Sponge-Based Parallel Authenticated Encryption With Variable Tag Length and Side-Channel Protection

Authenticated Encryption (AE) protects confidentiality and integrity at the same time. The sponge construction is based on an iterated permutation or transformation that can be used to implement hashing, and AE schemes, among others. Sponge-based AE schemes offer desirable characteristics like parallelizability and incrementality. In addition, they provide security features such as protection against Chosen Plaintext Attacks, Chosen-Ciphertext Attacks, and Side-Channel Attacks (SCAs). Traditionally AE schemes assume the tag length, also called the stretch, as a fixed parameter per key, and the security is proved according to that assumption. However, the variable tag length per key could happen due to misconfiguration or misuse. In that case, the security would be violated, so it is vital to accommodate variable tag length without sacrificing other desirable features. Reyhanitabar et al. proposed Key Equivalent Separation by Stretch feature and concretized it for protection against tag length misuse attacks in block cipher-based AE schemes. However, the problem remains unresolved for sponge-based constructions, where current sponge-based schemes are vulnerable to tag length variation under the same key attacks. This work aims to bridge this gap by proposing a parallel, sponge-based AE scheme with a variable tag length per key that protects against SCAs and suggesting a lower bound for the recommended tag length. Finally, the security of the proposed scheme is discussed, and its performance is analyzed after implementing the proposed AE scheme in the C programming language.

SECTION I. Introduction

A. Background

Secure communication requires Authenticated Encryption (AE) since it guarantees the privacy and authenticity of messages. Simple encryption-only primitives, like block or stream ciphers, protect the confidentiality of messages from being seen by unauthorized parties. However, such primitives, if used on their own without authenticity protection, are insecure about being employed in communications because an active attacker can alter the ciphertext without being noticed. For instance, an eavesdropper of a banking transaction (without authenticity protection) could change bits of the messages (with the help of some prior knowledge or guessing) without even needing to read it and forward it to its source. Still, it could be accepted as a valid transaction. A cryptosystem with such property is termed malleable. On this front, [1] and [2] proposed the first authenticated encryption (AE) schemes, combining individual encryption schemes and message authentication code (MAC) schemes to pave for a new paradigm of protecting privacy and integrity simultaneously. The AE with associated data (AEAD) allows the addition of unencrypted but authenticated pieces of data, such as those used for packet routing [3], [4], [5].

AE safeguards confidentiality and integrity by following two different security models. Confidentiality defends data privacy against passive adversaries in the chosen-plaintext attack (IND-CPA) and active attackers in the chosen-ciphertext attack (IND-CCA) [2], [6], [7]. Integrity ensures that communications are authentic and haven’t been tampered with, whether in motion or at rest. In addition, AE protects the authenticity of plaintext with the INT-PTXT model and that of ciphertext with the INT-CTXT model.

Most AE structures in the literature assume that the stretch (tag length) is a fixed value per key. Still, a lack of support for variable stretch may render them vulnerable to tag-length variation under the same key attack [8]. For instance, popular standardized AE schemes such as OCB, GCM, and GCM might have their security degraded or could even suffer a complete loss of security if they are misused in this way [9], [10], [11], as raised by Manger [9]. The concern was presented several times in CFRG forum discussions about OCB variable tag length [9] and the CAESAR competition mailing list [12]. For example, If the adversary wages that kind of attack under a scheme using different tag lengths under the same key, the adversary needs to break the shortest one, and the whole security is void.

Besides the security perspective, tag length variability is also advantageous in the constrained resources environment, but recalculating parameters the cost for key exchange because of energy and bandwidth limitations Struik [13]. Reyhanitabar et al. (2017) formalized a nonce-based AE with variable stretch (vNBAE) security notion. They proposed a modular approach for defining the key-equivalent separation by stretch (KESS) concept, which, combined with the traditional NAE, implies the vNBAE security notion.

There have been types of attacks in which the attacker exploits background information about the implementation environment of AE schemes instead of analyzing them under the security models previously discussed. These attacks, known as side-channel attacks (SCAs), are especially harmful when chips containing private data are in an adversary’s hands or installed in locations where the general public can access them. Smart cards, sensor network nodes, and IoT devices are vulnerable [14], [15]. SCAs can be avoided using several strategies, such as masking [15], [16], [17] and hiding [18] [27], [28], [29], [30]. However, rekeying [15], [19], [20], which uses the target cipher plus a subkey generation algorithm that accepts the master key as input, is a less expensive method of obtaining resistance against side-channel attacks.

AE schemes are constructed employing particular underlying building blocks. Block ciphers are the most used building blocks in AE schemes. Famous block ciphers like AES [21], SKINNY [22], and GIFT [23] are used to create AE schemes. An example of stream ciphers is given in [24]. Dedicated and keyless permutations are the fundamental building block of constructions based on permutations. These permutations use Encrypt Mix Encrypt (EME), Encrypt XOR [25], and variations of the Even-Mansour design in place of sponge-like modes [26]. Furthermore, the cryptographic sponge is the most commonly used keyless permutation. Many algorithms, such as the Keccak-f applied in the SHA3 competition winner, employ keyless permutations in the sponge mode of operation. In contrast, others rely on different permutations [27]. Moreover, Some AE schemes use additional building blocks, such as hash and compression functions (CF), as in [28]. Still, others use unique underlying structures, such as those specified in [29], [30], and [31].

In addition to security-related attributes, the following key traits also enhance the effectiveness and performance of AE schemes: parallelizability, which measures the capacity of a scheme to handle the $k^{\mathrm {th}}$ block separately from the subsequent $j^{\mathrm {th}}$ block, given that $k\ne j$ [32], [33]; inverse free: An AE scheme is inverse-free if its algorithm does not need it inverse to carry out encryption or decryption operations [44], [45]; Online use, which demonstrates a scheme’s capacity to process the kth block of ciphertext after observing the first $k$ blocks of plaintext and without knowing any plaintext after the current block [34]. Incrementality is the capacity to update only parts affected by the most recent operation seen in an earlier ciphertext-tag pair (C, T) [35]. The single-pass feature indicates an AE algorithm’s ability to process all the plaintext at once to achieve privacy and authenticity in one pass. Being single-pass boosts the efficiency of an AE scheme [8], [36].

B. Contributions

This study proposes and implements a Parallel Sponge-based Authentication Encryption with Variable Tag length and Side-channel Protection (PAVTASP). This work is a complementing component of ongoing efforts to improve AE schemes’ security and performance and is motivated by PSASPIN [37] and ISAP [38]. But there are three fundamental ways in which the proposed scheme differs from ISAP: first, PAVTASP is parallelizable; it can process several data blocks at a time; second, PAVTASP makes use of the leveled implementation in a different fashion. For example, while PAVTASP utilizes a PRF based on a block cipher or Galois field multiplication in the key-generation part, ISAP uses the sponge construction in the two implementation levels. On the other side, PAVTASP differs from PSASPIN that it allows variable tag length under the same key without losing other desirable features of the scheme. Another contribution of PAVTASP is that it sets a lower bound for the tag length with the help of rekeying that extends the threshold of the number of operations that can be carried out without negotiating for a new key. Finally, the proposed scheme’s security is discussed, and its performance is evaluated, compared to other sponge-based AE schemes, after implementation in C programming language.

C. Organization of This Work

Section II describes the related work. Next, we present a general AE model in Section III, introduce the PAVTASP AE scheme and its processes in Section IV, and discuss the security analysis in Section V. The performance analysis is presented in Section VI. Finally, We offer the discussion in Section VII and conclude this work in Section VIII.

