MMM: Authenticated Encryption with Minimum Secret State for Masking

Authors

  • Yusuke Naito Mitsubishi Electric Corporation, Kanagawa, Japan
  • Yu Sasaki NTT Social Informatics Laboratories, Tokyo, Japan
  • Takeshi Sugawara The University of Electro-Communications, Tokyo, Japan

DOI:

https://doi.org/10.46586/tches.v2023.i4.80-109

Keywords:

Authenticated Encryption, Mode of Operation, Side-Channel Attack, Masking, Multi-User Security

Abstract

We propose a new authenticated encryption (AE) mode MMM that achieves the minimum memory size with masking. Minimizing the secret state is the crucial challenge in the low-memory AE suitable for masking. Here, the minimum secret state is s + b bits, composed of s bits for a secret key and b bits for a plaintext block. HOMA appeared in CRYPTO 2022 achieved this goal with b = 64, but choosing a smaller b was difficult because b = s/2 is bound to the block size of the underlying primitive, meaning that a block cipher with an unrealistically small block size (e.g., 8 bits) is necessary for further improvement. MMM addresses the issue by making b independent of the underlying primitive while achieving the minimum (s + b)-bit secret state. Moreover, MMM provides additional advantages over HOMA, including (i) a better rate, (ii) the security under the multi-user model, (iii) and a smaller transmission cost. We instantiate two variants, MMM-8 (with b = 8) and MMM-64 (with b = 64), using the standard tweakable block cipher SKINNY-64/192. With a (d + 1)-masking scheme, MMM-8 (resp. MMM-64) is smaller by 56d + 184 (resp. 128) bits compared with HOMA. As a result of hardware performance evaluation, MMM-8 and MMM-64 achieved smaller circuit areas than HOMA with all the examined protection orders d ∈ [0, 5]. MMM-8’s circuit area is only 81% of HOMA with d = 5, and MMM-64 achieves more than x3 speed-up with a smaller circuit area.

Downloads

Published

2023-08-31

Issue

Section

Articles

How to Cite

MMM: Authenticated Encryption with Minimum Secret State for Masking. (2023). IACR Transactions on Cryptographic Hardware and Embedded Systems, 2023(4), 80-109. https://doi.org/10.46586/tches.v2023.i4.80-109