On the Security of Keyed Hashing Based on Public Permutations

Abstract

Doubly-extendable cryptographic keyed functions (deck) generalize the concept of message authentication codes (MAC) and stream ciphers in that they support variable-length strings as input and return variable-length strings as output. A prominent example of building deck functions is Farfalle, which consists of a set of public permutations and rolling functions that are used in its compression and expansion layers. By generalizing the compression layer of Farfalle, we prove its universality in terms of the probability of differentials over the public permutation used in it. As the compression layer of Farfalle is inherently parallel, we compare it to a generalization of a serial compression function inspired by Pelican-MAC. The same public permutation may result in different universalities depending on whether the compression is done in parallel or serial. The parallel construction consistently performs better than the serial one, sometimes by a big factor. We demonstrate this effect using Xoodoo $[3]$, which is a round-reduced variant of the public permutation used in the deck function Xoofff.

A Xoodoo Specification

We quote the specification of the Xoodoo round function, taken verbatim from the Xoodoo Cookbook [10].

Xoodoo is a family of permutations parameterized by its number of rounds $r$ and denoted ${\textsc {Xoodoo}[r]}$.

Xoodoo has a classical iterated structure: It iteratively applies a round function to a state. The state consists of 3 equally sized horizontal planes, each one consisting of 4 parallel 32-bit lanes. Similarly, the state can be seen as a set of 128 columns of 3 bits, arranged in a $4\times 32$ array. The planes are indexed by y, with plane $y=0$ at the bottom and plane $y=2$ at the top. Within a lane, we index bits with z. The lanes within a plane are indexed by x, so the position of a lane in the state is determined by the two coordinates (x, y). The bits of the state are indexed by (x, y, z) and the columns by (x, z). Sheets are the arrays of three lanes on top of each other and they are indexed by x. The Xoodoo state is illustrated in Fig. 3.

Fig. 3.

Toy version of the Xoodoo state, with lanes reduced to 8 bits, and different parts of the state highlighted. [10]

Table 3. Notational conventions [10]

Table 4. The round constants $c_i$ with $-11 \le i \le 0$, in hexadecimal notation (the least significant bit is at $z=0$) [10].

The permutation consists of the iteration of a round function $\mathrm {R_{i}}$ that has 5 steps: a mixing layer $\theta$, a plane shifting ${\rho _\textrm{west}}$, the addition of round constants $\iota$, a non-linear layer $\chi$ and another plane shifting ${\rho _\textrm{east}}$.

We specify Xoodoo in Algorithm 3, completely in terms of operations on planes and use thereby the notational conventions we specify in Table 3 and 4.