Efficient Variants of TNT with BBB Security
摘要
At EUROCRYPT’20, Bao et al. have shown that three-round cascading of LRW1 construction, which they dubbed as TNT, is a strong tweakable pseudorandom permutation that provably achieves 2n/3-bit security bound. Jha et al. showed a birthday bound distinguishing attack on TNT and invalidated the proven security bound and proved a tight birthday bound security on the TNT construction in EUROCRYPT’24. In a recent work, Datta et al. have shown that four round cascading of the LRW1 construction, which they dubbed as \(\textsf {CLRW1}^4\) is a strong tweakable pseudorandom permutation that provably achieves 3n/4-bit security. In this paper, we propose a variant of the TNT construction, called b-TNT1, and proved its security up to \(2^{3n/4}\) queries. However, unlike \(\textsf {CLRW1}^4\) , b-TNT1 requires three block cipher calls along with a field multiplication. Besides, we also propose another variant of the TNT construction, called b-TNT2 and showed a similar security bound. Compared to b-TNT1, b-TNT2 requires four block cipher calls. Nevertheless, its execution of block cipher calls can be pipelined which makes it efficient over \(\textsf {CLRW1}^4\) . We have also experimentally verified that both b-TNT1 and b-TNT2 outperform \(\textsf {CLRW1}^4\) .