4
$\begingroup$

In the Full-State Keyed duplex (sponge construction AEAD), plaintext is absorbed into the entire state of the sponge permutation but only a portion of the output can be used else the scheme breaks (permutation state leaks, key leaks).

How is this data asymmetry in any way useful? You cannot encrypt the block of plaintext you just fed in because of a size mismatch. Yet it is claimed to be more efficient.

$\endgroup$
3
  • 1
    $\begingroup$ I've tried to figure it out from the paper. It seems that they indicate somewhere that you could use the AD to initially feed in as message and that you can then use the output rate to encrypt, but I'm not sure. The notation in the paper isn't all that clear to me; it seems to use the same notation as in the Donkey Duplex paper without explicitly specifying so. The construction seems to absorb all plaintext before producing $Z$, which doesn't make any sense to me. $\endgroup$
    – Maarten Bodewes
    Commented Oct 10, 2023 at 15:28
  • 2
    $\begingroup$ You can do full-state for just the associated data, which improves the efficiency for absorbing that. Alternatively, you can do full-state for also absorbing the message, which involves some padding and processing the associated data simultaneously rather than before doing encryption. The full-state concept is more intuitive with MACs. Bonus info: full-state is actually a bad idea because it's not committing. The approach Ascon takes is better. $\endgroup$ Commented Oct 10, 2023 at 17:03
  • $\begingroup$ Interestingly, if using a Full-State Keyed Sponge for MAC safe, why aren't all HMACs made this way? It just involves: key -> permtute -> loop(xor msg block -> permute) -> truncate. No need for Davies-Meyer or other constructions. $\endgroup$ Commented Oct 11, 2023 at 1:17

1 Answer 1

0
$\begingroup$

In the Full-State Keyed duplex (sponge construction AEAD), plaintext is absorbed into the entire state of the sponge permutation but only a portion of the output can be used else the scheme breaks (permutation state leaks, key leaks).

This is an interesting observation. Indeed, revealing the full state of the sponge would very clearly not be CPA secure. In $\S$7.1 of the cited paper, the authors describe how (ignoring some domain separation & padding bits), in one example construction, the plaintext message is intended to be absorbed in ~$r$-bit (rate) chunks, & the associated data (AD) is simultaneously absorbed into the remaining $c$ (capacity) bits. That is, unless AD is large, in which case Algorithm 3 on page 15 describes how such overflow is handled.

In fact, $\S$3.1 Algorithm 2 on page 4 makes explicit that each $Z_i$ output is exactly drawn from the rate section of the internal state & must not be larger than $r$-bits.

Full-State Keyed Sponge (FKD) Algorithm Pseudo-Code


How is this data asymmetry in any way useful? You cannot encrypt the block of plaintext you just fed in because of a size mismatch. Yet it is claimed to be more efficient.

This requires a two-part explanation. The first part is that the full state can be used for absorption of various inputs, reducing the total number of internal permutation calls.

The second part isn't specified by the cited paper directly. It instead describes general wrap / unwrap cipher interfaces. But, it can be assumed from the context of the paper, & the similarities drawn between Full-State Keyed Sponge (FKS) & Full-State Keyed Duplex (FKD), that the various outputs $Z_i$ actually form a stream cipher's keystream bits, which of course, are squeezed out by at most $r$-bits at a time. This stream cipher interpretation means there's no technical issue between any differing sizes of inputs & outputs.

Full-State Keyed Sponge Algorithm Diagram

Figure 2 | Full-State Keyed Sponge Algorithm Diagram.

Full-State Keyed Duplex Algorithm Diagram

Figure 3 | Full-State Keyed Duplex Algorithm Diagram.

Additionally, $\S$6 Theorem 2 on page 11 shows the adversarial advantage of FKD to be better than or equal to the already provably secure FKS construction(0).

$$ \bf{Adv} \space ^{ind}_{FKD^\pi_0} (B) \le \bf{Adv} \space ^{ind}_{FKS^\pi_0} (B') $$

$\endgroup$
1
  • $\begingroup$ Hmm, I'm not agreeing that there is no technical issue. Theoretically this can work, but I would require more input were I'm to write an API description / implementation of it. For the paper it is alright, because it focusses on the proof. It feels unclear, convoluted and specific to context (I've seen plenty of instances where the AD isn't used, etc.). $\endgroup$
    – Maarten Bodewes
    Commented Oct 11, 2023 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.