SECTION II. Related Work

Protecting integrity necessities an AE scheme to append the authentication tag to the ciphertext. The expanded part of the ciphertext is also referred to as the ciphertext stretch. The difference between the lengths of the plaintext and the produced ciphertext obtains the stretch value. So, AE schemes traditionally have a syntax where the ciphertext is divided into a core ciphertext and a tag which is concatenated to produce the final ciphertext. The Robust AE (RAE) does not use the partitioned ciphertext syntax, so it uses the general term of stretch in that context [39]. The tag length is an essential element of AE authenticity; the cryptographic strength of an authentication strongly depends on the tag size. Therefore, most authors specify the minimum tag length for their schemes to assume security. Still, specific environments tolerate shorter tag lengths according to certain conditions defined by NIST [40].

Most AE schemes (e.g. [6], [7], [27], [41], [42], [43], [44]) assume a stretch is a fixed scheme parameter that should be constant per key. The security is proved according to the assumption that different stretch values use distinct keys. However, the variable stretch per key could happen either as a result of misconfiguration or attack; in that case, the security would be violated [39]. Examples of compromised Security because of misuse include attacks on OpenSSH, EAXPrime, and VMWare View remote desktop protocol [45].

The CAESAR [46] and NIST-LW [47] competitions provided guidelines for protecting confidentiality, integrity, robustness, and suitability for use in constrained environments. The robustness discussed until recently mainly focused on some instances of nonce misuse resistance; however, other misuse cases, like tag variation under the same key misuse, have not had enough attention [8].

In addition to its security relevance, tag length variability is desirable in the constrained environment, but negotiating parameters cost is preventively high due to energy and bandwidth limitations Struik [13] indicated that supporting a variable stretch under the same key would provide a slide scaling for authenticity, extending the lifetime of constrained resources sensors, especially when processed plaintexts are very short. At the same time, only a few packets would need high authenticity.

The issue was raised several times in CFRG forum discussions about OCB variable tag length [9] and the CAESAR competition mailing list [12]. The discussions motivated the modification of several second candidate schemes [12], [48], [49] to be modified for some heuristic solutions to the problem to accommodate variable tag length under the same key. The absence of variable tag length support is not just a theoretical concern because widely deployed schemes such as OCB, CCM, and GCM malfunction in one way or another once misused in this way [9], [10], [11]. That misuse may cause degraded security to complete loss of security, as raised by Manger [9]. For instance, if those schemes use different tag lengths under the same keys, if the attackers have a 128-bit tag, it’s trivial for them to produce a valid output with a 64-bit tag under the same key by dropping the last 64 bits because shorter tags are simply the truncation of longer ones.

Reyhanitabar et al. (2017) discussed the issue in detail, formalized a security notion vNBAE, then came up with an all-in-one security definition for it. Then the authors proposed a modular approach for defining the concept called key-equivalent separation by stretch (KESS), which, combined with the traditional Nonce-based AE (NAE), implies the vNBAE security notion. Finally, the authors proved that the vNBAE goal was efficient and provably achievable, applying simple tweaks to existing schemes by concretizing it with the modification of OCB without sacrificing its desirable features, such as the online processing of data blocks [8]. Finally, the authors proved that the vNBAE goal was efficient and provably achievable, applying simple tweaks to existing schemes by concretizing it with the modification of OCB based on a tweakable block cipher [8]

Side-channel attacks (SCAs) are implementation-based security threats that exploit the connection between cryptographic algorithms and the emission patterns of implementation environments, such as electromagnetic emissions, radiation emissions, and power consumption traces. The essential idea behind these attacks is to infer a secret key from how the side-channel signal pattern is related to it [18], [50]. When cryptographic equipment is mounted in a location where attackers can physically reach it, SCAs are more dangerous. Therefore, many sources in the literature advocated several countermeasures against SCAs, such as masking [15], [16], [17], [51] and hiding [18]. However, these solutions come with unsustainable performance costs in situations with limited resources, like IoT devices and smart cards. Therefore, fresh rekeying [19], [20] is a more affordable option to get SCA protection compared to the other methods listed. Furthermore, by limiting the usage of each session key to just a single or limited number of times, fresh rekeying protects against SCAs making more difficult for adversaries to collect intermediate key related values [19], [20], [52], [53].

The sponge construction is an iterative cryptographic primitive for creating a function $f$ that receives inputs of any length and produces outputs of any size using transformations or permutations of fixed length. Bertoni et al. initially proposed sponge construction [54]. It acts on a state $b$ that consists of a rate part $r$ and a capacity part c, where $b =r +c$ bits [54]. The sponge absorbs its input blocks first, then processes and squeezes them out as an output truncated to the desired length. The keyless permutation method most frequently employed in AE is the sponge structure. Stream ciphers and re-seedable pseudorandom generators are two further cryptographic applications of Sponges in addition to AE [27]. Depending on the functionality needed, there are different ways to employ the sponge function. For instance, online, single-pass AE methods are typically implemented using the Duplex modes and their variation MonkeyDuplex [27], [55] modes. Therefore, we can use the Sponge/Duplex lemma [54] to prove Duplex mode of operation is as secure as the sponge construction. Ascon [56], one of the winners in the CAESAR competition as well as five of the ten finalists in the NIST competition for lightweight AE, including Ascon [57], Elephant [58], ISAP [59], Photon-Beetle [60], and Xoodyak [61], were based on sponge construction.

Several parallelizable AE schemes based on sponge construction have been proposed. For instance, the AE schemes in the works [62], [63], [64] are incremental and parallelizable to varying degrees, but they are not protected against SCAs. Other sponge-based AE schemes are protected against side-channel attacks but are not parallelizable, incremental, or single-pass [59], [65], [66]. PSASPIN AE is a parallel, sponge-based AE and is defended against Differential Power Analysis (DPA) and Simple Power Analysis (SPA), but it does not support a variable tag length under the same key. This study proposes a parallel sponge-based AE that supports variable tag length and protects against SPAs and DPAs. See Table 1 for a comparison of the proposed solution and other AE schemes based on the sponge construction and its operation modes.

TABLE 1 PAVTASP compared to other AE schemes

SECTION III. Modeling Authenticated Encryption

We can think of the AEAD as a function that takes in a secret key $K$ , plaintext $M$ , associated data AD, a nonce ($N$ ) and outputs a ciphertext $C$ , and an authentication tag $T$ . its encryption algorithm can be modeled as $E:K\times N\times AD\times M\to C\vert T$ —, and its decryption can be modeled as $D:K\times N\times AD\times C\to P\left \{{ \bot }\right \}$ . Separated AE supports a verification algorithm, $V:K\times N\times AD\times C\times T\to M \{\top,\bot \}$ , in addition. The encryption algorithm, $E_{K}\left ({N,AD,M }\right)=(C,T)$ , and the decryption algorithm, $D_{K}\left ({N,AD,C }\right)=M$ if (C, $T$ ) is valid; otherwise, it yields $\bot $ ; the verification algorithm $V_{K}\left ({N,AD,C,T }\right)=\bot (failure \mathrm { }symbol)$ if a forgery is discovered [67], [68], [69].

SECTION IV. Sponge-Based Parallel Authenticated Encryption With Variable Tag Length and Side-Channel Protection (PAVTASP)

The proposed scheme, PAVTASP, is an AEAD sponge-based sponge construction with a state width $\boldsymbol {b}$ of 320 bits, a rate part $\boldsymbol {r}$ of 128 bits, and a capacity $\boldsymbol {c}$ part of 192 bits, where b=c+r. The scheme prevents SPAs and DPAs by generating a fresh session key in every process using parallel fresh re-keying and has the following necessary properties that are critical for the performance and security: Side-channel protected, parallel, single-pass, incremental, and online. In addition, it supports variable tag length without compromising security or losing other desirable features.

