At EUROCRYPT’20, Bao et al. have shown that three-round cascading of LRW1 construction, which they dubbed as TNT, is a strong tweakable pseudorandom permutation that provably achieves 2n/3-bit security bound. Jha et al. showed a birthday bound distinguishing attack on TNT and invalidated the proven security bound and proved a tight birthday bound security on the TNT construction in EUROCRYPT’24. In a recent work, Datta et al. have shown that four round cascading of the LRW1 construction, which they dubbed as \(\textsf {CLRW1}^4\) is a strong tweakable pseudorandom permutation that provably achieves 3n/4-bit security. In this paper, we propose a variant of the TNT construction, called b-TNT1, and proved its security up to \(2^{3n/4}\) queries. However, unlike \(\textsf {CLRW1}^4\) , b-TNT1 requires three block cipher calls along with a field multiplication. Besides, we also propose another variant of the TNT construction, called b-TNT2 and showed a similar security bound. Compared to b-TNT1, b-TNT2 requires four block cipher calls. Nevertheless, its execution of block cipher calls can be pipelined which makes it efficient over \(\textsf {CLRW1}^4\) . We have also experimentally verified that both b-TNT1 and b-TNT2 outperform \(\textsf {CLRW1}^4\) .

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Efficient Variants of TNT with BBB Security

  • Ritam Bhaumik,
  • Wonseok Choi,
  • Avijit Dutta,
  • Cuauhtemoc Mancillas López,
  • Hrithik Nandi,
  • Yaobin Shen

摘要

At EUROCRYPT’20, Bao et al. have shown that three-round cascading of LRW1 construction, which they dubbed as TNT, is a strong tweakable pseudorandom permutation that provably achieves 2n/3-bit security bound. Jha et al. showed a birthday bound distinguishing attack on TNT and invalidated the proven security bound and proved a tight birthday bound security on the TNT construction in EUROCRYPT’24. In a recent work, Datta et al. have shown that four round cascading of the LRW1 construction, which they dubbed as \(\textsf {CLRW1}^4\) is a strong tweakable pseudorandom permutation that provably achieves 3n/4-bit security. In this paper, we propose a variant of the TNT construction, called b-TNT1, and proved its security up to \(2^{3n/4}\) queries. However, unlike \(\textsf {CLRW1}^4\) , b-TNT1 requires three block cipher calls along with a field multiplication. Besides, we also propose another variant of the TNT construction, called b-TNT2 and showed a similar security bound. Compared to b-TNT1, b-TNT2 requires four block cipher calls. Nevertheless, its execution of block cipher calls can be pipelined which makes it efficient over \(\textsf {CLRW1}^4\) . We have also experimentally verified that both b-TNT1 and b-TNT2 outperform \(\textsf {CLRW1}^4\) .