{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:44:38Z","timestamp":1760147078962,"version":"build-2065373602"},"reference-count":36,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2023,1,4]],"date-time":"2023-01-04T00:00:00Z","timestamp":1672790400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"],"award-info":[{"award-number":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"],"award-info":[{"award-number":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"NUPTSF","award":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"],"award-info":[{"award-number":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"]}]},{"name":"Henan Key Laboratory of Network Cryptography Technology","award":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"],"award-info":[{"award-number":["2019YFB2101704","61902195","62272238","61902194","62072207","62102196","NY219131","LNCT2020-A05"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>GCM-SIV2 is a nonce-based beyond-birthday-bound (BBB)-secure authenticated encryption (AE) mode introduced by Iwata and Minematsu at FSE 2017. However, it is built by combining two instances of GCM-SIV1 and needs eight keys, which increases the costs of hardware and software implementation. This paper aims to reduce these costs by optimizing components (such as key materials, hash calls, and block cipher calls) and proposes an optimal tradeoff between GCM-SIV1 and GCM-SIV2 called GCM-SIV1.5. Moreover, we introduce the faulty nonce setting to AE and prove the BBB security of GCM-SIV1.5 with graceful security degradation in the faulty nonce setting by mirror theory. Finally, we discuss advantages of GCM-SIV1.5.<\/jats:p>","DOI":"10.3390\/e25010107","type":"journal-article","created":{"date-parts":[[2023,1,4]],"date-time":"2023-01-04T05:02:30Z","timestamp":1672808550000},"page":"107","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["GCM-SIV1.5: Optimal Tradeoff between GCM-SIV1 and GCM-SIV2"],"prefix":"10.3390","volume":"25","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0647-0375","authenticated-orcid":false,"given":"Ping","family":"Zhang","sequence":"first","affiliation":[{"name":"School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing 210023, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2023,1,4]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Canteaut, A., and Viswanathan, K. (2004). The security and performance of the Galois\/Counter Mode (GCM) of operation. Progress in Cryptology\u2014 INDOCRYPT 2004, Springer.","DOI":"10.1007\/b104579"},{"key":"ref_2","unstructured":"Joux, A. (2022, September 17). Authentication Failures in NIST Version of GCM. Public Comments to NIST, Available online: https:\/\/csrc.nist.gov\/csrc\/media\/projects\/block-cipher-techniques\/documents\/bcm\/joux_comments.pdf."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Safavi-Naini, R., and Canetti, R. (2012). Breaking and repairing GCM security proofs. Advances in Cryptology\u2014CRYPTO 2012, Springer.","DOI":"10.1007\/978-3-642-32009-5"},{"key":"ref_4","unstructured":"Kutylowski, M., and Yung, M. (2012). The security and performance of GCM when short multiplications are used instead. Advances in Cryptology\u2014Inscrypt 2012, Springer."},{"key":"ref_5","unstructured":"Leander, G. (2015). GCM security bounds reconsidered. Advances in Cryptology\u2014FSE 2015, Springer."},{"key":"ref_6","unstructured":"Robshaw, M., and Katz, J. (2016). The multi-user security of authenticated encryption: AES-GCM in TLS 1.3. Advances in Cryptology\u2014CRYPTO 2016, Springer."},{"key":"ref_7","unstructured":"Katz, J., and Shacham, H. (2017). Boosting authenticated encryption robustness with minimal modifications. Advances in Cryptology\u2014CRYPTO 2017, Springer."},{"key":"ref_8","first-page":"9715947:1","article-title":"Close to optimally secure variants of GCM","volume":"2018","author":"Zhang","year":"2018","journal-title":"Secur. Commun. Netw."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Hoang, V.T., Tessaro, S., and Thiruvengadam, A. (2018, January 15\u201319). The multi-user security of GCM, revisited: Tight bounds for nonce randomization. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security\u2014CCS 2018, Toronto, ON, Canada.","DOI":"10.1145\/3243734.3243816"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"339","DOI":"10.1109\/JIOT.2019.2953230","article-title":"Comparison of three CPU-core families for IoT applications in terms of security and performance of AES-GCM","volume":"7","author":"Sovyn","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Gueron, S., and Lindell, Y. (2015, January 12\u201316). GCM-SIV: Full nonce misuse-resistant authenticated encryption at under one cycle per byte. Proceedings of the 2015 ACM SIGSAC Conference on Computer and Communications Security\u2014CCS 2015, Denver, CO, USA.","DOI":"10.1145\/2810103.2813613"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"134","DOI":"10.46586\/tosc.v2016.i1.134-157","article-title":"Stronger security variants of GCM-SIV","volume":"2016","author":"Iwata","year":"2016","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Gueron, S., Langley, A., and Lindell, Y. (2019). AES-GCM-SIV: Nonce Misuse-Resistant Authenticated Encryption, Crypto Forum Research Group. RFC 8452.","DOI":"10.17487\/RFC8452"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"240","DOI":"10.46586\/tosc.v2017.i4.240-267","article-title":"Reconsidering the security bound of AES-GCM-SIV","volume":"2017","author":"Iwata","year":"2017","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Gueron, S., and Lindell, Y. (November, January 30). Better bounds for block cipher modes of operation via nonce-based key derivation. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security\u2014CCS 2017, Dallas, TX, USA.","DOI":"10.1145\/3133956.3133992"},{"key":"ref_16","unstructured":"Nielsen, J.B., and Rijmen, V. (2018). Revisiting AES-GCM-SIV: Multi-user security, faster key derivation, and better bounds. Advances in Cryptology\u2014EUROCRYPT 2018, Springer."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Vaudenay, S. (2006). A provable-security treatment of the key-wrap problem. Advances in Cryptology\u2014EUROCRYPT 2006, Springer.","DOI":"10.1007\/11761679"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Sako, K., and Sarkar, P. (2013). Parallelizable and authenticated online ciphers. Advances in Cryptology\u2014ASIACRYPT 2013, Springer.","DOI":"10.1007\/978-3-642-42033-7"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"3318","DOI":"10.1109\/TC.2016.2529618","article-title":"ELmD: A pipelineable authenticated encryption and its hardware implementation","volume":"65","author":"Bossuet","year":"2016","journal-title":"IEEE Trans. Comput."},{"key":"ref_20","unstructured":"Robshaw, M., and Katz, J. (2016). Counter-in-Tweak: Authenticated encryption modes for tweakable block ciphers. Advances in Cryptology\u2014CRYPTO 2016, Springer."},{"key":"ref_21","unstructured":"Katz, J., and Shacham, H. (2017). ZMAC: A fast tweakable block cipher mode for highly secure message authentication. Advances in Cryptology\u2014CRYPTO 2017, Springer."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Tibouchi, M., and Wang, H. (2021). Toward a fully secure authenticated encryption scheme from a pseudorandom permutation. Advances in Cryptology\u2014ASIACRYPT 2021, Springer.","DOI":"10.1007\/978-3-030-92078-4_14"},{"key":"ref_23","unstructured":"Ishai, Y., and Rijmen, V. (2019). Beyond birthday bound secure MAC in faulty nonce model. Advances in Cryptology\u2014EUROCRYPT 2019, Springer."},{"key":"ref_24","unstructured":"Robshaw, M. (2006). New blockcipher modes of operation with beyond the birthday bound security. Advances in Cryptology\u2014FSE 2006, Springer."},{"key":"ref_25","unstructured":"Canteaut, A., and Ishai, Y. (2020). Lightweight authenticated encryption mode suitable for threshold implementation. Advances in Cryptology\u2014EUROCRYPT 2020, Springer."},{"key":"ref_26","unstructured":"Moriai, S., and Wang, H. (2020). Improved security analysis for nonce-based enhanced hash-then-mask MACs. Advances in Cryptology\u2014ASIACRYPT 2020, Springer."},{"key":"ref_27","unstructured":"Tibouchi, M., and Wang, H. (2021). Categorization of faulty nonce misuse resistant message authentication. Advances in Cryptology\u2014ASIACRYPT 2021, Springer."},{"key":"ref_28","unstructured":"Joux, A. (2011). The software performance of authenticated encryption modes. Advances in Cryptology\u2014FSE 2011, Springer."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"314","DOI":"10.46586\/tosc.v2018.i1.314-335","article-title":"Revisiting variable output length XOR pseudorandom function","volume":"2018","author":"Bhattacharya","year":"2018","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1272","DOI":"10.1007\/s00145-020-09347-y","article-title":"Tight security of cascaded LRW2","volume":"33","author":"Jha","year":"2020","journal-title":"J. Cryptol."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Avanzi, R.M., Keliher, L., and Sica, F. (2008). The \u201ccoefficients H\u201d technique. Selected Areas in Cryptography\u2014SAC 2008, Springer.","DOI":"10.1007\/978-3-642-04159-4"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"321","DOI":"10.1007\/s00200-017-0326-y","article-title":"Mirror theory and cryptography","volume":"28","author":"Patarin","year":"2017","journal-title":"Appl. Algebra Eng. Commun. Comput."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Nachef, V., Patarin, J., and Volte, E. (2017). Introduction to mirror theory. Feistel Ciphers, Springer.","DOI":"10.1007\/978-3-319-49530-9"},{"key":"ref_34","unstructured":"Patarin, J. (2022, September 17). Introduction to Mirror Theory: Analysis of Systems of Linear Equalities and Linear Non Equalities for Cryptography. Available online: http:\/\/eprint.iacr.org\/2010\/287."},{"key":"ref_35","unstructured":"Canteaut, A., and Ishai, Y. (2020). Tight security bounds for double-block hash-then-sum MACs. Advances in Cryptology\u2014EUROCRYPT 2020, Springer."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Nguyen, P.Q., and Oswald, E. (2014). Reconsidering generic composition. Advances in Cryptology\u2014EUROCRYPT 2014, Springer.","DOI":"10.1007\/978-3-642-55220-5"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/1\/107\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T17:58:38Z","timestamp":1760119118000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/1\/107"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,4]]},"references-count":36,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,1]]}},"alternative-id":["e25010107"],"URL":"https:\/\/doi.org\/10.3390\/e25010107","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2023,1,4]]}}}