Security of Keyed Sponge Constructions Using a Modular Proof Approach

Sponge functions are versatile cryptographic primitives that can be used for hashing, but also in a wide range of keyed applications, such as message authentication codes (MAC), stream encryption, authenticated encryption, and pseudo-random sequence generation  [5, 7, 8]. This fact is illustrated by the large number of sponge based candidates in the CAESAR competition for authenticated encryption schemes [12]: Artemia [1], Ascon [15], ICEPOLE [23], Ketje [10], Keyak [11], NORX [3], \(\pi \)-Cipher [19], PRIMATEs [2], Prøst [21] and STRIBOB [28]. More recently, Rivest and Schuldt [27] presented an update of the RC4 stream cipher with the name Spritz, also adopting a keyed sponge construction.

The sponge function consists of the application of the sponge construction to a fixed-length permutation (or transformation) f. It is a function that maps an input string of variable length to an output of arbitrary length. The duplex construction also makes use of a fixed-length permutation but results in a stateful object that can be fed with short input strings and from which short output strings can be extracted [8]. The above mentioned authenticated encryption schemes are for example based on the duplex construction. In [8] Bertoni et al. prove the security of the duplex construction equivalent to the security of the sponge construction, which means that any security result on the sponge construction is automatically valid for the duplex construction.

We can identify two types of keyed sponge functions, both of which we see applied in practice [1, 2, 3, 10, 11, 15, 19, 21, 23, 25, 28, 29]. The first type applies the key by taking it as the first part of the sponge input and we call it the outer-keyed sponge. The second inner-keyed sponge applies the key on the inner part of the initial state, and can be viewed as successive applications of the Even-Mansour [16, 17] type block cipher, which in turn calls an unkeyed permutation.

One way to argue security of the keyed sponge constructions is via the indifferentiability result of [6]. This result guarantees that the keyed sponge constructions can replace random oracles in any single-stage cryptographic system [22, 26] as long as the total complexity of the adversary is less than \(2^{(c+1)/2}\). Bertoni et al. [9] derived an improved bound on the distinguishing advantage against the outer-keyed sponge by separating the total complexity into time and data complexity. However, their proof contains a subtle error: [9, Lemma 1] proves that the keyed sponge output is uniformly and independently distributed if certain conditions are fulfilled, whereas the proof requires uniformity of the joint keyed sponge output and queries to f, which does exhibit a bias. Regarding the inner-keyed sponge, Chang et al. considered security of the construction in the so-called standard model in [13]. Central in their reasoning is the clever trick to describe the keyed sponge as the sponge construction calling an Even-Mansour block cipher. Their bound does however not go beyond the generic sponge indifferentiability bound of [6] as their main intention appears to have been to prove security in the standard model rather than the ideal permutation model.

In this section we specify the constructions we address in this paper.

2.1 The Sponge Construction

The sponge construction operates on a state s of b bits, and calls a b-bit permutation f. It takes as input a message \(m\in \{0,1\}^{*}\) and natural number \(\ell \) and outputs a potentially infinite string truncated to the chosen length \(\ell \in \mathbb {N}\), denoted \(z\in \{0,1\}^{\ell }\).

We express an evaluation of the sponge function as

$$\begin{aligned} \textsc {Sponge}^f(m,\ell ) = z. \end{aligned}$$

(1)

The sponge function operates as follows. First we apply an injective padding function to the input message m, denoted by \(m||\mathrm {pad}[r](|m|)\), with r the rate. This padding rule is required to be injective and the last block is required to be different from 0. Then, we initialize the b bits of the sponge state s to zero. We refer to the first r bits of the state s as the outer part\(\bar{s}\) and to the last \(c = b - r\) bits (c is called the capacity) as its inner part\(\hat{s}\) (think back on \(\hat{\ }\) as a roof). The padded message is processed by an absorbing phase followed by a squeezing phase:

• Absorbing phase: the r-bit input message blocks are sequentially XORed into the outer part of the state, interleaved with applications of the function f;

• Squeezing phase: the bits of the outer part of the state are returned as output blocks, interleaved with applications of the function f, until enough bits are produced.

