{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T04:58:15Z","timestamp":1769921895691,"version":"3.49.0"},"reference-count":46,"publisher":"International Association for Cryptologic Research","license":[{"start":{"date-parts":[[2024,4,9]],"date-time":"2024-04-09T00:00:00Z","timestamp":1712620800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2024,6,3]]},"abstract":"There has been a notable surge of research on leakage-resilient authenticated encryption (AE) schemes, in the bounded as well as the unbounded leakage model. The latter has garnered significant attention due to its detailed and practical orientation. Designers have commonly utilized (tweakable) block ciphers, exemplified by the TEDT scheme, achieving \n \n \ud835\udcaa<\/mml:mi>\n (<\/mml:mo>\n n<\/mml:mi>\n \u2212<\/mml:mo>\n log<\/mml:mi>\n (<\/mml:mo>\n \n n<\/mml:mi>\n 2<\/mml:mn>\n <\/mml:msup>\n )<\/mml:mo>\n )<\/mml:mo>\n <\/mml:mrow>\n <\/mml:math>-bit integrity under leakage and comparable AE security in the black-box setting. However, the privacy of TEDT was limited by \n \n n<\/mml:mi>\n \/<\/mml:mo>\n 2<\/mml:mn>\n <\/mml:mrow>\n <\/mml:math>-bits under leakage; TEDT2 sought to overcome these limitations by achieving improved security with \n \n \ud835\udcaa<\/mml:mi>\n (<\/mml:mo>\n n<\/mml:mi>\n \u2212<\/mml:mo>\n log<\/mml:mi>\n n<\/mml:mi>\n )<\/mml:mo>\n <\/mml:mrow>\n <\/mml:math>-bit integrity and privacy under leakage.<\/jats:p>\n This work introduces FEDT, an efficient leakage-resilient authenticated encryption (AE) scheme based on fork-cipher. Compared to the state-of-the-art schemes TEDT and TEDT2, which process messages with a rate of \n \n 1<\/mml:mn>\n \/<\/mml:mo>\n 2<\/mml:mn>\n <\/mml:mrow>\n <\/mml:math> block per primitive call for encryption and one for authentication, FEDT doubles their rates at the price of a different primitive. FEDT employs a more parallelizable tree-based encryption compared to its predecessors while maintaining \n \n \ud835\udcaa<\/mml:mi>\n (<\/mml:mo>\n n<\/mml:mi>\n \u2212<\/mml:mo>\n log<\/mml:mi>\n n<\/mml:mi>\n )<\/mml:mo>\n <\/mml:mrow>\n <\/mml:math>-bit security for both privacy and integrity under leakage. FEDT prioritizes high throughput at the cost of increased latency. For settings where latency is important, we propose FEDT*, which combines the authentication part of FEDT with a CTR-based encryption. FEDT* offers security equivalent to FEDT while increasing the encryption rate of \n \n 4<\/mml:mn>\n \/<\/mml:mo>\n 3<\/mml:mn>\n <\/mml:mrow>\n <\/mml:math> and reducing the latency. <\/jats:p>","DOI":"10.62056\/akgyl86bm","type":"journal-article","created":{"date-parts":[[2024,7,8]],"date-time":"2024-07-08T15:52:04Z","timestamp":1720453924000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":5,"title":["FEDT: Forkcipher-based Leakage-resilient Beyond-birthday-secure AE"],"prefix":"10.62056","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-9761-1192","authenticated-orcid":false,"given":"Nilanjan","family":"Datta","sequence":"first","affiliation":[{"name":"Institute for Advancing Intelligence, TCG CREST","place":["Kolkata, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Avijit","family":"Dutta","sequence":"additional","affiliation":[{"name":"Institute for Advancing Intelligence, TCG CREST","place":["Kolkata, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0369-4901","authenticated-orcid":false,"given":"Eik","family":"List","sequence":"additional","affiliation":[{"name":"Independent Researcher","place":["Singapore, Singapore"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sougata","family":"Mandal","sequence":"additional","affiliation":[{"name":"Institute for Advancing Intelligence, TCG CREST","place":["Kolkata, India"]},{"name":"Ramakrishna Mission Vivekananda Educational and Research Institute","place":["Kolkata, India"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"48349","published-online":{"date-parts":[[2024,7,8]]},"reference":[{"key":"ref1:DBLP:conf\/asiacrypt\/BellareN00","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"531","DOI":"10.1007\/3-540-44448-3_41","article-title":"Authenticated Encryption: Relations among Notions and\n Analysis of the Generic Composition Paradigm","volume-title":"ASIACRYPT","volume":"1976","author":"Mihir Bellare","year":"2000"},{"key":"ref2:DBLP:conf\/ccs\/Rogaway02","doi-asserted-by":"publisher","first-page":"98","DOI":"10.1145\/586110.586125","article-title":"Authenticated-encryption