A. Notations

Here are definitions for the notations in this paper. The letters K, N, T, and IV are used respectively to represent the key, the nonce, the authentication tag, and the initialization vector. The plaintext message, the ciphertext, and the associated data are each denoted by M, $\boldsymbol {C}$ , and $\boldsymbol {A}$ , respectively. A failure of verification or an error is what we mean by ($\bot$ ). $\boldsymbol {S}$ stands for the 320-bit state of the sponge construction. $\boldsymbol {S} _{r}$ represents the rate part of the state, whereas $\boldsymbol {S} _{c}$ represents the capacity part of the state. The length of the string $`X'$ is denoted by the symbol $\vert $ $X\vert $ , whereas the text $`X'$ concatenated with the string $`Y'$ is designated as X$\vert \vert $ Y. $\boldsymbol {P}$ is the sponge permutation, $\boldsymbol {0}^{k}$ stands for an entirely 0-bit string of length $\boldsymbol {k}$ , and $\vert $ X$\vert $ is the symbol for the length of the string ‘$\boldsymbol {X}$ .’ We represent the XOR of the strings ‘X’ and ‘Y’ as ${\boldsymbol {X}\bigoplus \boldsymbol {Y}}$ . By $\left \lfloor{ \boldsymbol {X} }\right \rfloor _{k}$ , we refer to a bitstring $\boldsymbol {X}$ that has been truncated to its last $\boldsymbol {k}$ most significant bits. We refer to a bitstring $\boldsymbol {X}$ that has been truncated to the first k least significant bits as $\left \lfloor{ \boldsymbol {X} }\right \rfloor _{k}$ . Finally, we denote $\tau $ by the tag length(stretch).

B. Parameters

PAVTASP is an AE scheme using a 320-bit permutation $\boldsymbol {P}$ that applies eight rounds of ASCON permutations [57]. It requires five inputs: a 128-bit secret master $\boldsymbol {K}$ from which a session key $\boldsymbol {K} _{S}$ is obtained, a variable length tag length (stretch) $\tau $ , a variable length plaintext $\boldsymbol {M}$ , a variable length associated data AD, and a 128-bit nonce $\boldsymbol {N}$ . Decryption requires a 128-bit session key $\boldsymbol {K} _{S}$ obtained from $\boldsymbol {K}$ , a ciphertext $\boldsymbol {C}$ , a nonce $\boldsymbol {N}$ , an authentication tag T, and a variable length stretch value $\tau $ . For protection against SCAs, PAVTASP employs fresh rekeying to obtain a new key each time encryption/decryption and authentication operations are invoked. Figure 1 and Figure 2 respectively show a schematic view of the PAVTASP encryption and decryption processes. The initialization, encryption, and decryption/verification processes are described below. PAVTASP is a single-pass scheme that performs encryption and authentication in a single pass over the duplex structure. In addition, the scheme allows variable length and protects against SPAs and DPAs.

FIGURE 1.

Schematic view of PAVTASP encryption.

FIGURE 2.

Schematic view of PAVTASP decryption.

C. Pavtasp Processes

1) Initialization

In the initialization stage, the parallel fresh re-keying function (PFRK) is called. To protect the parallel threads of the system against SCAs, it requires a master $\boldsymbol {K}$ and a nonce $\boldsymbol {N}$ and generates new session keys $\boldsymbol {K} _{S,{i}}$ . The first $\boldsymbol {N}$ is produced at the source, shared in a secure manner, and incremented in every process to maintain synchronization between the communicating sides. This work assumes the existence of a secure way of making the keys and nonces available to the parties. For instance, key distribution mechanisms such as key wrapping schemes [70], could apply to the nonces. Another possibility is hiding the nonce in the ciphertext and extracting it at the destination using existing hide-nonce-transforms [37]. See Algorithm 3 for details on FRK. Once the secret session key is generated, the state $\boldsymbol {S}$ is updated by feeding the session key concatenated with a Secret Message number (SMN) to permutation $\boldsymbol {P}$ . The system generates a secure counter Ctr to monitor the number of parallel lanes and is incremented by 1 with every thread. The state is updated by XORing it with the Ctr variable before processing the AD part $; S\leftarrow (Ctr\bigotimes S_{r})\parallel S_{c}$ .

2) Associated Data (AD) Processing

PAVTASP first divides the $\boldsymbol {A}$ into $\boldsymbol {r}$ -bit blocks and pads it with ’1’ and the list number of ’0’s to make the length of $\boldsymbol {A}$ a multiple of $\boldsymbol {r}$ . There is no need for padding if the AD block is empty. Associated data is processed one block at a time, $A_{0}\vert \vert $ $A_{1}\vert \vert $ ........A $_{i}\vert \vert $ , $\vert $ $A\vert =$ r, then, each block of $A$ is XORed with $\boldsymbol {S} _{r}$ (the rate part), and after concatenating with $S_{c} ($ the capacity part), the shared state $\boldsymbol {S}$ is updated by the permutation $\boldsymbol {P}$ as following: $S\leftarrow (\left ({S_{r}\bigoplus A_{i} }\right)\parallel S_{c})$ . After processing the last block of associated data $\boldsymbol {A} _{i}$ , a domain separator of 1-bit is XORed with the state $S$ : $S\leftarrow S\bigoplus ({0}^{319}\parallel 1)$ .

3) Encryption

The padded plaintext ($M$ ) is broken into $r$ -bit blocks and processed block by block: $M\vert \vert 1\vert \vert 0^{r-1-(\vert M\vert {mod}{}{r})}=M_{0}\vert \vert $ $M_{1}\vert \vert $ .... $\vert \vert $ $M_{n_{\mathrm {,.}}} $ For all plaintext blocks except the last, each block of plaintext ($M_{i}$ ) is XORed with the outer part of the state $(S_{r})$ : $C_{i}\leftarrow S_{r}\bigoplus M_{i}$ , to output the ciphertext block $(C_{i})$ , after which the state is updated: $S\leftarrow \left ({C_{i}\parallel S_{c} }\right)$ . The resulting state is truncated so that the total length of the ciphertext is equal to that of the original unpadded length of the plaintext: $C_{z}\leftarrow \left \lfloor{ S_{r} }\right \rfloor _{\left |{ M }\right |mod r}$ . The resulting ciphertext block is then XORed with the padded stretch value to produce the final text in the following manner: $C_{z}\leftarrow \tau \vert \vert {0}^{r-\tau } \bigoplus C_{z}$ . See algorithm 1 for details.

Algorithm 1 Encryption

$E$ (A,M,K,N,$\tau$ )

Input: Key $K \epsilon $ {0,1}^k, $K\le $ 128,

Plaintext $M\epsilon $ {0,1}$^{\ast,}$

Nonce $N \epsilon $ {0,1}¹²⁸,

Associated Data $A\epsilon $ {0,1}$^{\ast }$ ,

Stretch $^{}\tau \epsilon \mathbb {N}$ ,

Output: Ciphertext $C\epsilon $ {0,1}$^{\mathit {\vert M\vert }}$ ,

Tag $T\epsilon $ {0,1} $\vert \tau \vert $

Initialization $///A$ new counter value

$Ctr=\left \lceil{ K }\right \rceil _{\vert r\vert }$

//Call the fresh rekeying function

$K_{s}\leftarrow $ PFRK(K,N) $;S\leftarrow K_{s}\vert \vert $ SMN

Processing the Associated Data

Let $A=A_{0}\vert \vert \text{A}_{1}\vert \vert $ ....$\vert \vert \text{A}_{x}$ , $\vert \text{A}_{i}\vert =\text{r}$ ,for $\text{i}< \text{x}$ , $A_{y}\le r$ and $\vert \text{A}_{x}\vert >0$

if $\text{x}>$ 0

for $i $ = 1,...,x do $S\leftarrow \text{P}$ ((Sr$\bigoplus A_{i}$ )$\vert \vert \text{S}_{c})$

$S\leftarrow S \bigoplus $ (0$^{319}\vert \vert 1$ )

