]>
Encryption algorithm Rocca-SKDDI Research, Inc.2-1-15 Ohara, Fujimino-shi, Saitama356-8502Japanyt-nakano@kddi.comKDDI Research, Inc.2-1-15 Ohara, Fujimino-shi, Saitama356-8502Japanka-fukushima@kddi.comUniversity of Hyogo7-1-28 Minatojima Minamimachi, Chuo-ku, Kobe-shi, Hyogo650-0047Japantakanori.isobe@ai.u-hyogo.ac.jp
sec
Internet-DraftThis document defines Rocca-S encryption scheme,
which is an Authenticated Encryption with Associated Data (AEAD),
using a 256-bit key and can be efficiently implemented utilizing the AES New Instruction set (AES-NI).IntroductionBackgroundCountries such as the USA, China, and South Korea are adapting to the fifth-generation mobile
communication systems (5G) technology at an increasingly rapid pace. There are more
than 1500 cities worldwide with access to 5G technology. Other countries are also taking significant
steps to make 5G networks commercially available to their citizens. As the research in
5G technology is moving toward global standardization, it is important for the research
community to focus on developing solutions beyond 5G and for the 6G era. The first
white paper on 6G was published by 6G Flagship, University of Oulu, Finland
under the 6Genesis project in 2019.
This white paper identified the key drivers, research
requirements, challenges, and essential research questions related to 6G.
One of the main requirements as listed in this paper was to look at the problem
of transmitting data at a speed of over 100 Gbps per user.Additionally, 3GPP requires that the cryptographic algorithms
proposed for 5G systems should support 256-bit keys . Apart from the need of
speeds of more than 100 Gbps and supporting 256-bit keys, 3GPP also discusses the
possible impacts of quantum computing in the coming years, especially due to Grover's
algorithm. While describing the impact of quantum computers on symmetric algorithms
required for 5G and beyond, 3GPP states the following in Section 5.3 of :"The threat to symmetric cryptography from quantum computing is lower
than that for asymmetric cryptography. As such there is little benefit in
transitioning symmetric algorithms without corresponding changes to the
asymmetric algorithms that accompany them."However, it has been shown in numerous articles that quantum computers can
be used to either efficiently break or drastically reduce the time necessary
to attack some symmetric-key cryptography methods.
These results require a serious reevaluation of the premise that has
informed beyond 5G quantum security concerns up to this point.
Additionally, since NIST will finally standardize quantum-resistant public key algorithms
in the coming few years, we believe it is important for the research community
to also focus on symmetric algorithms for future telecommunications that would provide security
against quantum adversaries.
The effectiveness of post-quantum asymmetric cryptography would only be
improved if the symmetric cryptography used with it is also quantum resistant.
Thus, a symmetric cryptographic algorithm thatsupports 256-bit key and provides 256-bit security with respect to key recovery and forgery attacks,has an encryption/decryption speed of more than 100 Gbps, andis at least as secure as AES-256 against quantum adversaries (for 128-bit security against a quantum adversary)is needed.Rocca-S has been designed as an encryption algorithm for a high speed communication such as future internet and beyond 5G mobile communications.
Rocca-S achieves an encryption/decryption speed of more than 200 Gbps in both the raw encryption scheme and the AEAD scheme on an Intel(R) Core(TM) i9-12900K.
It can provide 256-bit and 128-bit security against key recovery attacks in classical and quantum adversaries respectively.
The high throughput of Rocca-S can be achieved by utilizing the AES-NI .
A similar approach has been taken by the AEGIS family and Tiaoxin-346 , both two submissions to the CAESAR competition .
SNOW-V also uses the AES round function as a component so AES-NI can be used.Design ConceptIn this document, we present an AES-based AEAD encryption scheme
with a 256-bit key and 256-bit tag called Rocca-S.To achieve such a dramatically fast encryption/decryption speed,
Rocca-S adopts the design principle such as the SIMD-friendly round function and an efficient permutation-based structure.
We explore the class of AES-based structures to further increase its speed and reduce the state size.
Specifically, we take the following different approaches:To minimize the critical path of the round function, we focus on the structure where
each 128-bit block of the internal state is updated by either one AES round (aesenc) or XOR
while Jean and Nikolic consider the case of applying both aesenc and XOR
in a cascade way for one round.We introduce a permutation between the 128-bit state words of the internal state
in order to increase the number of possible candidates while maintaining efficiency because
executing such a permutation is a cost-free operation in the target software, which
was not taken into account in .Conventions Used in This DocumentThe key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when,
and only when, they appear in all capitals, as shown here.Algorithm DescriptionIn this section, the notations and the specification of our designs will be described.NotationsThe following notations will be used in the document.
Throughout this document,
a block means a 2-octet value.
