2
$\begingroup$

With a Sponge permutation in a Duplex construction for authenticated encryption.

illustration example: ascon; actual interest if relevant: keccak

enter image description here

Suppose there is no associated data and there is no nonce, just a key. A classical xor-cipher problem arises with the first cipher-text block where

$C_{a,1}\oplus C_{b,1}= P_{a,1}\oplus P_{b,1}$. - for two streams $a$ and $b$ with the same key

  • but it would appear that subsequent blocks are fine.

However, suppose instead of associated data you insert $P_1$ (and then repeat $P_1$ again and proceed normally as per the construction)

Basically Using $P_1$ as a nonce. But then every subsequent $P_x$ is an additional nonce of sorts.

Would you not have a situation where you end up with a stream cipher that will be in no danger of nonce (nonce being 0*) reuse? Every duplex instance using the same key would only produce identical $S_1\ldots S_x$ for identical $P_1\ldots P_x$ ($S_x$ being $C_x\oplus P_x$ or the "public" part of the sponge permutation)

Is this correct? And if so, is the only downside of this approach the fact that identical plaintext will always produce identical ciphertext & tag? No other security implications?

$\endgroup$

1 Answer 1

2
$\begingroup$

You would still have the XOR-cipher problem for pairs of plaintext where $P_{a,1}=P_{b,1}$. This is quite a credible condition as messages can often have stereotyped beginning such as "Dear Sir/Madam" or "CLASSIFICATION: TOP SECRET".

If we have two messages where $P_{a,1}=P_{b,1}$, then the state coming out of $p_b$ after the "associated data" step is equal for both messages. We then see that $C_{a,1}$ and $C_{b,1}$ are also equal as are the two states and for the next block we'd have $C_{a,2}\oplus C_{b,2}=P_{a,2}\oplus P_{b,2}$.

There's also the question of how the recipient is supposed to recreate the stream. They have no knowledge of $P_1$ and so cannot reproduce the state coming out of $p_b$ after the "associated data" step unless $P_1$ is transmitted in the clear.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.