Processing Plaintext

Let $M=A_{0}\vert \vert \text{M}_{1}\vert \vert $ ....$\vert \vert \text{M}_{n}$ , $\vert \text{M}_{i}\vert =\text{r}$ , for $\text{i}< \text{n}$ , $M_{n}\le r$ and$\vert \text{M}_{n}\vert >0$ if $\text{n}>$ 0

for $I $ = 1,...,n-1 do

Sr$\leftarrow $ Sr$\bigoplus $ Mi;CM$\leftarrow $ Sr $;S\leftarrow \text{P}$ (Sr$\vert \vert $ Sc)

Sr$\leftarrow $ Sr$\bigoplus M_{nn} C_{n}\leftarrow \left \lfloor{ S_{r} }\right \rfloor _{\left |{ M }\right |mod r}$

Cz$\leftarrow \tau \vert \vert {0}^{r-\tau } \bigoplus C_{n}$

Finalization

Ks$\leftarrow $ PFRK(K,N)

$S \leftarrow P(S$ (0$_{r}\vert \vert \text{K}_{s}\vert \vert 0^{c-r-k})$

${t_{i}\leftarrow \left \lceil{ S\otimes K_{s} }\right \rceil }_{\vert \tau \vert }$

//if final lane

$If Ctr=n$

$T\leftarrow t_{0} \bigoplus t_{1}\ldots.\bigoplus t_{n-1}$

Return $C_{1}\vert \vert... \vert \vert \text{C}_{i}\vert \vert \text{C}_{n}\vert \vert \text{T}$

4) Decryption

The padded ciphertext ($C$ ) is split into $r$ -bit blocks and processed block by block: $C\vert \vert 1\vert \vert 0^{r-1-(\vert M\vert ^{mod r})}{}$ =$C_{0}\vert \vert $ $C_{1}\vert \vert $ ... $\vert \vert $ $C_{z}$ . The last ciphertext block $(C_{z})$ is parsed into a ciphertext block and the stretch part in the following manner: $\tau \vert \vert C_{z}\leftarrow C_{z}$ . The rest of the process is identical to encryption; the two processes differ only in that plaintext and ciphertext are swapped. See algorithm 2 for details.

Algorithm 2 Decryption

$D(A, C, K, N, T, \tau)$

Input: Key $K \in\{0,1\}^{k}, K \leq 128$ ,

Ciphertext $C \in\{0,1\}|M|$ ,

Associated Data $A \in\{0,1\} *$ ,

i $N \in\{0,1\} 128$ ,

Stretch $\tau \in \mathbb{N}$ ,

$\operatorname{Tag} T \in\{0,1\}|\tau|$

Output: Plaintext $M \in\{0,1\}^*$ or $\perp$

Initialization

$C t r=C t r=\lceil K\rceil_{|r|}$

//Generate a fresh subkey

$K s \leftarrow \operatorname{PFRK}(K, N)$

//Call the fresh rekeying function

$S \leftarrow K s \| S M N$

Processing the Associated Data

Let $A=A_{0}|| A_{1}|| \ldots.|| A_{x},\left|A_{i}\right|=r$ , for $i\lt x, A y \leq r$ and $\left|A_{x}\right|\gt0$

if $x\gt0$

for $i=1, \ldots, x d o$

$S \leftarrow P\left(\left(\operatorname{Sr} \bigoplus A_{i}\right) \| S c\right)$

$S \leftarrow S \bigoplus(0319|| 1)$

Processing Ciphertext

Let $C=A_{0}|| C_{1} \| \ldots.|| C_{n},\left|C_{i}\right|=r$ , for $i\lt n, C_{n} \leq r$ and $\left|C_{n}\right|\gt0$ if $n\gt0$

for $i=1, \ldots, n-1$ do

$M_{i} \leftarrow \operatorname{Sr} \bigoplus C_{i}; S \leftarrow C M_{i} \| S_{c}$

$S \leftarrow P(S)$

$\tau \| C_{n} \leftarrow C_{n}$

$\quad M_{n} \leftarrow\left\lfloor S_{r}\right\rfloor_{n \mid} \bigoplus C_{n}$

$\quad S_{r} \leftarrow S_{r} \bigoplus\left(M_{n}\|1\| 0^*\right)$

Finalization

$K s \leftarrow P F R K(K, N)$

$\quad S \leftarrow P\left(S \bigoplus\left(O^{r} \| K_{s \|}|| 0 c-r-k\right)\right.$

$t_{i} \leftarrow\left\lceil S \otimes K_{s}\right\rceil_{128}$

in the final lane

$\text { If } C t r=n$

$T^{\prime \prime} \leftarrow t_{0} \bigoplus t_{1} \ldots \bigoplus t_{n-1}$

$\text { If } T^{\prime \prime}=T \text { and }|T|=\tau$

$\text { Return } M_{1}\|\ldots\| M_{i} \| M_{n}$

5) Finalization

In the finalization and authentication state, the fresh re-keying function is again called for protection against SCA and forgery attacks. Once the session key $K_{s}$ is generated and concatenated with SMN, the shared state is updated by transforming the XOR of state $S$ with the padded fresh session key $K_{S}$ , $S \leftarrow $ P(S $\bigoplus $ (0 $^{r}\vert \vert $ $K_{s}\vert \vert 0^{c-r-k}$ ). For all the parallel threads except the last one, intermediate tags $t_{i}s$ are generated by truncating the state XORed with the session key to the last $\tau $ bits, and the intermediate tags are combined. In the last threat (once the counter Ctr is equal to $n$ ), the final intermediate tag $T$ is generated and concatenated to the ciphertext blocks, $T\leftarrow t_{0}\bigoplus t_{1}\ldots.\bigoplus t_{n-1}$ . In the finalization of the decryption process, the plaintext is returned if the generated tag length is equal to the stretch value $\tau $ , and the generated tag $\boldsymbol {T} ^{''}$ is qual the $\boldsymbol {T}$ parameter $T$ of the decryption; otherwise, the process aborts. If $T^{''}=T$ and $\vert $ $T\vert =^{}\tau {;}{}$ Return $M_{1}\vert \vert $ ... $\vert \vert $ $M_{i}\vert \vert $ $M_{z}$ .

6) The Rekeying Function

Figure 3 illustrates several implementation options for the rekeying function. The leveled implementation used in this work is adapted from the method proposed by..Abdalla and Bellare [20] and implemented by [19] and [71]. The structure is split up into a rekeying function and a data processing (rekeyed) component. Several alternatives for implementing the data processing part include block ciphers like AES, sponge construction and its operation modes, and tweakable block ciphers [66]. On the other hand, a PRF serving as a pseudorandom generator ($G$ ) can be used to implement the rekeying function with different options, including the following: Constructions based on Galois field (GF) multiplication, leakage-resistant primitives like duplex sponges [38], [66], protected block ciphers like SERPENT [72] and AEAS, tweakable block ciphers or traditional block ciphers strengthened with countermeasures like hiding and masking [52], [65], [73].

FIGURE 3.

Rekeying function options that can be used in PAVTASP [37].

In this work, the rekeying function can be constructed in one of two ways using the leveled implementation. Using a rekeying function built on a GF multiplication field is the first option similar to those in [71], and [74]; however, some modifications are necessary because those implementations only protect against lower-order DPAs. On the other hand, this work integrates the defense mechanisms to protect against higher-order DPAs. A leakage-resilient block cipher is an additional option with a more complex design than the first one but is preferable for hardware implementations. The function $\boldsymbol {G}$ based on the GF multiplication is implemented in Algorithm 3 using combined shuffling and masking for defense against higher-order DPAs.