For the constants Z0 and Z1,
we utilize the same ones as Tiaoxin-346 .X ^ Y: The bitwise Exclusive OR (XOR) of X and Y.X#Y: For a number X and a positive integer Y, the Y-th power of X.f#(N): For a function f and a non-negative integer N,
the N-th iteration of function f.|X|: The length of X in bits.X||Y : The concatenation of X and Y.ZERO(l): A zero string of length l bits.PAD(X): X||ZERO(l), where l is the minimal non-negative integer such that
|PAD(X)| is a multiple of 256.PADN(X): X||ZERO(l), where l is the minimal non-negative integer such that
|PADN(X)| is a multiple of 128.LE128(X): the little-endian encoding of 128-bit integer X.Write X as X = X[0]||X[1]|| ... ||X[n] with |X[i]| = 256,
where n is |X|/256 - 1.
In addition, X[i] is written as X[i] = X[i]_0||X[i]_1 where X[i]_0 and X[i]_1 are 128-bit.S: The state of Rocca-S, which is composed of 7 blocks, i.e.,
S = (S[0], S[1], ..., S[6]),
where S[i] (0 <= i <= 6) are blocks and S[0] is the first block.Z0: A 128-bit constant block defined as Z0 = 428a2f98d728ae227137449123ef65cd.Z1: A 128-bit constant block defined as Z1 = b5c0fbcfec4d3b2fe9b5dba58189dbbc.A(X): The AES round function without the constant addition operation, as defined
below: A(X) = MixColumns( ShiftRows( SubBytes(X) ) ),
where MixColumns, ShiftRows and SubBytes are the same operations as defined
in AES .AES(X,Y): One AES round is applied to the block X, where the round constant is Y,
as defined below: AES(X,Y) = A(X) ^ Y.
This operation is the same as aesenc, which is one of the instructions of AES-NI and
performs one regular (not the last) round of AES on an input state X with a subkey Y.R(S,X0,X1): The round function is used to update the state S, as defined in .The Round FunctionThe input of the round function R(S,X0,X1) of Rocca-S consists of the state S and two
blocks (X0,X1).
If denoting the output by Snew, Snew:=R(S,X0,X1) can be defined as follows:The corresponding illustration can be found in .SpecificationRocca-S is an AEAD scheme composed of four phases:
initialization, processing the associated data, encryption, and finalization.
The input consists of a 256-bit key K = K0||K1,
a nonce N of between 12 and 16 octets (both inclusive) in length,
the associated data AD, and the message M.
The output is the corresponding ciphertext C and a 256-bit tag T.The settings described below are required for the parameters:The key K MUST be unpredictable for each invocation.PADN(N), where N is the nonce, MUST be unique per invocation with the same key,
so N MUST NOT be randomly generated.InitializationFirst, (N,K0,K1) is loaded into the state S in the following way:Then, 16 iterations of the round function R(S,Z0,Z1),
which is written as R(S,Z0,Z1)#(16),
are applied to state S.After 16 iterations of the round function, two 128-bit keys are XORed with the state S in the following way:Processing the Associated DataIf AD is empty, this phase will be skipped. Otherwise,
AD is padded to PAD(AD), and the state is updated as follows:where d = |PAD(AD)| / 256.EncryptionThe encryption phase is similar to the phase to process the associated data.
If M is empty, the encryption phase will be skipped.
Otherwise, M is first padded to PAD(M), and then PAD(M) will be absorbed
with the round function.
During this procedure, the ciphertext C is generated.
If the last block of M is incomplete and its length is b bits, i.e.,
0 < b < 256, the last block of C will be truncated to the first b bits.
A detailed description is shown below:where m = |PAD(M)| / 256.FinalizationThe state S will again pass through 16 iterations
of the round function R(S,LE128(|AD|),LE128(|M|)) and then the 256-bit tag T is computed in the
following way:Rocca-S AlgorithmA formal description of Rocca-S can be seen in , and
the corresponding illustration is shown in .A Raw Encryption SchemeIf the phases of processing the associated data and finalization are removed,
a raw encryption scheme is obtained.A Keystream Generation SchemeIf the phases of processing the associated data and finalization are removed, and there is no message injection into the round function such that R(S,0,0),
a keystream generation scheme is obtained.
This scheme can be used as a general stream cipher and for random bit generation.Support for Shorter Key LengthFor Rocca-S to support 128-bit or 192-bit keys, the given key needs to be expanded to 256 bits.
When a 128-bit key is given, it will be set to K0, and K1 is defined as K1 = ZERO(128).
When a 192-bit key is given, the first 128-bit will be set to K0, and the remaining 64-bit will be set to K1_p.
Then K1 is defined as K1 = K1_p||ZERO(64).The use of Key Derivation Functions (KDF) to stretch the key length to 256-bit could be another option.
