Abstract:In this work we present the COLM authenticated encryption (AE) scheme which is the second of the two winners in the defense in depth category of the CAESAR competition. COLM realizes a nonce-based authenticated encryption with associated data and uses the popular AES blockcipher as its underlying primitive. We propose two possible blockcipher instantiations (with key of length 128 or 256 bits). We also define two COLM modes of operation variants: a primary COLM mode for general purpose applications, and a COLM variant with intermediate tag generation/verification geared to support low-end devices and applications where frequent verification is required. COLM is designed with security, simplicity, and efficiency in mind. The main design goal of COLM is high security : a primary feature of the defense in depth CAESAR category. COLM provides security beyond the traditional AE security. First, COLM is secure against nonce misuse , namely, it enables security in adversarial settings where the nonce inputs to the AE scheme repeat. In contrast to standardized and popular AE algorithms, such as GCM and OCB1-3 modes, whose AE security trivially breaks down when the nonce is repeated, COLM ensures both confidentiality and authenticity (AE) security with repeated nonces. Second, our COLM variant enables increased security levels in situations where release of unverified ciphertext (RUP) occurs due to its ability to limit a potential leakage by frequent verifications. In this work we prove COLM secure with respect to both confidentiality and authenticity (AE) security under nonce misuse in the well-known provable security framework. Our proofs show that COLM maintains n /2-bit security levels for block sizes of n bits. Furthermore, due to the inherent parallelism on both mode and primitive levels, our software performance results show that the price paid for enhanced security does come at the cost of minimal efficiency losses. More concretely, we implement GCM, COLM, and Deoxys-II on the Kaby Lake and Coffee lake Intel platforms. Compared to the other winner in the defense in depth category Deoxys-II, our AE design COLM performs 10–20% faster for the 128-bit key version. Regarding the 256-bit key versions COLM is around 5% faster for short and 2% slower than Deoxys-II for the longer messages.

Ascon v1.2: Lightweight Authenticated Encryption and Hashing

Preimage attacks on reduced-round Ascon-Xof

Improved 2-round collision attack on IoT hash standard ASCON-HASH

Review of the NIST Light-weight Cryptography Finalists

A Comprehensive Survey on the Implementations, Attacks, and Countermeasures of the Current NIST Lightweight Cryptography Standard

Securing the IoT ecosystem: ASIC-based hardware realization of Ascon lightweight cipher

Automatic Preimage Attack Framework on Ascon Using a Linearize-and-Guess Approach

Construction and security analysis of hash algorithm based on stream cipher

Quantum circuit implementations of lightweight authenticated encryption ASCON

Survey of Design and Security Evaluation of Authenticated Encryption Algorithms in the CAESAR Competition

Data Tastes Better Seasoned: Introducing the ASH Family of Hashing Algorithms

Harnessing Lightweight Ciphers for PDF Encryption

A Framework for the Analysis and Evaluation of Algebraic Fault Attacks on Lightweight Block Ciphers

DPA on hardware implementations of Ascon and Keyak

Lightweight, Post-Quantum Secure Cryptography Based on Ascon: Hardware Implementation in Automotive Applications

Lightweight AEAD and Hashing Using the Sparkle Permutation Family.

E2-ACE: an Energy-Efficient Reconfigurable Crypto-Accelerator with Agile End-to-End Toolchain

i-AEGIS-128: An Improved Authenticated Encryption Based on AEGIS-128

Hash Functions and Benchmarks for Resource Constrained Passive Devices: A Preliminary Study

The COLM Authenticated Encryption Scheme

Depth-Optimized Quantum Circuits for ASCON: AEAD and HASH