Improved XKX-Based AEAD Scheme: Removing the Birthday Terms

Abstract

Naito [ToSC 2017, Issue 2] proposed $\mathtt {XKX}$, a tweakable blockcipher (TBC) based on a blockcipher (BC). It offers efficient authenticated encryption with associated data (AEAD) schemes with beyond-birthday-bound (BBB) security, by combining with efficient TBC-based AEAD schemes such as $\mathrm {\Theta CB3}$. In the resultant schemes, for each data block, a BC is called once. The security bound is roughly $\ell ^2 q/2^n+ \sigma _{A}^2/2^n+ \sigma _\mathcal {D}^2/2^n$, where $n$ is the block size of the BC in bits, $\ell$ is the number of BC calls by a query, $q$ is the number of queries, $\sigma _{A}$ is the number of BC calls handing associated data by encryption queries, and $\sigma _\mathcal {D}$ is the number of BC calls by decryption queries. Hence, assuming $\ell , \sigma _{A}, \sigma _\mathcal {D}\ll 2^{n/2}$, the AEAD schemes achieve BBB security. However, the birthday terms $\sigma _{A}^2/2^n$, $\sigma _\mathcal {D}^2/2^n$ might become dominant, for example, when $n$ is small such as $n=64$ and when DoS attacks are performed. The birthday terms are introduced due to the modular proof via the $\mathtt {XKX}$’s security proof.

In this paper, in order to remove the birthday terms, we slightly modify $\mathrm {\Theta CB3}$ called $\mathrm {\Theta CB3}^\dagger$, and directly prove the security of $\mathrm {\Theta CB3}^\dagger$ with $\mathtt {XKX}$. We show that the security bound becomes roughly $\ell ^2 q/2^n$.