To conclude the proof, one can identify the functions f 1 and f 2 to their vector of values in ({0, 1} 2 ) L by denoting f i (x) = (ϕ

i,L ) for x ∈ {0, 1} 2 and i ∈ {1, 2}, where ϕ i,j ∈ {0, 1} 2 for i ∈ {1, 2} and j ∈ {1, . . . , L}. In this case by construction, τ i is the authentication tag of the document D i with randomness r i for all i ∈ {1, . . . , q + 1} if and only if for all j ∈ {1, . . . , L}, the j-th bit τ (j) i of τ i is equal to the dot product of the i-th row of the matrix B and the vector ϕ 2,i ||ϕ 1,i . Using the same argument as in [START_REF] Bellare | XOR MACs: New methods for message authentication using finite pseudorandom functions[END_REF], since B is of full rank, the number of vectors satisfying this q + 1 equations is 2 L times smaller than the number of vectors satisfying only the first q equations (corresponding to the first q rows of B), and therefore we obtained that the forgery τ q+1 output by the adversary is valid with probability 2 -L if the matrix B is full rank.

We have thus proved that, in the simplified case, the probability that A's forgery is valid is upper-bounded by

and thus the claimed bound for general adversaries.

Computational case. If we replace the (truly) random functions by pseudorandom functions in the previous result, we obtain readily the following computational security result: Theorem 5.2.4. Let F = (KS, Dom, Rng, eval) be a pseudorandom function family such that F.Dom = {0, 1} 2• and F.Rng = {0, 1} L . Let A be any adversary making a (q t , q v , q upd )-attack against the modified Xor-Scheme with two functions picked uniformly at random from F and running in time λ.

There exist an adversary B against the pseudorandomness property of F that makes q = q • t queries to F, runs in time λ = λ + O(q ( + L)) such that

Here, q t is an upper bound on the number of tagging queries, q upd is an upper bound on the number of update queries (such that q = q t + q upd ), q v is an upper bound on the number of verification queries and nb denotes the maximal block-length of the documents authenticated in the security game.

Theorem 5.2.4. The proof is identical to the proof of [BGR95, Theorem 4.2] and is left to the reader.

Chapter 5 Incremental Authentication Schemes MXS.kg() Security analysis. As shown by the adversary A described below, XMACC is not IUF2-SD secure. This adversary can be easily adapted for XMACR.

Attack. We give the description of an adversary A against the IUF2-SD security of the XMAC scheme.

1. A calls the Initialize oracle.

2.

A builds the 3-blocks document D 1 such that D 1 = D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D [2]||D [3] for any document blocks.

3. A calls the Tag oracle and gives as inputs the nonce value 0 and the document D 1 . It receives the tag t 1 .

4.

A builds the document D 2 such that D * 1 = D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D [2]||D [2].

5.

A calls the Update oracle giving as inputs the nonce value 1, the document D * 1 , the operation R, the argument D [2], 3 and the tag t 1 . It receives the tag t 2 . [2] and calls the Finalize oracle with (D 2 , t 2 ) as input.

A builds

During the Tag call, the document D 1 = D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D [2]||D [3] is added to the list DL. An during the Update call, the document D 2 = D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D [3]||D [3] is added to the list DL because the document is updated according the current document which was D 1 in this case. Then we can see that the document D 2 = D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]||D [2]||D [2] provided by the adversary is not in the list DL.

Remark 5.3.1. (Difference between Xor-MAC and Plus-MAC) This attack works only when the operator of XMAC is a "XOR", it does not work with the modular addition. In fact, during the replace operation, the image by F of the deleted block x d at position i and the image by F of the inserted block x i at position i are XORed: removing a block at some position and deleting a block at the same position are done by the same operation "XOR" which in not the case for the modular addition: adding "+" and removing "-" are not done by the same operation.

The previous attack does not break the IUF2-SD security, there is an other adversary that breaks it: the following adversary B.

1. B calls the Initialize oracle. [2] where D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] and D [2] are any document block. B calls the Tag oracle giving as input the document D 1 . It receives the tag t 1 . [2] and calls the Update oracle giving as input the operation R, the document D * 1 , the argument D [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF] , 1 and the tag t 1 . It receives the tag t 2 .

B builds the document

B builds the document

• If the j-th query for j ∈ {2, . . . , q}, corresponds to deletion of the first block of D j , the Update will pick uniformly at random one block of randomness r , compute

and output (r * j [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]|| . . . ||r * j [nb j -1]||r , τ j ) as the new authentication tag.

• If the j-th query for j ∈ {2, . . . , q}, corresponds to deletion of the p-th block of D j , the Update will pick uniformly at random one block of randomness r , compute

and output (r The adversary is thus given some kind of authentication tags for (respectively):

• the document (D , D * j [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]) with "randomness" (r , r * j [START_REF]1 (Right) Game for defining the prf-advantage of pseudorandom family functions F. (Left) Game for defining the strong prp-advantage of pseudorandom permutation family P[END_REF]) ;

• the document (D

which are masked by two values of f 2 which depends on D j [nb j ] (with one which uses fresh new randomness) instead of just one.