“Algorithm 3 Parallel Fresh Rekeying (PFRK)

Requires: $a, b \in G F\left(2^{2}\right)[y] / y^{d}+1$

Ensures: $c=b * b \in G F\left(2^{2}\right)[y] / y^{d}+1$

$x \leftarrow \operatorname{rand}(), j \leftarrow x, k \leftarrow x$ , with $h=1-m, 0 \leftarrow$ st

while $k \# x-1 \bmod d$ do

$k_{b} \leftarrow k$

$\text { for } h=1 \text { to } m \text { do }$

$k b_{h} \leftarrow k b_{h} \bigoplus b_{j}$

$j \leftarrow j+1 \bmod d$

End for

$k_{s} \leftarrow N \cdot b k_{h}$

$\text { for } h=1 \text { to } m d o$

$k_{s} \leftarrow N \cdot\left(b_{j} \bigoplus b k_{h}\right)$

End for

End while

Return $\left(k_{s_{h}}, s t+1\right)$ ” [37]

SECTION V. Security Analysis

We evaluate PAVTASP security in terms of its two implementation levels. The first level is the rekeying function, which protects against DPA and SPA and generates session keys. The second level is the sponge function, based on the duplex construction, which protects against SPA. We can measure the overall adversarial advantage according to its ability to compromise the key generation function and its ability to compromise the base rekeyed scheme. Furthermore, there are various countermeasures for protection against SCAs. Examples include employing session keys for one or more tasks, hiding, masking, and applying logic styles. However, [18] indicated that the most effective way is to combine countermeasures rather than using them separately. For example, we can combine shuffling and masking for defense against higher-order DPAs.

A. Security of Parallel Fresh Rekeying Function (G).

The parallel rekeying function creates session keys for use in the AE schemes’ encryption component using an initial master key [15], [20]. This method enables us to encrypt more data under the same key, increasing the key’s lifetime. Rekeying functions can be divided into two categories: parallel rekeying, which generates session keys, all at once, separately, and serial rekeying, in which the generated session keys depend on the prior states and are updated continuously [20]. According to [53], when concurrent access to data is implemented, parallel rekeying is required.

According to [20], a stateful generator’s pseudo-randomness is defined as follows: Consider the following experiment taking into account $G=\left ({K,N }\right)$ as a stateful generator with a block size of $\boldsymbol {k}$ , $\boldsymbol {n}$ as an integer, and $\boldsymbol {A}$ as an adversary:\begin{align*} &Experiment {EXP}_{G,n,A}^{prg-real} \\ & \quad for i=1,\ldots.,n \mathbf {do} \\ \quad &\left ({{Out}_{i},{St}_{i} }\right)\leftarrow N\left ({{St}_{i-1} }\right);\leftarrow st\parallel {Out}_{i} \\ &\quad g_{n}\leftarrow A\left ({st }\right) \\ &\quad return g_{n} \\ &Experiment {EXP}_{G,n,A}^{prg-rand} \\ &st\leftarrow {\{0,1\}}^{n.k} \\ &g_{n}\leftarrow A\left ({st }\right) \\ &return g_{n}\end{align*}

The security evaluation of the proposed parallel fresh rekeying function can be described concerning the security notions of pseudorandom generators. The approach proposed in [20] is followed in this work, but their schemes protect a block cipher, whereas that proposed here protects a parallel sponge-based AE scheme. Pseudorandomness, which represents adversary $A$ ’s inability to differentiate the generator’s output from a random string of identical length, is the desirable property of the generator. Real and random experiments define adversary $A\boldsymbol {'}\text{s}$ advantage and the generating function’s advantage (ADV) in the following way:

${ADV}_{G,n,A}^{prg}=\Pr \left [{ {EXP}_{G,n,A}^{prg-Real}=1 }\right]-\Pr \left [{ {EXP}_{G,n,A}^{prg-rand}=1 }\right] {ADV}_{G,n,A}^{prg}\left ({t }\right)={max}_{A}\left \{{ {ADV}_{G,n,A}^{prg} }\right \}$ . The advantage function quantifies the likelihood that $A$ can compromise function $G$ using the abovementioned resources. The maximum is overall $A$ running in $t$ , the time complexity, and the total time complexity is the running time of the two experiments, in addition to the size of adversary $A\boldsymbol {'}\text{s}$ code. The underlying PRF is what ensures the key generation function security $F:{\{0,1\}}^{l}\times {\{0,1\}}^{l}\times {\{0,1\}}^{l}\to {\{0,1\}}^{l}$ . Let ${\{0,1\}}^{l}\mathrm { }to$ be a function family that maps an $l$ -bit string to an $l$ -bit string assuming a uniform distribution. If $\boldsymbol {D}$ is a distribution with Oracle access, then \begin{align*} {ADV}_{F,D}^{prf}&={\mathrm {Pr}[D}^{(F,K)}=1:K\stackrel { R } \longleftarrow {\{0,1\}}^{n}] \\ &-\mathrm {Pr}[D^{f\left ({. }\right)}=1:f\stackrel {\$} \longleftarrow R^{n}]\end{align*} is the advantage of the distinguisher D. The advantage of F is: ${ADV}_{F}^{prf}\left ({t,q }\right)={Max}_{D}\left \{{ {ADV}_{F,D}^{prf} }\right \}$ ,

The overall $A$ ’s advantage is the maximum, $t$ denotes the time complexity, and $q$ represents the oracle queries executed. In the following, we demonstrate how the underlying PRF affects the pseudorandom of the parallel fresh rekeying function.

Theorem 1:

Let $F:{\{0,1\}}^{l}\times {\{0,1\}}^{l}\to {\{0,1\}}^{l}$ be a PRF, and let $G$ [$F$ ] be a parallel key generator; then ${ADV}_{G,l}^{prg}\left ({t }\right)\le {ADV}_{F}^{prf}\left ({t,l }\right)$ .

Proof:

Assume that adversary A is trying to defeat the pseudo-randomness of $G$ [$F$ ], and assume $t$ to be the running time of ${EXP}_{G\left [{ F }\right],l,A}^{prg-real}$ . An upper bound is determined for ${ADV}_{G\left [{ F }\right],l,A}^{prg}$ . Then a distinguisher $D$ for $F$ is constructed whose advantage is related to that of $A$ . The distinguisher $D$ interacts with an oracle $B$ that calculates $s=B(1) \vert \vert \ldots..\vert \vert $ B(n) and produces the same guess of $A$ on input $s$ . When $B$ is randomly drawn from $F$ , the likelihood that the distinguisher $D$ produces 1 is equal to the likelihood that ${EXP}_{G\left [{ F }\right],n,A}^{prg-real}$ produces 1. Alternatively, the likelihood that ${EXP}_{G\left [{ F }\right],n,A}^{prg-rand}$ produces 1 is equal to that of $D$ producing 1 assuming that $B$ is drawn randomly from a random function family $R^{n}$ . Because $D's$ running is t, makes at most $l$ queries to its oracle, it follows that ${ADV}_{G\left [{ F }\right],l,A}^{prg}\le {ADV}_{F}^{prf}\left ({t,l }\right). A$ is an adversary, and the combined maximum time of the two experiments is t, and that completes the proof.

The Security of the PRF ($F$ ) under $l$ queries determines, quantitatively, the pseudo-randomness of the fresh rekeying function $(G)$ . When $F$ is a PRF, then ${ADV}_{G\left [{ F }\right],l}^{prg}\left ({t }\right)\approx \frac {l+t}{2^{k}}$ .

B. The Base AE Scheme Security

The sponge-based AE scheme, PAVTASP, is based on the duplex mode of operation. It receives a plaintext $M$ , associated data AD, a nonce $N$ , a stretch value $\tau $ , and a master key $K$ fed into the pseudorandom generator to produce subkeys to process data blocks in a parallel fashion. At the core of AE security, we consider two notions of security for sponge construction, confidentiality, and integrity [2], [6], [7]. Finally, the method put forward by Jovanovic et al. [75], Andreeva et al. [30], and Mihajloska et al. [76] is used to prove the security of the rekeyed part of PAVTASP.

