Attacking and fixing the CS mode

ISCAS OpenIR

	Attacking and fixing the CS mode
	Sui, Han (1); Wu, Wenling (1); Zhang, Liting (1); Wang, Peng (2)
	2013
会议名称	15th International Conference on Information and Communications Security, ICICS 2013
页码	318-330
会议日期	November 20, 2013 - November 22, 2013
会议地点	Beijing, China
收录类别	EI
出版地	Springer Verlag, Tiergartenstrasse 17, Heidelberg, D-69121, Germany
ISSN	3029743
ISBN	9783319027258
部门归属	(1) Trusted Computing and Information Assurance Laboratory, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China; (2) Data Assurance and Communication Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
摘要	The security of the Cipher-State (CS) mode was proposed to NIST as an authenticated encryption (AE) scheme in 2004. The usual SPRP blockcipher security for AE schemes may not guarantee its security. By constructing a special SPRP, one can easily make a key-recovery attack with a single block query. The distinguishing attacks and the forgery attacks can also be made with simpler SPRP constructions. The security flaw relies in the method for generating initial whitening values. To fix this shortcoming, we propose a modified version CS* which incorporates a new method for generating initial whitening values, while keeping the main structure of CS unchanged. As we show, CS* is secure when its underlying blockcipher is an SPRP and halves of which are unpredictable. © Springer International Publishing 2013.; The security of the Cipher-State (CS) mode was proposed to NIST as an authenticated encryption (AE) scheme in 2004. The usual SPRP blockcipher security for AE schemes may not guarantee its security. By constructing a special SPRP, one can easily make a key-recovery attack with a single block query. The distinguishing attacks and the forgery attacks can also be made with simpler SPRP constructions. The security flaw relies in the method for generating initial whitening values. To fix this shortcoming, we propose a modified version CS* which incorporates a new method for generating initial whitening values, while keeping the main structure of CS unchanged. As we show, CS* is secure when its underlying blockcipher is an SPRP and halves of which are unpredictable. © Springer International Publishing 2013.
语种	英语
内容类型	会议论文
URI标识	http://ir.iscas.ac.cn/handle/311060/16647
专题	中国科学院软件研究所
推荐引用方式 GB/T 7714	Sui, Han ,Wu, Wenling ,Zhang, Liting ,et al. Attacking and fixing the CS mode[C]. Springer Verlag, Tiergartenstrasse 17, Heidelberg, D-69121, Germany,2013:318-330.