{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,27]],"date-time":"2026-10-27T12:01:08Z","timestamp":1793102468487,"version":"4.5.0"},"reference-count":39,"publisher":"International Association for Cryptologic Research","issue":"4","license":[{"start":{"date-parts":[[2024,10,1]],"date-time":"2024-10-01T00:00:00Z","timestamp":1727740800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2024,12,3]]},"abstract":"<jats:p>Robust message authentication codes (MACs) and authenticated encryption (AE) schemes that provide authenticity in the presence of side-channel leakage are essential primitives. These constructions often rely on primitives designed for strong leakage protection, among others including the use of strong-unpredictable (tweakable) block-ciphers.     This paper extends the strong-unpredictability security definition to the versatile and new forkcipher primitive.     We show how to construct secure and efficient MAC and AEs that guarantee authenticity in the presence of leakage. We present a leakage-resistant MAC, ForkMAC, and two leakage-resistant AE schemes, ForkDTE1 and ForkDTE2, which use forkciphers instead of traditional secure (tweakable) block-ciphers as compared to the prior art.     We prove and analyze their security in the presence of leakage based on a strong unpredictable forkcipher.     A comparison with the state-of-the-art in terms of both security and efficiency is included in the paper.     Key advantages and highlights promoted by the proposed constructions are that for the minimal assumptions they require, unpredictability with leakage-based security, the tag-generation of ForkMAC is the most efficient among leakage-resilient MAC proposals, like the block cipher based HBC.     ForkDTE1 and 2 have a more efficient encryption than any other scheme, achieving integrity with leakage (and also providing misuse-resistance).<\/jats:p>","DOI":"10.62056\/abksr-10k","type":"journal-article","created":{"date-parts":[[2025,1,13]],"date-time":"2025-01-13T12:00:52Z","timestamp":1736769652000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":3,"title":["Authenticity in the Presence of Leakage using a Forkcipher"],"prefix":"10.62056","volume":"1","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3558-7177","authenticated-orcid":false,"given":"Francesco","family":"Berti","sequence":"first","affiliation":[{"id":[{"id":"https:\/\/ror.org\/02495e989","id-type":"ROR","asserted-by":"publisher"}],"name":"Bar-Ilan University","place":["Ramat Gan, Israel"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7444-0285","authenticated-orcid":false,"given":"Fran\u00e7ois-Xavier","family":"Standaert","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/031v4g827","id-type":"ROR","asserted-by":"publisher"}],"name":"UCLouvain, ICTEAM\/ELEN\/Crypto Group","place":["Louvain-la-Neuve, 1348, Belgium"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5591-5799","authenticated-orcid":false,"given":"Itamar","family":"Levi","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/02495e989","id-type":"ROR","asserted-by":"publisher"}],"name":"Bar-Ilan University","place":["Ramat Gan, Israel"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"48349","published-online":{"date-parts":[[2025,1,13]]},"reference":[{"key":"ref1:KatzLindell2014","isbn-type":"print","doi-asserted-by":"crossref","DOI":"10.1201\/b17668","volume-title":"Introduction to Modern Cryptography, Second Edition","author":"Jonathan Katz","year":"2014","ISBN":"https:\/\/id.crossref.org\/isbn\/9781466570269"},{"key":"ref2:crypto\/Kocher96","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"104","DOI":"10.1007\/3-540-68697-5_9","article-title":"Timing Attacks on Implementations of Diffie-Hellman, RSA,\n  DSS, and Other Systems","volume":"1109","author":"Paul C. Kocher","year":"1996"},{"key":"ref3:crypto\/KocherJJ99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"388","DOI":"10.1007\/3-540-48405-1_25","article-title":"Differential Power Analysis","volume":"1666","author":"Paul C. Kocher","year":"1999"},{"key":"ref4:esmart\/QuisquaterS01","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"200","DOI":"10.1007\/3-540-45418-7_17","article-title":"ElectroMagnetic Analysis (EMA): Measures and\n  Counter-Measures for Smart Cards","volume":"2140","author":"Jean-Jacques Quisquater","year":"2001"},{"key":"ref5:tches\/BertiBBHPSU22","doi-asserted-by":"publisher","first-page":"461","DOI":"10.46586\/TCHES.V2022.I1.461-481","article-title":"A Finer-Grain Analysis of the Leakage (Non) Resilience of\n  OCB","volume":"2022","author":"Francesco Berti","year":"2022","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref6:eurocrypt\/DobraunigM21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"377","DOI":"10.1007\/978-3-030-77886-6_13","article-title":"Leakage Resilient Value Comparison with Application to\n  Message Authentication","volume":"12697","author":"Christoph