An illustration is given in Fig. 1 and a formal description is provided in Algorithm 1. The notation \({\lfloor x \rfloor _{n}}\) means that the string x is truncated after its first n bits.

Open image in new window

Open image in new window

2.3 The Root-Keyed Sponge

As a way to highlight the similarities between the inner- and outer-keyed sponges, which we will define in the next sections, we define a common construction called the root-keyed sponge. Basically, it is a variant of the sponge construction where the state is initialized to a key \(K\in \{0,1\}^{b}\) instead of \(0^b\). The root-keyed sponge \(\textsc {RKS}^f_K\) is defined in Algorithm 2.

The root-keyed sponge can be rewritten using the Even-Mansour block cipher. Indeed, we have

$$\begin{aligned} \textsc {RKS}^f_K(m, \ell ) = \textsc {RKS}^{E^f_{\hat{K}}}_{\bar{K}||0^c}(m, \ell ), \end{aligned}$$

(3)

as key additions between subsequent applications of \(E^f_{\hat{K}}\) cancel out.

Open image in new window

2.5 The Outer-Keyed Sponge

The outer-keyed sponge \(\textsc {OKS}^f\) is a PRF construction that was originally introduced by Bertoni et al. [9] as the keyed sponge. An outer-keyed sponge instance is defined by a permutation f and a key \(K\in \{0,1\}^{k}\) and simply consists of an evaluation of the sponge construction where the secret key and the message are concatenated:

$$\begin{aligned} \textsc {OKS}^f_K(m,\ell ) = \textsc {Sponge}^f(K||m,\ell ). \end{aligned}$$

(6)

While K may be of any size, we limit our analysis to the case where k is a multiple of the rate r, or \(\{0,1\}^{k}=(\{0,1\}^{r})^+\). The outer-keyed sponge can be equivalently described as a function that derives the root key\(L\in \{0,1\}^{b}\) from the cipher key \(K\in \{0,1\}^{k}\), followed by the root-keyed sponge with root key L. The root key derivation function \(\textsc {kd}^f(K)\) is defined in Algorithm 3. We obtain:

$$\begin{aligned} \textsc {OKS}^f_K(m,\ell ) = \textsc {RKS}^f_{\textsc {kd}^f(K)}(m,\ell ) \mathop {=}\limits ^{(3)} \textsc {RKS}^{E^f_{\hat{L}}}_{\bar{L}||0^c}(m, \ell ), \end{aligned}$$

(7)

with \(L=\textsc {kd}^f(K)\). This alternative description highlights a similarity with the inner-keyed sponge: the only effective difference lies in the presence of the root key derivation function.

Open image in new window

The security analyses in this work are done in the indistinguishability framework where one bounds the advantage of an adversary \(\mathcal {A}\) in distinguishing a real system from an ideal system. The real system contains one or more specified constructions, while the ideal one consists of ideal functions with the same interface. We explain the high-level idea for the case where \(\mathcal {A}\) attacks one instance of a keyed sponge construction.

Suppose \(f:\{0,1\}^{b}\rightarrow \{0,1\}^{b}\) is a permutation and consider a keyed sponge construction \(\mathcal {H}_K^f\) based on f and some key \(K\in \{0,1\}^{k}\). Let \(\mathcal {RO}\) be a random oracle [4] with the same interface as \(\mathcal {H}_K^f\). Adversary \(\mathcal {A}\) is given query access to either \(\mathcal {H}_K^f\) or \(\mathcal {RO}\) and tries to tell both apart. It is also given access to the underlying permutation f, which is modeled by query access. The random oracle is required to output infinitely long strings truncated to a certain length. The function can be defined as \(\mathcal {RO}:\{0,1\}^{*}\times \mathbb {N}\rightarrow \{0,1\}^{\mathbb {N}}\) that on input \((m,\ell )\) outputs \(\mathcal {RO}(m,\ell )=\lfloor \mathcal {RO}^\infty (m)\rfloor _\ell \), where \(\mathcal {RO}^\infty :\{0,1\}^{*}\rightarrow \{0,1\}^{\infty }\) takes inputs of arbitrary but finite length and returns random infinite strings where each output bit is selected uniformly and independently, for every m.