We can now consider the sequence of q documents D 1 , . . . , D q (the first one made of at most nb blocks of n bits and the other one made of at most 3 blocks of n bits) corresponding to all documents constructed in this way during the security game. We also fix the bit-strings possibly used as random values for these documents and we assume that the last blocks of all of them are all different. Finally we fix τ 1 , . . . , τ q some possible corresponding tags in {0, 1} L for these documents.

As in the proof of Theorem 5.2.3, we will compute the probability of the event that A's forgery is valid conditioned on the event that the authentication queries made by A corresponds to the constructed documents D 1 , . . . , D q , use the specified random coins and result in the tags (τ 1 , . . . , τ q ). More precisely, we will show that this probability is upperbounded by nb 2 •2 n-+2 -L (and since the bit-strings (D 1 , . . . , D q ), (r 1 , . . . , r q ) and (τ 1 , . . . , τ q ) are arbitrary, we will get the result by standard conditioning arguments). We construct again a matrix B containing a 1 on the row i for i ∈ {1, . . . , q + 1} only at positions corresponding to bit-strings of length 2 used as inputs to the random functions f 1 and f 2 (where the left part consisting of the first 2 2 columns of the matrix corresponds to the two 7 inputs of f 2 and the right part corresponds to all inputs to f 1 ).

Open Questions and future work

In this section, we would like to address some open problems.

Disk protection mechanisms in practice. The analysis of disk protection was made step by step: encryption (FDE with a diversifier), authenticated encryption for a sector (ADE), authenticated encryption robust against replay attacks (FADE). However, this analysis has only been conducted from the theoretical side. It would be interesting to benchmark different implementations, on different devices and with different cryptographic mechanisms. For now, the incremental scheme that seems to be the most suitable is the Merkle tree (even if it is a bad incremental scheme in the sense that the update complexity is logarithmic) where the update and verify times are close.

Question 6.1 (Benchmark). How much a diversifier and/or a FADE mechanism slows down read and write operations?

The benchmark on different devices can be a first step to check wether theses solutions are practical.

Key-Dependent Message Security. The KDM security analysis of the Even-Mansour and the Key-Alternating Feistel ciphers were conducted for some configurations and with one KDM analysis techniques: splitting and forgetting technique and the H-coefficient technique (except the 1-round EM).

Question 6.2 (Technique comparison). Prove the KDM-security for different schemes and configurations (EM, KAF or others) with both techniques to see if for some cases, one of these methods gives better results.

Question 6.3 (Minimal KDM-secure configurations of EM and KAF ciphers). From how many rounds, the EM and the KAF schemes, with a simple configuration (same internal primitives and independent keys), are KDM secure under a claw-free KDM set?

More theoretically, we can ask the following questions: Question 6.4 (Feistel network KDM security). Can we prove the KDM security of the Feistel network where the underlying function are PRFs? The main difficulty to solve this question is that here there is no information about how the key is used in each round.

Incremental MACs. For now, only the MXS[KV18] construction is proved IUF2-X-secure but it is hard to use it in practice. Question 6.5 (Better than MXS). Can we find a scheme that achieves IUF2-X security and that is more practical than MXS?

By practical, we mean that this should generate smaller tag, require less random generation even if it is stateful. If it is stateful the state has to be as small as small. Question 6.6 (Incremental MACs IUFR-2 suitable for disk protection). More specifically, can we have an incremental MAC that is an IUFR-2 secure MAC with a small tag and a small state ?

List of Illustrations

MOTS CLÉS

Cryptographie, Sécurité prouvée, Modes opératoires, Chiffrement de disque, MAC incrémentaux, Sécurité en présence de messages dependant de la clé.

ABSTRACT

This thesis is dedicated to the analysis of modes of operation in the context of disk protection usage. First, we give modes of operation secure in the Full Disk Encryption (FDE) model where additional data storage is not allowed. In this context, encryption has to be length preserving which implies deterministic encryption. However, it is possible to use a value already present in the system, called a diversifier, to randomize the encryption and to achieve a better security. Then, we introduce two methods to analyse symmetric primitive in the very constrained Key-Dependent Message (KDM) model which is of interest for disk encryption since some particular application may store the encryption key in the disk. The Even-Mansour and the Key-Alternating Feistel constructions, which are commonly found in blockciphers, are analysed in this model. Moreover, knowing that data authenticity cannot be ensured in the FDE model because tag storage is not allowed, we relax this constraint which yields two models: the Authenticated Disk Encryption model (ADE) and the Fully Authenticated Disk Encryption (FADE). A secure mode in the ADE model ensures data authenticity of a sector but can be vulnerable to replay attacks; and a secure mode in the FADE model ensures the authenticity of the entire disk even against replay attacks. Besides security (confidentiality and authenticity), performances of the mode need particular attention, indeed read and write delays on a sector is a competitive argument for disk manufacturers since disk performances tightly depend on it. Consenquently, adding extra computation to handle authentication codes does not help which leds us to analyse incremental Message Authentication Codes that have the property to be updatable in a time proportional to the corresponding modification.

KEYWORDS

Cryptography, Security Proof, Modes of Operation, Full Disk Encryption, Incremental MACs, Key-Dependent Message Security.