C. Confidentiality (or Privacy)

Confidentiality ensures that only legitimate parties can view the messages in the IND-CPA model against passive attackers and the IND-CCA model against active attackers. The attacker is granted access to an encryption oracle in the first model and a decryption oracle in the second. The adversary’s advantage must always be insignificant for an AE scheme to be secure [2], [6], [7].

Consider $P$ a collection of idealized permutations of an AE scheme II. The following formula describes $A's$ advantage (ADV) while having access to both forward and inverse permutations in breaching scheme II ’s privacy:\begin{equation*} {ADV}_{II}^{priv}\left ({A }\right)=\vert {Pr}_{p,K}\left ({A^{p^{\pm },E_{K}}=1 }\right)-{Pr}_{p,{\$}}(A^{PP^{\pm,{\$} }}=1).\end{equation*}

The $P^{\pm }$ denotes that $A$ can make queries to forward and inverse permutations. Assuming that $A$ does not call $E_{k}$ and $\$ $ using the same nonces, ${ADV}_{II}^{priv}(q_{p},q_{e},\lambda _{e})$ represents all adversaries the maximum advantages making queries to $E_{k}$ or $\$ $ .

D. Integrity or Authenticity

Integrity guarantees that communications come from reliable parties and haven’t been changed while in motion or at rest. AE provides plaintext integrity under the INT-PTXT paradigm and ciphertext integrity under the INT-CTXT paradigm. The former assures that the attacker cannot forge ciphertext decryption of data that the sender did not previously encrypt. The latter guarantees that the adversary cannot come up with a ciphertext that the sender had not created, regardless of whether the plaintext is new [2], [6].

Assume that $P$ is a collection of the AE scheme II ’s underpinning idealized permutations. Then, we can describe the integrity-related goals of AE are defined as demonstrated by the adversary $A$ ’s failure to produce a new plaintext that is not the outcome of a valid decryption $(D_{k}(C))$ process under a valid key $K$ :\begin{equation*} {ADV}_{II}^{auth}={Pr}_{P,K}\left ({A^{P^{\pm,E_{K},\mathrm { }D_{K}}}Forges }\right),\end{equation*} The probability is taken over $A$ , and $K$ , assuming $P$ has been chosen randomly. We say that adversary $A$ wins in making a forgery if $D_{k}$ produces a message that is different from $\bot $ on receiving an input (A, C, N, $T$ ), and (A, $C$ ) have not been created by $E_{k}$ after taking (N, A, $M$ ) as input. The adversary is also assumed to be nonce-respecting in that it does not repeat the same nonces, as in the privacy case. Let us represent authenticity as ${ADV}_{II}^{auth}\left ({q_{p},q_{E},\lambda _{E},q_{D},\lambda _{D} }\right)$ . We can determine the maximum advantage over all adversaries by querying $P^{\pm }$ at most $q_{p}$ times making at most $q_{E}$ queries of total length at most $\lambda _{E}$ blocks to $E_{K}$ and at most $q_{D}$ queries of the total length $\lambda _{D}$ to $D_{K}/\bot $ .

For the proof of PAVTASP’s privacy, we consider an adversary $A$ making $q_{P}$ permutation queries and $q_{E}$ encryption queries whose total length is $\lambda _{E}$ . For integrity proof, we consider adversary $A$ making $q_{D}$ decryption queries totaling a length of $\lambda _{D}$ . The number of permutation calls is determined by $q_{E}$ encryption queries, and the same procedure is repeated for encryption queries with similar parameters. Considering $q_{E}$ , of $c$ associated data blocks and $f$ message blocks, and $T$ intermediate tags, the equivalent $n$ state values can be described as follows:\begin{align*} \left ({init.S_{0}\left [{ {\begin{array}{cccccccccccccccccccc} A_{S1,0} & M_{S1,0} & T_{s1,0}\\ \vdots & \vdots & \vdots \\ {\begin{array}{cccccccccccccccccccc} \vdots \\ \vdots \\ A_{Sn+1,c}\\ \end{array}} & {\begin{array}{cccccccccccccccccccc} \vdots \\ \vdots \\ M_{Sn+1,f}\\ \end{array}} & {\begin{array}{cccccccccccccccccccc} \vdots \\ \vdots \\ T_{sn+1,T}\\ \end{array}}\\ \end{array}} }\right] }\right) \tag{1}\end{align*} The number of state values $\sigma _{e,j}$ is c+f+4, assuming that the $j^{th}$ query is $c+f$ blocks, and which results in the number of $\Pi $ evaluations using the encryption query:\begin{equation*} \sigma _{E}:=\sum \nolimits _{j=1}^{q_{E}} {\sigma _{j,E}\le q_{E}\left ({c+f+4 }\right)=\lambda _{E}+{4q}_{E}.} \tag{2}\end{equation*}

We calculate for $\sigma _{D}$ and $\sigma _{j,D}$ in the same manner.

E. Syntax of NBAE with Variable Tag Length

We can expand the syntax of Nonce-Based Authenticated Encryption (NBAE) schemes to include a variable tag length as proposed by [8]. An AE scheme with variable stretch consists of a triplet $\mathrm {\Pi =(}K,E,D)$ where $K{\subseteq }{\{1,0\}}^{\ast }$ a set of keys with a uniform distribution, and $E{:}K\times N{\times }{\mathcal {T}}_{T}\times M\to C$ and $D{:}K\times A\times N{\times \mathbb {N}\times }C\to M\cup \{\bot \}$ are encryption and decryption algorithms in that order. In this context, we call $N$ the nonce space, A the Associated Data space, M the plaintext space, C the ciphertext space, and ${\mathcal {T}}$ the stretch space of the scheme $\mathrm {(\Pi })$ . We assume that $N\subseteq \left \{{ 1,0 }\right \}^{\ast }{, }M\subseteq \left \{{1,0 }\right \}^{\mathrm {\ast }},A\subseteq \left \{{1,0 }\right \}^{\ast },C\subseteq \left \{{ 1,0 }\right \}^{\ast }, and \mathrm { }{\mathcal {T}}_{T}\subseteq \mathbb {N}$ . We also assume that if $M\in M then\mathrm { }{\{0,1\}}^{\vert M\mathrm {\vert }}\subseteq M$ .

Reyhanitabar et al. [8] proposed a modular syntax for achieving the vNBAE, key-equivalent separation by stretch (KESS). The assumption is that the scheme should behave as having a fresh independent key with each value of a separate tag length value. In addition, they stated that KESS ensures that the scheme instances using different tag lengths be independent and inaccessible to one another rather than encouraging short tag lengths or claiming particular robustness.

