Analysis and Design of Authenticated Encryption Schemes

虽然大多数人认为机密性是密码学的主要目标，但消息身份验证也同样重要。密码学家很早就意识到隐私和完整性目标的重要性。然而，解决实现保密和完整性问题的传统方法是孤立地考虑这两个目标；安全研究人员设计了加密方案来保护数字通信的隐私，并自主设计了消息验证码来保护其完整性。近年来，由于错误地应用了机密性和真实性原语，导致了一系列灾难性的攻击。因此，继美国国家标准与技术研究所（NIST）高级加密标准（AES）竞赛、欧盟eStream竞赛和NIST SHA-3哈希函数竞赛之后，由NIST资助的新的身份验证加密竞赛：安全性、适用性和鲁棒性（CAESAR）宣布。虽然这个竞赛相对较新，但它促进了密码学研究界考虑身份验证加密（AE）原语的分析和设计。竞赛的第一阶段于2014年3月开始，共收到57份参赛作品。自从这个竞赛开始以来，AE方案可能是对称密钥密码学领域中最常被访问和最具挑战性的主题。******主要有两种方法来设计集成的声发射算法。第一种是在特殊模式下使用分组密码。第二种可以说是更有效的方法是设计一个专用的AE算法，其中消息用于更新底层密码的状态，并且几乎可以免费实现消息身份验证。在本研究项目中，我们计划重点研究使用后一种方法构建的方案。***该项目的目的是调查设计，分析和实现可证明安全的高效家族（针对预定义的密码分析攻击集）专用AE方案。特别是，我们计划(i)将最先进的密码分析攻击和自动密码分析工具应用于提交给CAESAR竞赛的AE方案；（ii）研究声发射方案的不同构造方法，包括底层基元基于类aes基元的新设计和最近提出的基于加密的双工/基于海绵的构造（最近选择的哈希函数标准是基于海绵的构造）（iii）建立量化声发射方案抵抗不同攻击的标准，包括侧信道攻击，并将这些知识应用于设计高效，安全，nonce防误用，可并行和在线AE，可优化在资源受限的环境中运行

While in most people's minds confidentiality is the primary goal of cryptography, message authentication is arguably as important. Cryptographers have long realized the importance of the privacy and integrity goals. However, the traditional approach to tackle the problem of achieving confidentiality and integrity has been to consider these two goals in isolation; security researchers designed encryption schemes to protect the privacy of digital communication and they independently designed message authentication codes to protect its integrity.  Recently, there have been a series of disastrous attacks resulting from the wrong application of confidentiality and authenticity primitives. Consequently, and following the National Institute for Standards and Technology (NIST) Advanced Encryption Standard (AES) competition, the European Union eStream competition, and the NIST SHA-3 hash function competition, a new Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR) funded by NIST was announced. While being relatively new, this competition has provided a boost to the cryptographic research community to consider the analysis and design of authenticated encryption (AE) primitives. In the first phase of this competition, which started in March 2014, 57 submissions were received. Since this competition has been opened, AE schemes are probably the most frequently visited and challenging topic in the area of symmetric key cryptology.******There are mainly two approaches to design an integrated AE algorithm. The first is to use a block cipher in a special mode. The second, and arguably more efficient approach, is to design a dedicated AE algorithm where the message is used to update the state of the underlying cipher and message authentication can be achieved almost for free. In this research project, we plan to focus on schemes constructed using the latter approach. ***The objective of this project is to investigate the design, analysis and implementation of efficient families of provably secure (against a predefined set of cryptanalytic attacks) dedicated AE schemes. In particular, we plan to (i) Apply state of the art cryptanalytic attacks and automated cryptanalysis tools to the AE schemes submitted to the CAESAR competition, (ii) Investigate different construction methods for AE schemes including new designs whose underlying primitives are based on  AES-like primitives and the recently proposed cryptographic Duplex/Sponge-based constructions (the recently selected hash function standard is a Sponge-based construction) (iii) Establish a criteria for quantifying the AE scheme resistance against different attacks, including side channel attacks, and apply this knowledge to the design of an efficient, secure, nonce misuse resistant, parallelizable and online AE which can be optimized to operate within resource constrained environments.**