Friet: An Authenticated Encryption Scheme with Built-in Fault Detection

Abstract

In this work we present a duplex-based authenticated encryption scheme $\textsc {Friet}$ based on a new permutation called $\textsc {Friet-P}$. We designed $\textsc {Friet-P}$ with a novel approach for cryptographic permutations and block ciphers that takes fault-attack resistance into account and that we introduce in this paper.

In this method, we build a permutation ${f_C}$ to be embedded in a larger one, $f$. First, we define $f$ as a sequence of steps that all abide a chosen error-correcting code $C$, i.e., that map $C$-codewords to $C$-codewords. Then, we embed ${f_C}$ in $f$ by first encoding its input to an element of C, applying $f$ and then decoding back from C. This last step detects a fault when the output of $f$ is not in $C$.

We motivate the design of the permutation we use in $\textsc {Friet}$ and report on performance in soft- and hardware. We evaluate the fault-detection capabilities of the software and simulated hardware implementations with attacks. Finally, we perform a leakage evaluation. Our code is available at https://github.com/thisimon/Friet.git.

Keywords

A Design Strategy for a \([6, 3, 3]_2\)-abiding Permutation

In this section, we discuss adapting the code embedding technique on a larger linear code. We focus on code $C = [6, 3, 3]_2$ and showcase the different limb transposition operations that a C-abiding permutation could take advantage of.

Let ${f_C}$ be a $C$-abiding permutation on a state (a, b, c, d, e, f), with a, b, c native limbs and d, e, f parity limbs satisfying equations:

$$\begin{aligned} d = b+c, \quad e = a+c, \quad f = a+b. \end{aligned}$$

Let’s say that a native and a parity limb are related when both of them appear in the same parity equation. In particular, limb a is related to limbs e and f, but not to d. A native limb transposition then requires swapping two native limbs and the two parity limbs that are related to only one of the two native limbs involved. An example for such operation is given by $\pi (a,b,c,d,e,f) = (a,c,b,d,f,e)$. On the other hand, a non-native limb transposition requires swapping a native limb x with a parity limb $x+y$ and bitwise add the other native limb y to the other parity limb related to x. An example for this is $\rho (a,b,c,d,e,f) = (e,b,c,d,a,f+c)$. Note that this the same computational cost of one bitwise addition as the associated embedded operation $\rho _C(a,b,c)= (a+c,b,c)$. By contrast, a limb adaptation operation requires three times as much computation as its embedded equivalent.