Let $\Pi =(K,E,D)$ be and vNBAE scheme. Let A be an adversary that tries to break KESS of $\Pi $ by distinguishing two games, one containing the encryption and decryption oracles of the Real schemes and another of an Ideal scheme with similar parameters. The advantage of A in breaking the scheme is measured by ${ADV}_{\Pi }^{KESS}\left ({A }\right)=\Pr \left [{ A^{KESS-{Real}_{\Pi }}\Rightarrow }\right]\mathrm {-Pr}[A^{KESS-{Ideal}_{\Pi }}\Rightarrow 1]$ . When combined with NBAE security, KESS implies vNBAE Security. KESS’s role is merely to handle the interaction between queries with different tag lengths so that queries of $\tau $ bit of stretch are independent of one another. So we have:

$\left ({KESS\bigwedge NBAE }\right)\mathrm {\Rightarrow }vNBAE\mathrm {.}Let\Pi =\left ({K,E,D }\right)$ be a nonce-based AE scheme with a variable stretch; we have that:\begin{align*} &\hspace {-2pc}{ADV}_{\Pi }^{vNBAE\left ({\tau _{c} }\right)}\left ({t,q_{E},q_{D},\sigma }\right) \\ &\le {ADV}_{\Pi }^{KESS}\left ({t^{\prime},q_{E},q_{D},\sigma }\right) \\ &+{ADV}_{\Pi \left [{ c }\right]}^{NBAE}\left ({t^{\mathrm {''}},q_{E}^{\tau _{c}},q_{D}^{\tau _{c}},\sigma ^{\tau _{c}} }\right), \\ &\hspace {-2pc}with t^{\prime} =t+O\left ({q }\right)\mathrm { }andt^{\mathrm {''}}=t+O\left ({\sigma }\right)where q \\ &=\sum \nolimits _{\tau \mathrm {\in }{\mathcal {T}}_{T}} {\left ({q_{E}^{\tau }+q_{D}^{\tau } }\right)}and\sigma \\ &= \sum \nolimits _{\tau \in {\mathcal {T}}_{T}} {\left ({\sigma _{E}^{\tau }+\sigma _{D}^{\tau } }\right)\mathrm {.}}\end{align*} The adversarial resources are $(t,q_{e},q_{d},\sigma)$ where $t$ is the adversarial running time $q_{D}\mathrm =(q_{E}^{\tau }\backslash \tau \in {\mathcal {T}}_{T})$ stands for the vector of the number of encryption queries made with the stretch value $\tau $ for every stretch $\tau \mathrm {\in }{\mathcal {T}}_{T}$ , and $q_{D}\mathrm =(q_{D}^{\tau }\backslash \tau \mathrm {\in }{\mathcal {T}}_{T})$ denotes the number of decryption queries, and $\sigma =(\sigma ^{\tau }\backslash \tau {\in }{\mathcal {T}}_{T})$ stands for the vector of the total amount of data processed by all queries with stretch value $\tau $ for every $\tau \in {\mathcal {T}}_{T}$ .

For a resources parameterized function of an AE scheme $\Pi $ for a given tag length value $\tau _{c}$ the adversarial advantage can be defined as ${ADV}_{\Pi }^{vNBAE\left ({\tau _{c} }\right)}\left ({r_{\tau _{c}} }\right)={Max}_{A}\{{ADV}_{\Pi }^{\tau _{c}}\left ({A}\right)\}$ . The maximum is taken over all adversaries with $r_{\tau _{c}}$ bound resources, the scheme is secure if, for all practical adversaries, with the resources mentioned above, the advantage is negligible. Thus a scheme $\Pi $ is a vNBAE-secure if for every stretch value $\tau _{c}\mathrm {\in }{\mathcal {T}}_{T}$ , for all practical adversaries with the specified resources, the advantage ${ADV}_{\Pi }^{vNBAE\left ({\tau _{c} }\right)}\left ({r_{\tau _{c}} }\right)$ is small, keeping in mind that the advantage ${ADV}_{\Pi }^{vNBAE\left ({\tau _{c} }\right)}\left ({r_{\tau _{c}} }\right)$ will be inevitably high if the stretch value $\tau _{c}$ is small.

F. A Lower Limit for Tag Lengths

As more data is processed with a single key, the security assurance provided by cryptographic systems deteriorates. Therefore, limiting the amount of plaintext and associated data blocks protected by calls to the authenticated encryption function during the key lifetime is recommended. For instance, $2^{64}$ would be a reasonable limit for most applications. Jovanovic, Luykx [75] set the integrity bound (tag length) of sponge-based schemes to $2^{\mathrm {c/2}}$ where c is the capacity. As soon as the lower bound limit approaches, a key exchange should be negotiated for the security to hold...Abdalla and Bellare [20] and Mennink [15] stated that with fresh rekeying, the security bounds of schemes could be enhanced, for instance, from $2^{\mathrm {k/2}}$ to $2^{\mathrm {k/3}}$ . For that reason, we claim that PAVTASP enhances the minimum recommended tag length of $2^{64}$ for the equal key length and capacity of 128 bits to $2^{\mathrm {128/3}}$ or approximately $2^{42} $ bits. NIST standard on this issue requires the implementing parties to be careful when using shorter tag lengths [40]. For instance, they recommend that packets that fail the integrity should be discarded silently to prevent them from giving useful information to the potential attackers and limiting the associated data packet to contain only the necessary header information.

G. Pavtasp Adversary Model

In this study, adversary A is considered powerful, with full access to the communication medium, intent on compromising privacy and integrity, access to encryption and decryption oracles, and the ability to employ various tag lengths while using the same key. Figure 4 depicts the PAVTASP adversarial model following the approach of Do et al. [77] and Jimale et al. [37].

FIGURE 4.

PAVTASP adversary model.

If adversary A cannot breach PAVTASP’s Security with a non-trivial probability under the specified assumptions, capabilities, and goals, then PAVTASP is assumed secure. For example, although A can utilize different values of stretch (tag lengths) under the same key, the KESS property instances of the schemes using stretch values are separated and cannot interact, so that will not increase the success probability of A.

SECTION VI. Performance Analysis

Although security is the most decisive factor for cryptographic algorithms, performance is equally vital because of the continuously shifting information processing paradigms and diverse implementation platform requirements. For instance, the ever-increasing reliance on online data processing necessitates speedy accessibility of information for better user experiences. Therefore, we implemented PAVTASP to evaluate its performance and measure it against three other Sponge-based AE schemes using similar parameters.

We used Visual Studio code version 1.74.0 IDE, installed on Dell Spectre x360 Convertible laptop with Intel Core i7-1065G7 CPU/1.30GHz 1.50 GHz processor and 16 GB memory, running Microsoft Windows 10 version 22H2 (OS built 190452251). We ran the C language implementations of PAVTASP with six other sponge-based schemes NORX [62], PSASPIN [37], ASCON [56], ISAP [59], $\pi $ –CIPHER [63], and SPOOK [78]. We recorded the performance metrics and compared the performance results, as shown in Table 2. We used the framework by Dobraunig et al. [57], enabling the GCC compiler flags: -O3 -march=native -Wall for compile-time optimization. The performance metrics are presented in cycle per byte (cpb), following the approach of NORX [56], [62], ASCON [56], and ISAP [59].

TABLE 2 Comparison of PAVTASP against other AE schemes (in cycles per byte)

Table 2 compares the performance of PAVTASP against other similar AE schemes based on sponge construction. The entries in the table show the number of cycles per byte (cpb) when processing messages of different lengths: from 1 byte, 8 bytes, and up to 32768 bytes—the higher the cpb, the more efficient the scheme.

The results demonstrate that ISAP and $\pi $ –CIPHER outperform PAVTASP in every message length. Although ISAP provides protection against SCA, it lacks many other features that PAVTASP has, e.g., parallelizability, incremental, single pass, online, and variable stretch (refer to Table 1). On the other hand, $\pi $ –CIPHER does not offer protection against SCAs and lacks the support of variable stretch features.

Furthermore, PAVTASP generally outperforms PSASPIN and SPOOK in processing any message length. For example, PAVTASP gives 71 cpb when encrypting one byte, whereas PSASPIN requires 56 cpb and SPOOK 29 cpb. Note that the only difference between PSASPIN and PAVTASP is that the former does not provide a variable stretch tag feature, whereas the latter does; in addition, PAVTASP does not support the nonce-hiding features. Therefore, PAVTASP has a slight advantage over PSASPIN in performance.

NORX and ASCON seem to excel in processing short messages. However, these two schemes are not protected against SCA and do not have the same number of features that PAVTASP has. As in any cryptographic scheme, there are tradeoffs between security and performance. Generally, an AE scheme that provides more security features is not necessarily the most efficient. Therefore, applications that require the set of features offered by PAVTASP would likely benefit from using it. Furthermore, as far as we know, PAVTASP is the only sponge-based AE scheme that allows the use of variable tag length under the same key without compromising other critical security and performance features.