with associated-data","volume-title":"CCS","author":"Phillip Rogaway","year":"2002"},{"key":"ref3:online","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"292","DOI":"10.1007\/3-540-44647-8_18","article-title":"Online Ciphers and the Hash-CBC Construction","volume-title":"CRYPTO","volume":"2139","author":"Mihir Bellare","year":"2001"},{"key":"ref4:DBLP:conf\/crypto\/HoangRRV15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"493","DOI":"10.1007\/978-3-662-47989-6_24","article-title":"Online Authenticated-Encryption and its Nonce-Reuse\n Misuse-Resistance","volume-title":"CRYPTO I","volume":"9215","author":"Viet Tung Hoang","year":"2015"},{"key":"ref5:nm","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"373","DOI":"10.1007\/11761679_23","article-title":"A Provable-Security Treatment of the Key-Wrap Problem","volume-title":"EUROCRYPT","volume":"4004","author":"Phillip Rogaway","year":"2006"},{"key":"ref6:caesar","article-title":"CAESAR: Competition for Authenticated Encryption: Security,\n Applicability, and Robustness","author":"Daniel J. Bernstein","year":"2014"},{"key":"ref7:nistlwc","article-title":"NIST IR 8454 \u2013 Status Report on the Final Round of the\n NIST Lightweight Cryptography Standardization Process","author":"Meltem S\u00f6nmez Turan","year":"2023"},{"key":"ref8:faulty","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"437","DOI":"10.1007\/978-3-030-17653-2_15","article-title":"Beyond Birthday Bound Secure MAC in Faulty Nonce Model","volume-title":"EUROCRYPT I","volume":"11476","author":"Avijit Dutta","year":"2019"},{"key":"ref9:rupae","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"105","DOI":"10.1007\/978-3-662-45611-8_6","article-title":"How to Securely Release Unverified Plaintext in\n Authenticated Encryption","volume-title":"ASIACRYPT I","volume":"8873","author":"Elena Andreeva","year":"2014"},{"key":"ref10:aerup","doi-asserted-by":"publisher","first-page":"119","DOI":"10.13154\/tosc.v2019.i4.119-146","article-title":"Release of Unverified Plaintext: Tight Unified Model and\n Application to ANYDAE","volume":"2019","author":"Donghoon Chang","year":"2019","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref11:DBLP:conf\/crypto\/KocherJJ99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"388","DOI":"10.1007\/3-540-48405-1_25","article-title":"Differential Power Analysis","volume-title":"CRYPTO","volume":"1666","author":"Paul C. Kocher","year":"1999"},{"key":"ref12:ocb","doi-asserted-by":"publisher","first-page":"196","DOI":"10.1145\/501983.502011","article-title":"OCB: a block-cipher mode of operation for efficient\n authenticated encryption","volume-title":"CCS","author":"Phillip Rogaway","year":"2001"},{"key":"ref13:krovetz:2016","article-title":"OCB (v1.1)","author":"Ted Krovetz","year":"2016","journal-title":"Submission to the CAESAR Competition"},{"key":"ref14:gcm","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"343","DOI":"10.1007\/978-3-540-30556-9_27","article-title":"The Security and Performance of the Galois\/Counter Mode\n (GCM) of Operation","volume-title":"INDOCRYPT","volume":"3348","author":"David A. McGrew","year":"2004"},{"key":"ref15:dworkin:2007","article-title":"NIST Special Publication 800-38D \u2013 Recommendation for\n block cipher modes of operation: Galois\/Counter Mode (GCM) and GMAC","author":"Morris Dworkin","year":"2007"},{"key":"ref16:ccm","article-title":"NIST Special Publication 800-38C \u2013 Recommendation for\n Block Cipher Modes of Operation: The CCM Mode for Authentication and\n Confidentiality [including updates through 7\/20\/2007]","author":"Morris Dworkin","year":"2004"},{"key":"ref17:DBLP:conf\/crypto\/ChariJRR99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"398","DOI":"10.1007\/3-540-48405-1_26","article-title":"Towards Sound Approaches to Counteract Power-Analysis\n Attacks","volume-title":"CRYPTO","volume":"1666","author":"Suresh Chari","year":"1999"},{"key":"ref18:DBLP:conf\/ches\/GoubinP99","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"158","DOI":"10.1007\/3-540-48059-5_15","article-title":"DES and Differential Power Analysis (The \"Duplication\"\n Method)","volume-title":"CHES","volume":"1717","author":"Louis Goubin","year":"1999"},{"key":"ref19:DBLP:conf\/acns\/HerbstOM06","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"239","DOI":"10.1007\/11767480_16","article-title":"An