We similarly consider the PRP security of the Even-Mansour construction \(E^f_K\), where \(\mathcal {A}\) is given query access to either this construction or a random permutation \(\pi \xleftarrow {{\scriptscriptstyle \$}}\mathsf {Perm}(b)\) with domain and range \(\{0,1\}^{b}\), along with query access to f. We also consider a slightly more advanced notion of kdPRP security, where the root key derivation function \(\textsc {kd}\) is applied to K first.

The security proofs of \(\textsc {IKS}\) and \(\textsc {OKS}\) consist of two steps: the first one reduces the security of the construction to the PRP security (for \(\textsc {IKS}\)) or kdPRP security (for \(\textsc {OKS}\)) of the Even-Mansour construction. This step does not depend on f and is in fact a standard-model reduction. Next, we investigate the PRP/kdPRP security of Even-Mansour under the assumption that f is a random permutation.

3.1 Counting

We express our bound in terms of the query complexities that model the effort by the adversary. Here we distinguish between keyed sponge construction or random oracle queries and primitive queries to \(f^{\pm }\):

• Data or online complexityM: the amount of access to the construction \(\mathcal {H}_K^f\) or \(\mathcal {RO}\), that in many practical use cases is limited;

• Time or offline complexityN: computations requiring no access to the construction, in practical use cases only limited by the computing power and time available to the adversary.

Both M and N are expressed in terms of the number of primitive calls. We include in M only fresh calls: a call from \(\mathcal {H}_K^f\) to f is not fresh if it has already been made due to a prior query to the construction. In the ideal world a random oracle naturally does not make calls to f, but the data complexity is counted as if it would and as such, it is fully determined by the queries. For N, we assume without loss of generality that the adversary makes no repeated queries.

In our proofs, we use an additional characteristic of the queries called the total maximum multiplicity and denote it by \(\mu \). Let \(\{(s_i,t_i)\}_{i=1}^M\) be the set of M input/output pairs for f made in construction evaluations.

Definition 1

(Multiplicity). The maximum forward and backward multiplicities are given by

$$\begin{aligned} \mu _\mathrm {fw}&= \max _a \#\{i\in \{1,\ldots ,M\} \mid \bar{s}_i=a\}\,\, and \\ \mu _\mathrm {bw}&= \max _a \#\{i\in \{1,\ldots ,M\} \mid \bar{t}_i=a\}. \end{aligned}$$

The total maximum multiplicity is given by \(\mu =\mu _\mathrm {fw}+\mu _\mathrm {bw}\).

Note that the total maximum multiplicity \(\mu \) is the sum of the maximum forward and backward multiplicities while [7] uses the maximum over the forward and backward multiplicities.

Open image in new window

We bound the distinguishing advantage of the inner-keyed sponge construction in the ideal permutation model. A bound for the case of \(n=1\) is given in Sect. 4.1, and it is generalized to arbitrary \(n\) in Sect. 4.2. Both proofs consist of two steps that are both of independent interest. Note that we assume equal key size and capacity in our proofs. If \(k < c\), the denominator \(2^c\) in the bounds of Theorems 2 and 4 must be replaced by \(2^k\).

Before proceeding, we define the notion of PRP security that we will use in the security proof of the inner-keyed sponge to replace \(E^f_{K_1},\ldots ,E^f_{K_n}\) with random permutations \(\pi _1,\ldots ,\pi _n\), in analogy with (4). As multiple instances of E for \(n\) different keys are considered, we call this notion joint PRP security.

We bound the distinguishing advantage of the outer-keyed sponge construction in the ideal permutation model. A bound for the case of \(n=1\) is given in Sect. 5.1, and it is generalized to arbitrary \(n\) in Sect. 5.2. The high-level ideas of the proofs are the same as the ones of Sect. 4. The outer-keyed sponge differs from the inner-keyed sponge by the presence of a key derivation function using f. Therefore, a more involved version of PRP security is needed, where the key derivation L from K is taken into account. We call this notion joint kdPRP (key derivated PRP) security. For simplicity, we assume that all keys have equal length, with \(v=k/r\) their block length.