SECTION VII. Discussion

The cryptographic sponge function was first proposed by Bertoni et al. [54] and gained popularity after NIST declared Keccak as the SHA3 competition winner in October 2012 [79]. Sponge-based variants like Duplex, MonkeyDuplex, SpongeWrap, and DonkeySponge [27], [55] and their innovative design philosophies have eliminated the complications of key scheduling in other constructions like block ciphers. Our sponge-based scheme, PAVTASP, protects against SPAs and DPAs in addition to being parallel.

The first parallelizable AE construction based on the duplex mode of the sponge function was presented by Morawiecki et al. [64] and, then other works followed like those in [30], [62], and [63]. However, the main problem with these early efforts was that the resulting schemes did not protect against side-channel attacks, especially against SPAs and DPAs [18], [50].

Furthermore, ISAP [38], SALE [38], and SPOOK [65] sponge-based AE schemes were proposed to defend against SPA and DPA attacks using different approaches. For example, some AE schemes [38], [66] used sponge-based constructions to defend against SCA, followed by [64], who based their scheme on a tweakable block cipher. These studies used the leveled implementation approach [18], [20]. But these constructions lacked parallelizability, which is an essential performance feature. The scheme proposed in this work combines the merits of parallelizability, and protection against SCAs particularly against SPAs and DPAs.

Several countermeasures to protect against SCAs, like hiding, shuffling [18], and masking [15], [16], but fresh rekeying achieves the same goal less resource-intensively. Abdalla & Bellare [20] first proposed fresh rekeying. This method uses the master key $K$ as an input to a pseudorandom generator that generates session keys which are then used to preserve systems’ privacy and integrity; thus, it does not use the master key directly in the schemes. Furthermore, fresh re-keying increases the key lifetime, the number of times a specific key can be used to encrypt messages before needing to be changed. Abdalla and Bellare first suggested a rekeying scheme in a leveled implementation fashion [20]. They stated that the rekeying component should be protected against both SPA and DPA but itself does not need to be cryptographically strong. The main construction (the rekeyed part), on the other hand, must be protected only against SPA, but must be cryptographically strong.

Medwed et al. [19], [71] developed a rekeying scheme following the leveled implementation approach using the AES block cipher for the base scheme component and a PRF based on modular multiplication GF($2^{8}$ ) for the rekeying part. However, their scheme is susceptible to attacks suggested by Black et al. in [80], because of their way of intermediate processing states of the block cipher, as mentioned by Dobraunig et al. [81]. Our work uses a rekeying function on the GF($2^{8}$ ) multiplication field that is protected against by a combination of masking and hiding to defend it against higher-order DPAs.

On the other side, the leveled implementation of SALE [66] and ISAP [38] used sponge-based structures in both levels of rekeying component, and the core rekeyed data processing component. Although using the same primitive for the two levels is preferable for reducing the code size of the scheme, the possibility of enabling CPAs may lead to compromising the subsequent keys [53]. Other works, notably Spook [65], employed a tiered implementation in which the data processing component is based on a sponge construction (T-Sponge) and the rekeying generation on a tweakable block cipher. However, a Galois field multiplication GF($2^{8}$ ) based algebraic construct is lighter and easier to protect against SPAs and DPAs. PSASPIN [37] proposed a parallel, sponge-based AE scheme with SPA and DPA protection and hidden nonces from adversaries. Still, it assumed the tag length is a fixed parameter under the same key and thus might be vulnerable to tag length variation attacks. Remember that these AE schemes, except PSASPIN, are serial and do not provide parallelism, which is a crucial property for AE schemes. Our scheme in this study, PAVTASP, allows the use of variable stretch while using the same key, in addition to parallelizability and protections against SCAs. No other sponge-based AE scheme provides the combination of those properties to the best of the author’s knowledge.

Most AE schemes, including [6], [7], [27], [41], [42], [43], and [44], consider the stretch a fixed scheme parameter per key, and the security is proved accordingly, assuming that different stretch values use distinct keys. However, using variable tag lengths under the same key could happen either because of misconfiguration or attack, and the security would be violated [39]. In addition to its security relevance, tag length variability is desirable in constrained resource environments. Still, negotiating parameters cost is preventively high due to resource limitations, according to Struik [13].

Reyhanitabar et al. (2017) discussed the issue in detail and formalized a security notion for the nonce-based AE schemes vNBAE. Furthermore, the authors proposed a modular approach for defining the key-equivalent separation by stretch (KESS) concept, which, combined with the traditional NBAE implies the vNBAE security notion. Finally, the authors proved that the vNBAE goal was efficient and provably achievable, concretizing it with the modification of OCB without sacrificing its desirable features, such as the online processing of data blocks [8]. Finally, the authors outlined some open problems indicating possible ways to extend their work, including the possibility of describing transformations that apply to large subsets of NBAE secure schemes encoding the stretch value $\tau $ in the input of sponge-based modes. This work fills the gap by proposing and implementing a sponge-based AE scheme that encodes the stretch value $\tau $ in the encryption and decryption processes to allow the secure use of variable tag lengths under the same key.

There should be an upper limit on the amount of plaintext and associated data blocks protected by calls to the authenticated encryption function over the key lifetime. According to NIST, Special Publication 800-38D [40], $2^{64}$ would be a fair upper limit for the majority of applications. Jovanovic, Luykx [76] set sponge-based schemes’ integrity bound (tag length) to $2^{\mathrm {c/2,}}$ where c is the capacity. As soon as the lower bound limit approaches, a key exchange should be negotiated to the security to hold...Abdalla and Bellare [20] and Mennink [15] stated that with fresh rekeying, the security bounds of schemes could be enhanced, for instance, from 2 $^{k/2}$ to $2^{\mathrm {k/3}}$ . Our work, PAVTASP, enhances the minimum recommended tag length of $2^{64}$ for the equal key length and capacity of 128 bits to $2^{\mathrm {128/3}}$ or approximately $2^{42} $ bits. This fact is supported by the fact that fresh rekeying can enhance to increase the traditional bounder of security limit.

This work is inspired by ISAP [38] and PSASPIN [37] but differs from ISAP in two ways: first, the proposed scheme PAVTASP is parallelizable. Second, it follows a different implementation approach for key generation and data processing to protect against the weaknesses indicated in [53]. Our implementation consisted of two layers, and The rekeying layer is based on Galois Field multiplication using a PRF, following the design proposed by Medwed et al. [19], Medwed et al. [71]. Moreover, the related key attack concern raced by Dobraunig et al. [81] is not relevant in the case of the sponge-based schemes because those attacks exploit the partial key processing values of key scheduling, which does not exist for the sponge functions.

Finally, PAVTASP differs from PSASPIN because it permits using variable tag lengths under the same key in a secure manner, protecting against misuse attacks related to instances of the same AE schemes using different stretch values under the same secret key. PAVTASP follows the KESS approach proposed by Reyhanitabar et al. (2017) to achieve this goal. Thus PAVTASP has a different syntax that adapts the tag length (stretch) value as an input parameter in encryption and decryption processes. Furthermore, PAVTASP performs better than PSASPIN after testing their implementation in the C programming language.

SECTION VIII. Conclusion

This paper proposed and implemented a side-channel attack-resistant sponge-based, parallel AE scheme that permits using variable tag lengths under the same key, PAVTASP. Our implementation consisted of two layers. The rekeying layer is based on Galois Field multiplication, while the base scheme layer is based on the sponge construction in the duplex mode. The proposed scheme is advantageous over similar sponge-based AE schemes because it allows variable tag lengths under the same key without sacrificing other valuable features like online and parallelizability. Finally, the security of the proposed scheme is evaluated, and its performance is analyzed and compared to similar AE schemes after implementing it in the C programming language.