Dobraunig","year":"2021"},{"key":"ref7:tosc\/BertiPPS17","doi-asserted-by":"publisher","first-page":"271","DOI":"10.13154\/TOSC.V2017.I3.271-293","article-title":"On Leakage-Resilient Authenticated Encryption with\n  Decryption Leakages","volume":"2017","author":"Francesco Berti","year":"2017","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref8:eurocrypt\/GoudarziR17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"567","DOI":"10.1007\/978-3-319-56620-7_20","article-title":"How Fast Can Higher-Order Masking Be in Software?","volume":"10210","author":"Dahmun Goudarzi","year":"2017"},{"key":"ref9:ches\/JournaultS17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"623","DOI":"10.1007\/978-3-319-66787-4_30","article-title":"Very High Order Masking: Efficient Implementation and\n  Security Evaluation","volume":"10529","author":"Anthony Journault","year":"2017"},{"key":"ref10:salomon2023masksimd","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1007\/S13389-023-00322-4","article-title":"MaskSIMD-lib: on the performance gap of a generic C\n  optimized assembly and wide vector extensions for masked software with an\n  Ascon-p test case","volume":"13","author":"Dor Salomon","year":"2023","journal-title":"J. Cryptogr. Eng."},{"key":"ref11:cassiers2020hardware","doi-asserted-by":"publisher","first-page":"1677","DOI":"10.1109\/TC.2020.3022979","article-title":"Hardware Private Circuits: From Trivial Composition to Full\n  Verification","volume":"70","author":"Ga\u00ebtan Cassiers","year":"2021","journal-title":"IEEE Trans. Computers"},{"key":"ref12:cisc\/BertiGPPS19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"517","DOI":"10.1007\/978-3-030-42921-8_31","article-title":"Strong Authenticity with Leakage Under Weak and Falsifiable\n  Physical Assumptions","volume":"12020","author":"Francesco Berti","year":"2019"},{"key":"ref13:crypto\/DodisS09","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"267","DOI":"10.1007\/978-3-642-03356-8_16","article-title":"Message Authentication Codes from Unpredictable Block\n  Ciphers","volume":"5677","author":"Yevgeniy Dodis","year":"2009"},{"key":"ref14:joc\/LiskovRW11","doi-asserted-by":"publisher","first-page":"588","DOI":"10.1007\/S00145-010-9073-Y","article-title":"Tweakable Block Ciphers","volume":"24","author":"Moses D. Liskov","year":"2011","journal-title":"J. Cryptol."},{"key":"ref15:asiacrypt\/BertiGPS21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1007\/978-3-030-92075-3_4","article-title":"Efficient Leakage-Resilient MACs Without Idealized\n  Assumptions","volume":"13091","author":"Francesco Berti","year":"2021"},{"key":"ref16:asiacrypt\/0001LPR0V19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"153","DOI":"10.1007\/978-3-030-34621-8_6","article-title":"Forkcipher: A New Primitive for Authenticated Encryption\n  of Very Short Messages","volume":"11922","author":"Elena Andreeva","year":"2019"},{"key":"ref17:tosc\/0001BPV21","doi-asserted-by":"publisher","first-page":"1","DOI":"10.46586\/TOSC.V2021.I3.1-35","article-title":"1, 2, 3, Fork: Counter Mode Variants based on a Generalized\n  Forkcipher","volume":"2021","author":"Elena Andreeva","year":"2021","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref18:acns\/0001CLMP024","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"433","DOI":"10.1007\/978-3-031-54773-7_17","article-title":"Masked Iterate-Fork-Iterate: A New Design Paradigm for\n  Tweakable Expanding Pseudorandom Function","volume":"14584","author":"Elena Andreeva","year":"2024"},{"key":"ref19:iacr\/AndreevaRVV18","first-page":"916","article-title":"Forking a Blockcipher for Authenticated Encryption of Very\n  Short Messages","author":"Elena Andreeva","year":"2018","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref20:acns\/AndreevaW23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/978-3-031-33491-7_1","article-title":"A Forkcipher-Based Pseudo-Random Number Generator","volume":"13906","author":"Elena Andreeva","year":"2023"},{"key":"ref21:icics\/BhattacharjeeBDL23","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1007\/978-981-99-7356-9_5","article-title":"PAE: Towards More Efficient and BBB-Secure AE from a\n  Single Public Permutation","volume":"14252","author":"Arghya Bhattacharjee","year":"2023"},{"key":"ref22:iacr\/DuttaGL22","first-page":"1609","article-title":"Forking Sums of Permutations for Optimally Secure and Highly\n  Efficient PRFs","author":"Avijit Dutta","year":"2022","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref23:cic\/DattaDLM24","doi-asserted-by":"publisher","first-page":"21","DOI":"10.62056\/AKGYL86BM","article-title":"FEDT: Forkcipher-based Leakage-resilient\n  Beyond-birthday-secure AE","volume":"1","author":"Nilanjan Datta","year":"2024","journal-title":"IACR Commun. Cryptol."},{"key":"ref24:tches\/BertiGPPS20","doi-asserted-by":"publisher","first-page":"256","DOI":"10.13154\/TCHES.V2020.I1.256-320","article-title":"TEDT, a Leakage-Resist AEAD Mode for High Physical\n  Security Applications","volume":"2020","author":"Francesco Berti","year":"2020","journal-title":"IACR Trans. Cryptogr. Hardw. Embed. Syst."