Efficient Constructions from Double POLYVAL
摘要
POLYVAL is an almost-XOR universal hash-function family that is used with AES-GCM-SIV. It has 128-bit outputs and can be computed efficiently on modern platforms. We show here constructions based on two POLYVAL calls to produce 256-bit outputs, and a block cipher with 256-bit keys and 256-bit block size. These are the pseudorandom function Double POLYVAL PRF (DP-PRF) and the stateless Message Authentication Code (MAC) Double POLYVAL MAC (DP-MAC). Their security relies on the single assumption that the block cipher is indistinguishable from a random permutation of {0, 1}256 even with the target number (>264) of queries. Under this assumption DP-MAC and DP-PRF can be safely used for processing 264 bytes. This obviates key rotation due to key wear out in real world applications. We use Rijndael256 as the block cipher. This allows us to use the AES-NI/PCLMULQDQ instructions on modern processors, for optimizing software performance and reach the throughput of 0.61 cycles per byte.