Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Integrity-protecting block cipher modes -- Untangling a tangled web

Chris J Mitchell

TL;DR

This paper re-evaluates three closely related authenticated-encryption block-cipher modes—PES-PCBC, IOBC, and EPBC—and demonstrates that each contains exploitable defects. Through synthesis of prior cryptanalysis and the introduction of new attacks, it shows that PES-PCBC and IOBC permit forgery and that EPBC's security status is not settled, with new methods achieving high forgery success at submittal costs below $2^{n/2}$. It also discusses general forgery techniques and IV-management pitfalls that apply across this design space, including chosen-plaintext and cross-message attacks. The findings argue strongly against adopting these modes in practice and underscore the availability of alternative, provably secure authenticated-encryption schemes.

Abstract

This paper re-examines the security of three related block cipher modes of operation designed to provide authenticated encryption. These modes, known as PES-PCBC, IOBC and EPBC, were all proposed in the mid-1990s. However, analyses of security of the latter two modes were published more recently. In each case one or more papers describing security issues with the schemes were eventually published, although a flaw in one of these analyses (of EPBC) was subsequently discovered - this means that until now EPBC had no known major issues. This paper establishes that, despite this, all three schemes possess defects which should prevent their use - especially as there are a number of efficient alternative schemes possessing proofs of security.

Integrity-protecting block cipher modes -- Untangling a tangled web

TL;DR

This paper re-evaluates three closely related authenticated-encryption block-cipher modes—PES-PCBC, IOBC, and EPBC—and demonstrates that each contains exploitable defects. Through synthesis of prior cryptanalysis and the introduction of new attacks, it shows that PES-PCBC and IOBC permit forgery and that EPBC's security status is not settled, with new methods achieving high forgery success at submittal costs below . It also discusses general forgery techniques and IV-management pitfalls that apply across this design space, including chosen-plaintext and cross-message attacks. The findings argue strongly against adopting these modes in practice and underscore the availability of alternative, provably secure authenticated-encryption schemes.

Abstract

This paper re-examines the security of three related block cipher modes of operation designed to provide authenticated encryption. These modes, known as PES-PCBC, IOBC and EPBC, were all proposed in the mid-1990s. However, analyses of security of the latter two modes were published more recently. In each case one or more papers describing security issues with the schemes were eventually published, although a flaw in one of these analyses (of EPBC) was subsequently discovered - this means that until now EPBC had no known major issues. This paper establishes that, despite this, all three schemes possess defects which should prevent their use - especially as there are a number of efficient alternative schemes possessing proofs of security.
Paper Structure (21 sections, 12 theorems, 25 equations, 2 figures, 1 table)

This paper contains 21 sections, 12 theorems, 25 equations, 2 figures, 1 table.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. PES-PCBC
  4. PES-PCBC operation
  5. Cryptanalysis
  6. Impact
  7. IOBC
  8. IOBC operation
  9. Remarks on use
  10. Cryptanalysis
  11. Impact
  12. EPBC
  13. EPBC operation
  14. A flawed cryptanalysis
  15. Impact
  16. ...and 6 more sections

Key Result

theorem 1

Suppose the ciphertext $C_1,C_2,\ldots,C_t$ was constructed using PES-PCBC from the plaintext $P_1,P_2,\ldots,P_t$, and that $j$ satisfies $1<j<t$. Suppose the $(t+2)$-block ciphertext $C'_1,C'_2,\ldots,C'_{t+2}$ is constructed as follows: When decrypted to yield $P'_1,P'_2,\ldots,P'_{t+2}$, the value of the final plaintext block $P'_{t+2}$ will equal $P_t$ for the original (untampered) message,

Figures (2)

  • Figure 1: PES-PCBC encryption
  • Figure 2: IOBC encryption

Theorems & Definitions (19)

  • theorem 1
  • proof
  • lemma 1: Mitchell, Mitchell13
  • lemma 2: Mitchell, Mitchell13
  • lemma 3: Mitchell, Mitchell13
  • lemma 4: Mitchell, Mitchell07
  • lemma 5: Mitchell, Mitchell07
  • lemma 6
  • proof
  • lemma 7
  • ...and 9 more