Intuitively, permutation f results in a kdPRP secure block cipher if (i) it renders sufficiently secure evaluations of \(\textsc {kd}\) and (ii) \(E^f_{\hat{L}_1},\dots ,E^f_{\hat{L}_n}\) are secure Even-Mansour block ciphers. Note that, indeed, Definition 4 generalizes Definition 3 in the same way the \(\textsc {OKS}^f_K\) of (7) generalizes over \(\textsc {IKS}^f_K\) of (5).

Our theorems have implications on all keyed-sponge based modes as they impose upper bounds to the success probability for both single-target and multi-target attacks, generic in f. In general, a designer of a cryptographic system has a certain security level in mind, where a security level of s bits implies that it should resist against adversaries with resources for performing an amount of computation equivalent to \(2^s\) executions of f. This security level s determines a lower bound for the choice of the sponge capacity c. The indifferentiability bound of Bertoni et al. [6] gives a bound \(\frac{(M+N)^2}{2^{c+1}}\) resulting in the requirement \(c \ge 2s-1\) bits. For attack complexities that are relevant in practice, our success probability bounds are dominated by \(\frac{\mu N}{2^c}\), combining the time complexity and the multiplicity. This results in the requirement \(c \ge s + \log _2(\mu )\) bits. The designer can use this in its advantage by increasing the rate for higher speed or to take a permutation with smaller width for smaller footprint.

The main advantage of having a dependence on \(\mu \) in the bound is that it makes its application flexible. The proof in this paper remains generic and independent of any use case scenario by considering an adversary who can perform all kinds of queries. Yet, the way a keyed sponge function is used in a concrete protocol can restrict what the attacker can actually do, and the bound follows depending on how these restrictions affect the multiplicity.

In general, \(\mu \) depends on the mode of use and on the ability of the adversary, and a designer that cares about efficiency has the challenge to reliably estimate it. In real-world applications, the amount of data that will be available to an adversary can easily be upper bound due to physical, protocol-level or other restrictions, imposing an upper bound to M. As per definition \(\mu \le 2M\) the value of c can be taken \(c \ge s + \log _2(M) + 1\).

The bound \(\mu \le 2M\) is actually very pessimistic and virtually never reached. The multiplicity is the sum of two components: the forward multiplicity \(\mu _\mathrm {fw}\) and the backward multiplicity \(\mu _\mathrm {bw}\). The latter is determined by the responses of the keyed sponge and even an active attacker has little grip on it. For small rates, it is typically \(M2^{-r}\) multiplied by a small constant.

The forward multiplicity, however, can be manipulated in some settings. An example of such a use case is a very liberal mode of use on top of the duplex construction [8]. At each duplexing call, the adversary can choose the input for the next duplexing call to force the outer part to some fixed value and let \(\mu _\mathrm {fw}\) approach M. The dominating security term then becomes \(\frac{MN}{2^c}\), reducing the requirement to \(c \ge s + \log _2(M)\). However, most modes and attack circumstances do not allow the adversary to increase the forward multiplicity \(\mu _\mathrm {fw}\) beyond a small multiple of \(M2^{-r}\). This is in general the case if the adversary cannot choose the outer values. For instance, for sponge based stream ciphers which output a keystream on input of a nonce: if the total number of output blocks is much smaller than \(2^{r/2}\), we have \(\mu = 2\) with overwhelming probability, reducing the requirement to \(c \ge s+1\). A similar effect occurs in the case of nonce-respecting authenticated encryption scenarios.

Knowing the mode of use and the relevant adversary model, one can often demonstrate an upper bound to the multiplicity. If no sharp bounds can be demonstrated, it may be possible to prove that the multiplicity is only higher than some value \(\mu _{\text {limit}}\) with a very low probability. This probability should then be included in the bound as an additional term.