},{"key":"ref25:eurocrypt\/RogawayS06","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"373","DOI":"10.1007\/11761679_23","article-title":"A Provable-Security Treatment of the Key-Wrap Problem","volume":"4004","author":"Phillip Rogaway","year":"2006"},{"key":"ref26:ccs\/PereiraSV15","doi-asserted-by":"publisher","first-page":"96","DOI":"10.1145\/2810103.2813626","article-title":"Leakage-Resilient Authentication and Encryption from\n  Symmetric Cryptographic Primitives","author":"Olivier Pereira","year":"2015"},{"key":"ref27:crypto\/BellareNT19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"235","DOI":"10.1007\/978-3-030-26948-7_9","article-title":"Nonces Are Noticed: AEAD Revisited","volume":"11692","author":"Mihir Bellare","year":"2019"},{"key":"ref28:ccs\/BertiKPPS18","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1145\/3196494.3196525","article-title":"Ciphertext Integrity with Misuse and Leakage: Definition and\n  Efficient Constructions with Symmetric Primitives","author":"Francesco Berti","year":"2018"},{"key":"ref29:eurocrypt\/DodisS11","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"323","DOI":"10.1007\/978-3-642-20465-4_19","article-title":"Domain Extension for MACs Beyond the Birthday Barrier","volume":"6632","author":"Yevgeniy Dodis","year":"2011"},{"key":"ref30:DBLP:conf\/ccs\/BhatiPA0P23","doi-asserted-by":"publisher","first-page":"2546","DOI":"10.1145\/3576915.3623091","article-title":"Let's Go Eevee! A Friendly and Suitable Family of AEAD\n  Modes for IoT-to-Cloud Secure Computation","author":"Amit Singh Bhati","year":"2023"},{"key":"ref31:tosc\/DobraunigEMMU17","doi-asserted-by":"publisher","first-page":"80","DOI":"10.13154\/TOSC.V2017.I1.80-105","article-title":"ISAP - Towards Side-Channel Secure Authenticated\n  Encryption","volume":"2017","author":"Christoph Dobraunig","year":"2017","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref32:DBLP:journals\/iacr\/AndreevaRVV18","first-page":"916","article-title":"Forking a Blockcipher for Authenticated Encryption of Very\n  Short Messages","author":"Elena Andreeva","year":"2018","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref33:DBLP:conf\/acns\/BanikBJLLMRSS19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1007\/978-3-030-21568-2_3","article-title":"Cryptanalysis of ForkAES","volume":"11464","author":"Subhadeep Banik","year":"2019"},{"key":"ref34:latincrypt\/List21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"275","DOI":"10.1007\/978-3-030-88238-9_14","article-title":"TEDT2 - Highly Secure Leakage-Resilient TBC-Based\n  Authenticated Encryption","volume":"12912","author":"Eik List","year":"2021"},{"key":"ref35:tosc\/BelliziaBBCDGLL20","doi-asserted-by":"publisher","first-page":"295","DOI":"10.13154\/TOSC.V2020.IS1.295-349","article-title":"Spook: Sponge-Based Leakage-Resistant Authenticated\n  Encryption with a Masked Tweakable Block Cipher","volume":"2020","author":"Davide Bellizia","year":"2020","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref36:africacrypt\/BertiPS19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"229","DOI":"10.1007\/978-3-030-23696-0_12","article-title":"Reducing the Cost of Authenticity with Leakages: a\n  \\mathsf CIML2 -Secure \\mathsf AE Scheme\n  with One Call to a Strongly Protected Tweakable Block Cipher","volume":"11627","author":"Francesco Berti","year":"2019"},{"key":"ref37:tosc\/BertiGPSS23","doi-asserted-by":"publisher","first-page":"288","DOI":"10.46586\/TOSC.V2023.I1.288-315","article-title":"Secure Message Authentication in the Presence of Leakage and\n  Faults","volume":"2023","author":"Francesco Berti","year":"2023","journal-title":"IACR Trans. Symmetric Cryptol."},{"key":"ref38:fse\/RogawayS04","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"371","DOI":"10.1007\/978-3-540-25937-4_24","article-title":"Cryptographic Hash-Function Basics: Definitions,\n  Implications, and Separations for Preimage Resistance, Second-Preimage\n  Resistance, and Collision Resistance","volume":"3017","author":"Phillip Rogaway","year":"2004"},{"key":"ref39:ccs\/Rogaway02","doi-asserted-by":"publisher","first-page":"98","DOI":"10.1145\/586110.586125","article-title":"Authenticated-encryption with associated-data","author":"Phillip Rogaway","year":"2002"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2025,1,13]],"date-time":"2025-01-13T12:11:22Z","timestamp":1736770282000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/1\/4\/13"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1,13]]},"references-count":39,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,1,13]]}},"URL":"https:\/\/doi.org\/10.62056\/abksr-10k","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,1,13]]},"assertion":[{"value":"2024-10-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-12-03","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc1-4-19"}}