International Association for Cryptologic Research

International Association
for Cryptologic Research


Optimal PRFs from Blockcipher Designs

Bart Mennink , Digital Security Group, Radboud University, Nijmegen; CWI, Amsterdam
Samuel Neves , CISUC, Dept. of Informatics Engineering, University of Coimbra
DOI: 10.13154/tosc.v2017.i3.228-252
Search ePrint
Search Google
Abstract: Cryptographic modes built on top of a blockcipher usually rely on the assumption that this primitive behaves like a pseudorandom permutation (PRP). For many of these modes, including counter mode and GCM, stronger security guarantees could be derived if they were based on a PRF design. We propose a heuristic method of transforming a dedicated blockcipher design into a dedicated PRF design. Intuitively, the method consists of evaluating the blockcipher once, with one or more intermediate state values fed-forward. It shows strong resemblance with the optimally secure EDMD construction by Mennink and Neves (CRYPTO 2017), but the use of internal state values make their security analysis formally inapplicable. In support of its security, we give the rationale of relying on the EDMD function (as opposed to alternatives), and present analysis of simplified versions of our conversion method applied to the AES. We conjecture that our main proposal AES-PRF, AES with a feed-forward of the middle state, achieves close to optimal security. We apply the design to GCM and GCM-SIV, and demonstrate how it entails significant security improvements. We furthermore demonstrate how the technique extends to tweakable blockciphers and allows for security improvements in, for instance, PMAC1.
  title={Optimal PRFs from Blockcipher Designs},
  journal={IACR Trans. Symmetric Cryptol.},
  publisher={Ruhr-Universit├Ąt Bochum},
  volume={2017, Issue 3},
  author={Bart Mennink and Samuel Neves},