Use blake2 permutation as a block cipher

Question

Blake2(1024 bit state) permutation (compression function core) is basically a modified ChaCha permutation. One of the modifications is to mix in message bits (key schedule?). Given that blake2 is a hash function, designed to resist related messages (related key attack?) would it not also make a good 1024 bit block cipher?

Some of my questions regarding the resultant construction would be:

1. Will it be a secure block cipher?

2. Given that the result will be a 1024 block cipher with what appears to be a 1024 bit key (previously, the message block) would you be able to expect a 2^1024 security level? (in practice the key would likely be derived from some PRNG of a lower security level rather than opt for this overkill)

The use case will be to encrypt AD in AEAD. To make AEAD packets(large, not necessarily networking) appear as entirely random bits. AD will also include parameters of encryption for the packet along with a nonce.

Answer 1

To answer question 1, we don't know whether that will be a secure construction. Just because the compression function of a hash function is secure when using it as a hash function doesn't mean it's secure when using it as a block cipher. For example, there are attacks on the block ciphers underlying SHA-1 and SHA-2 that wouldn't apply to the hash algorithms themselves.

As an example of a weakness that could theoretically occur, say the first half of the BLAKE2 permutation is found to be weak, but the second half is independent and indistinguishable from random. Then BLAKE2b would likely still be secure, but the permutation as a block cipher probably would not.

In order to determine whether this design is secure, you'd have to conduct normal cryptanalysis on the design, and cryptanalysis on ChaCha would likely not apply because there the permutation is not used as a block cipher. Without sufficient study, I wouldn't recommend this approach.

An approach which is more likely to be secure (but you should also not use because it has seen zero cryptanalysis) is a four-round Feistel cipher with keyed BLAKE2b as the $ F $ function. That would yield a 1024-bit block cipher with a key up to 255 bytes. At least this approach would have a security proof based on some assumptions about keyed BLAKE2b, although it might not be particularly performant.

While speculating about this design is theoretically interesting, I'd encourage you to use a more standard approach which has seen substantial real-world cryptanalysis and is still considered to be secure.

Answer 2

The BLAKE2b keyed permutation is not an ideal cipher. For $2^{64}$ "weak" keys consisting of the same word $k$ repeated $16$ times, it is elementary to distinguish it from a random permutation via the property $$ E\left(k^{16}, m \lll s\right) = E\left(k^{16}, m\right) \lll s\,, $$ where $\lll s$ means rotating the columns of the $4\times 4$ state by $s$, e.g., $$ \pmatrix{a & d & h & m \\ b & e & i & n \\ c & f & j & o \\ d & g & l & p} \lll 1 = \pmatrix{d & h & m & a \\ e & i & n & b \\ f & j & o & c \\ g & l & p & d}\,. $$ This property is exploited in the attacks on modified BLAKE2b with a chosen IV, which alter the initialization constants of BLAKE to make the scheme weaker.

Now, an AEAD typically does not rely on its underlying block cipher to be ideal, but simply a pseudorandom permutation. In this case, the probability of a weak key is negligible ($2^{-960}$), and the standard cryptanalysis of the permutation becomes more relevant.

To my knowledge there is no attack that would compromise the security of the permutation when used with a random key. But then again this is not a setting that has seen much study, so the cryptanalysis may be incomplete. I would not recommend using the BLAKE2b keyed permutation in this manner for anything serious.