Analysis of the CAESAR Candidate Silver.

Jérémy Jean,Yu Sasaki,Lei Wang

DOI: https://doi.org/10.1007/978-3-319-31301-6_28

2015-01-01

Abstract:In this paper, we present the first third-party cryptanalysis against the authenticated encryption scheme Silver. In high-level, Silver builds a tweakable block cipher by tweaking AES-128 with a dedicated method and performs a similar computation as OCB3 to achieve 128-bit security for both of integrity and confidentiality in nonce-respecting model. Besides, by modifying the tag generation of OCB3, some robustness against nonce-repeating adversaries is claimed. We first present a forgery attack against 8 out of 10 rounds with $$2^{111}$$2111 blocks of queries in the nonce-respecting model. The attack exploits a weakness of the dedicated AES tweaking method of Silver. Then, we present several attacks in the nonce-repeating model. Those include 1 a forgery against full Silver with $$2^{49.46}$$249.46 blocks of queries which matches a conservative security claim by the designers, 2 a plaintext recovery against full Silver with a single query and 3 a key recovery against 8 rounds with $$2^{111}$$2111 blocks of queries. In particular, the plaintext recovery breaks the security claim by the designers. Considering that the current best key recovery for plain AES-128 is up﾿to seven rounds, Silver lowers the security margin of AES due to its tweaking method. The attacks have been partially implemented and experimentally verified.