The given 128-bit or 192-bit key will be used as a key derivation key, and the output of the KDF will be 256-bit.Settings as AEAD Algorithm SpecificationsTo comply with the requirements defined in Section 4 of ,
the settings of the parameters for Rocca-S are defined as follows:K_LEN (key length) is 32 octets (256 bits), and K (key) does not require any particular data format.P_MAX (maximum size of the plaintext) is 2#125 octets.A_MAX (maximum size of the associated data) is 2#61 octets.N_MIN (minimum size of the nonce) = 12 octets,
and N_MAX (maximum size of the nonce) = 16 octets.C_MAX (the largest possible AEAD ciphertext) = P_MAX + tag length = 2#125 + 32 octets.In addition,Rocca-S does not structure its ciphertext output with the
authentication tag.Rocca-S is not randomized or is not stateful in the meanings of
the section 4 of .Security ClaimsClassic SettingAs described in , Rocca-S provides 256-bit security against key-recovery and 192-bit security against forgery attacks
in the nonce-respecting setting.
We do not claim its security in the related-key and known-key settings.The message length for a fixed key is limited to at most 2#128, and we also limit the number of different messages that are produced for a fixed key to be at most 2#128.
The length of the associated data for a fixed key is up to 2#64.Quantum SettingRocca-S provides 128-bit security against key-recovery and forgery attacks against quantum adversary with classical online queries.
Rocca-S does not claim security against online quantum superposition attacks.Security ConsiderationsSecurity Against AttacksRocca-S is secure against the following attacks:Key-Recovery Attack: 256-bit security against key-recovery attacks.Differential Attack: Secure against differential attacks in the initialization phase.Forgery Attack: 192-bit security against forgery attacks.Integral Attack: Secure against integral attacks.State-recovery Attack: Guess-and-Determine Attack: The time complexity of
the guess-and-determine attack cannot be lower than 2#256.Algebraic Attack: The system of equations, which needs to be solved in algebraic attacks to Rocca-S,
cannot be solved with time complexity 2#256.The Linear Bias: Secure against a statistical attack.The details can be found in the paper .Other AttacksWhile there are many attack vectors for block ciphers, their application to Rocca-S is
restrictive, as the attackers can only know partial information about the internal state from
the ciphertext blocks. In other words, reversing the round function is impossible in
Rocca-S without guessing many secret state blocks. Therefore, only the above potential
attack vectors are taken into account. In addition, due to the usage of the constant
(Z0,Z1) at the initialization phase, the attack based on the similarity in the four columns
of the AES state is also excluded.Nonce ReuseInadvertent reuse of the same nonce by two invocations of the Rocca-S
encryption operation, with the same key, undermines the security of
the messages processed with those invocations.
A loss of confidentiality ensues because an adversary will be able to
reconstruct the bitwise exclusive-or of the two plaintext values.Tag Verificatoin FailureWhen the tag verification fails during the decryption phase, it is reccomended to erase the plaintext and computed tag.IANA ConsiderationsIANA has assigned value TBD in the AEAD Algorithms registry to AEAD_ROCCA.
&RFC2119;
&RFC5116;
&RFC8174;
Recommendation for Key Derivation Using Pseudorandom Functions (Revised)NIST Special Publication 800-108An Ultra-High Throughput AES-Based Authenticated Encryption Scheme for 6G: Design and Implementation28th European Symposium on Research in Computer Security, ESORICS 2023Tiaoxin-346: VERSION 2.0Nanyang Technological University, SingaporeCAESAR CompetitionAEGIS: A fast authenticated encryption algorithmSelected Areas in Cryptography (SAC 2013) pp.185-201FIPS 197 Advanced Encryption Standard (AES)National Institute of Standards and TechnologyKey drivers and research challenges for 6G ubiquitous wireless intelligenceA new SNOW stream cipher called SNOW-VIACR Transactions on Symmetric Cryptology, 2019(3), 1-42Study on the support of 256-bit algorithms for 5G3GPP SA3Intel Advanced Encryption Standard (AES) New Instructions SetIntel CorporationCAESAR: Competition for Authenticated Encryption: Security, Applicability, and RobustnessEfficient Design Strategies Based on the AES Round FunctionIn: Peyrin, T. (eds) Fast Software Encryption. FSE 2016. Lecture Notes in Computer Science, vol 9783Software ImplementationImplementation with SIMD Instructions shows a sample implementation of Rocca-S.
Test VectorThis section gives three test vectors of Rocca-S. The least significant octet of the vector is
shown on the left and the first 128-bit value is shown on the first line.AcknowledgementsThis draft is partially supported by a contract of "Research and development on new generation cryptography for secure wireless communication services" among "Research and Development for Expansion of Radio Wave Resources (JPJ000254)", which was supported by the Ministry of Internal Affairs and Communications, Japan.