0
$\begingroup$

A PRF can be used both to generate a key stream for use in a stream cipher, and to construct a MAC to authenticate. The two can then be combined e.g. in a generic encrypt-then-MAC construction to create an authenticated stream cipher, using the same PRF for both (with independent keys). Is this actually done in any real-world authenticated encryption scheme? I see constructions like Salsa20/ChaCha20 stream ciphers combined with Poly1305 (a secure MAC, but not a PRF). Presumably you could combine ChaCha20 with Blake2, which is based on the same round function internally, but even here there are differences in the PRF (as I understand it). Are there any real-world cases where exactly the same PRF is used for both? If not, is there a reason why not?

One similar real-world construction I can think of is CCM mode where the same block cipher (e.g. AES) is used both in CBC-MAC and then in CTR mode. This provides some code size advantages as the same code can be used for both operations (and you only need the encrypt direction of AES too). Presumably similar arguments could be made for an authenticated stream cipher that used the same PRF for both key stream generation and MAC.

$\endgroup$
  • $\begingroup$ If you are looking for authentication modes that use just PRF calls maybe OTR is a good choice - n block messages are authenticated with only n PRF calls using a feistel network. $\endgroup$ – Dragos Apr 22 '17 at 21:27
3
$\begingroup$

The Duplex constructions of Keccak (now standardized as SHA-3) work this way.

See: http://sponge.noekeon.org/SpongeDuplex.pdf

And

http://keccak.noekeon.org/KeccakDIAC2012.pdf

I believe some variant of this is in the process of standardization by NIST, but I haven't seen a draft yet. See:

http://csrc.nist.gov/groups/ST/hash/sha-3/Aug2014/documents/sonmez-turan_sha3_2014_workshop.pdf

$\endgroup$
  • $\begingroup$ Thanks. That also led me to eprint.iacr.org/2016/1188.pdf that also explores PRF-based constructions based on the Keccak permutation, including a nice SIV mode for authenticated encryption. $\endgroup$ – Neil Madden Apr 22 '17 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.