Differential Analysis of Encryption and Finalization Phases of AES-based AEAD Schemes

抄録

We examine the security of AES-based authenticated encryption schemes, including the AEGIS family, Tiaoxin-346, Rocca and Rocca-S. Existing studies evaluated the security against forgery attacks, focusing on state collisions in the encryption phase. These studies estimated the lower bounds for the number of active S-boxes by a byte-wise search. However, this approach might underestimate these bounds since it might include invalid characteristics. In this paper, we conduct a bit-wise evaluation of the AEGIS family, Tiaoxin-346, Rocca, and Rocca-S against forgery attacks based on state collision by Boolean satisfiability problem (SAT) tools. This approach enables us to derive tighter bounds for the minimum number of active S-boxes. In addition, for AEGIS-128L, Tiaoxin-346, and Rocca, we incorporate values of differential distribution tables of S-boxes to obtain the exact differential characteristics probability as a direct indicator of forgery attacks on AEGIS-128L, Tiaoxin-346, and Rocca. Additionally, we conduct a bit-wise evaluation of differential distinguishing attacks on the finalization phase of the AEGIS family, Tiaoxin-346, Rocca, and Rocca-S. These results reveal that AEGIS-128L cannot claim 256-bit security against forgery attacks even with a 256-bit tag. Furthermore, for the first time, we perform a security evaluation against forgery attacks exploiting tag collisions in the tag generation phase. Finally, we reveal that the finalization phase cannot be distinguished from the pseudo-random permutation under differential attacks.