AES Smart Card Implementation Resistant to Power\n Analysis Attacks","volume-title":"ACNS","volume":"3989","author":"Christoph Herbst","year":"2006"},{"key":"ref20:DBLP:conf\/asiacrypt\/Veyrat-CharvillonMKS12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"740","DOI":"10.1007\/978-3-642-34961-4_44","article-title":"Shuffling against Side-Channel Attacks: A Comprehensive\n Study with Cautionary Note","volume-title":"ASIACRYPT","volume":"7658","author":"Nicolas Veyrat-Charvillon","year":"2012"},{"key":"ref21:DBLP:conf\/ches\/GrossoSF13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"400","DOI":"10.1007\/978-3-642-40349-1_23","article-title":"Masking vs. Multiparty Computation: How Large Is the Gap\n for AES?","volume-title":"CHES","volume":"8086","author":"Vincent Grosso","year":"2013"},{"key":"ref22:bmos17","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"693","DOI":"10.1007\/978-3-319-70694-8_24","article-title":"Authenticated Encryption in the Face of Protocol and Side\n Channel Leakage","volume-title":"ASIACRYPT I","volume":"10624","author":"Guy Barwell","year":"2017"},{"key":"ref23:ciml","doi-asserted-by":"publisher","first-page":"37","DOI":"10.1145\/3196494.3196525","article-title":"Ciphertext Integrity with Misuse and Leakage: Definition\n and Efficient Constructions with Symmetric Primitives","volume-title":"AsiaCCS","author":"Francesco Berti","year":"2018"},{"key":"ref24:CIML2","doi-asserted-by":"publisher","first-page":"271","DOI":"10.13154\/tosc.v2017.i3.271-293","article-title":"On Leakage-Resilient Authenticated Encryption with\n Decryption Leakages","volume":"2017","author":"Francesco Berti","year":"2017","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref25:dem+17","doi-asserted-by":"publisher","first-page":"80","DOI":"10.13154\/tosc.v2017.i1.80-105","article-title":"ISAP \u2013 Towards Side-Channel Secure Authenticated\n Encryption","volume":"2017","author":"Christoph Dobraunig","year":"2017","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref26:Berti19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"229","DOI":"10.1007\/978-3-030-23696-0_12","article-title":"Reducing the Cost of Authenticity with Leakages: a\n CIML2-Secure AE Scheme with One Call to a Strongly Protected Tweakable Block\n Cipher","volume-title":"AFRICACRYPT","volume":"11627","author":"Francesco Berti","year":"2019"},{"key":"ref27:CCAmL1","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"150","DOI":"10.1007\/978-3-030-30530-7_8","article-title":"Authenticated Encryption with Nonce Misuse and Physical\n Leakage: Definitions, Separation Results and First Construction - (Extended\n Abstract)","volume-title":"LATINCRYPT","volume":"11774","author":"Chun Guo","year":"2019"},{"key":"ref28:Guo19eprint","article-title":"Authenticated Encryption with Nonce Misuse and Physical\n Leakages: Definitions, Separation Results, and Leveled Constructions","author":"Chun Guo","year":"2018"},{"key":"ref29:Reduction-to-single-block-SPA","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"369","DOI":"10.1007\/978-3-030-56784-2_13","article-title":"Mode-Level vs. Implementation-Level Physical Security in\n Symmetric Cryptography - A Practical Guide Through the Leakage-Resistance\n Jungle","volume-title":"CRYPTO I","volume":"12170","author":"Davide Bellizia","year":"2020"},{"key":"ref30:TEDT","doi-asserted-by":"publisher","first-page":"256","DOI":"10.13154\/tches.v2020.i1.256-320","article-title":"TEDT, a Leakage-Resistant AEAD Mode for High Physical\n Security Applications","volume":"2020","author":"Francesco Berti","year":"2020","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n Systems"},{"key":"ref31:TEDT2","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"275","DOI":"10.1007\/978-3-030-88238-9_14","article-title":"TEDT2 \u2013 Highly Secure Leakage-Resilient TBC-Based\n Authenticated Encryption","volume-title":"LATINCRYPT","volume":"12912","author":"Eik List","year":"2021"},{"key":"ref32:dem+20","doi-asserted-by":"publisher","first-page":"390","DOI":"10.13154\/tosc.v2020.iS1.390-416","article-title":"Isap v2.0","volume":"2020","author":"Christoph Dobraunig","year":"2020","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref33:triplex","doi-asserted-by":"publisher","first-page":"135","DOI":"10.46586\/tches.v2022.i4.135-162","article-title":"Triplex: an Efficient and One-Pass Leakage-Resistant Mode\n of Operation","volume":"2022","author":"Yaobin Shen","year":"2022","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n Systems"},{"key":"ref34:multiplex","doi-asserted-by":"publisher","first-page":"1","DOI":"10.46586\/tosc.v2024.i2.1-34","article-title":"Multiplex: TBC-Based Authenticated Encryption with\n Sponge-Like Rate","volume":"2024","author":"Yaobin Shen","year":"2024","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref35:tweplex","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"25","DOI":"10.1007\/978-3-031-56232-7_2","article-title":"On the Security of Triplex- and Multiplex-Type\n Constructions with Smaller Tweaks","volume-title":"INDOCRYPT I","volume":"14459","author":"Nilanjan Datta","year":"2023"},{"key":"ref36:hirose","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"210","DOI":"10.1007\/11799313_14","article-title":"Some Plausible Constructions of Double-Block-Length Hash\n Functions","volume-title":"FSE","volume":"4047","author":"Shoichi Hirose","year":"2006"},{"key":"ref37:Naito19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"65","DOI":"10.1007\/978-3-030-30530-7_4","article-title":"Optimally Indifferentiable Double-Block-Length Hashing\n Without Post-processing and with Support for Longer Key Than Single Block","volume-title":"LATINCRYPT","volume":"11774","author":"Yusuke Naito","year":"2019"},{"key":"ref38:DBLP:conf\/asiacrypt\/0001LPR0V19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"153","DOI":"10.1007\/978-3-030-34621-8_6","article-title":"Forkcipher: A New Primitive for Authenticated Encryption of\n Very Short Messages","volume-title":"ASIACRYPT II","volume":"11922","author":"Elena Andreeva","year":"2019"},{"key":"ref39:aetlr","article-title":"AET-LR: Rate-1 Leakage-Resilient AEAD based on the Romulus\n Family","volume-title":"NIST LWC Workshop","author":"Chun Guo","year":"2020"},{"key":"ref40:DBLP:conf\/stoc\/Ostrovsky90","doi-asserted-by":"publisher","first-page":"514","DOI":"10.1145\/100216.100289","article-title":"Efficient Computation on Oblivious RAMs","volume-title":"STOC","author":"Rafail Ostrovsky","year":"1990"},{"key":"ref41:Bellare03","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/3-540-36563-X_1","article-title":"Forward-Security in Private-Key Cryptography","volume-title":"CT-RSA","volume":"2612","author":"Mihir Bellare","year":"2003"},{"key":"ref42:Pereira15","doi-asserted-by":"publisher","first-page":"96","DOI":"10.1145\/2810103.2813626","article-title":"Leakage-Resilient Authentication and Encryption from\n Symmetric Cryptographic Primitives","volume-title":"CCS","author":"Olivier Pereira","year":"2015"},{"key":"ref43:Hirose07","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"113","DOI":"10.1007\/978-3-540-76900-2_7","article-title":"A Simple Variant of the Merkle-Damg\u00e5rd Scheme with a\n Permutation","volume-title":"ASIACRYPT","volume":"4833","author":"Shoichi Hirose","year":"2007"},{"key":"ref44:DBLP:conf\/asiacrypt\/BertiGPS21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1007\/978-3-030-92075-3_4","article-title":"Efficient Leakage-Resilient MACs Without Idealized\n Assumptions","volume-title":"ASIACRYPT II","volume":"13091","author":"Francesco Berti","year":"2021"},{"key":"ref45:DBLP:conf\/cisc\/BertiGPPS19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"517","DOI":"10.1007\/978-3-030-42921-8_31","article-title":"Strong Authenticity with Leakage Under Weak and Falsifiable\n Physical Assumptions","volume-title":"Inscrypt","volume":"12020","author":"Francesco Berti","year":"2019"},{"key":"ref46:DBLP:journals\/tosc\/GuoPPS20","doi-asserted-by":"publisher","first-page":"6","DOI":"10.13154\/tosc.v2020.i1.6-42","article-title":"Towards Low-Energy Leakage-Resistant Authenticated\n Encryption from the Duplex Sponge Construction","volume":"2020","author":"Chun Guo","year":"2020","journal-title":"IACR Transactions on Symmetric Cryptology"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2024,12,10]],"date-time":"2024-12-10T21:27:00Z","timestamp":1733866020000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/1\/2\/21"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,8]]},"references-count":46,"URL":"https:\/\/doi.org\/10.62056\/akgyl86bm","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7,8]]},"assertion":[{"value":"2024-04-09","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-06-03","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc1-2-73"}}