Subject: [Cfrg] SHA256 based AEAD construction

From: Fihlman Emil <[email-masked]>
Date: Mon, 18 Feb 2019 23:17:09 +0000

Hi

Let me first apologise if this is not the correct forum (if so, any pointers towards a place of discussion are appreciated).

I recently implemented a SHA256 based AEAD crypto (base file https://emil.fi/d/sha256.c and a test program / simple utility https://emil.fi/d/sha256crypt.c).

In a nutshell:
We make an intermediate key kv by taking sha256(key|vector), which is then used to
a) generate a random keystream by taking sha256(kv|counter), with which input is xorred by and
b) take a hmac of the ciphertext for authentication.

This concept is nothing new nor special. Some positives provided by this scheme are a) the base key is in the system only for a brief moment, b) it's very, very simple and easy to audit and use.

My current idea is to release this as a foss library after refinements, mainly targeted for resource limited systems.
I greatly appreciate any criticism, guidance, ideas and suggestions (especially improvements on reducing ram and cpu requirements and hardening against any timing/side channel attacks are welcomed, I suspect there are quite a few low hanging fruits at the moment).

Emil Fihlman

---

From: Tony Arcieri <[email-masked]>
Date: Mon, 18 Feb 2019 15:33:13 -0800

You might have a look at this paper, which specifies an AEAD scheme based
on hash functions (instantiated with SHA-256, but also usable with e.g.
SHA-3) as part of their pursuit of additional security properties (ccAEAD,
which adds a commitment scheme).

https://eprint.iacr.org/2019/016.pdf

On Mon, Feb 18, 2019 at 3:17 PM Fihlman Emil <[email-masked]> wrote:

> Hi
>
> Let me first apologise if this is not the correct forum (if so, any
> pointers towards a place of discussion are appreciated).
>
> I recently implemented a SHA256 based AEAD crypto (base file
> https://emil.fi/d/sha256.c and a test program / simple utility
> https://emil.fi/d/sha256crypt.c).
>
> In a nutshell:
> This concept is nothing new nor special. Some positives provided by this
> scheme are a) the base key is in the system only for a brief moment, b)
> it's very, very simple and easy to audit and use.
>
> My current idea is to release this as a foss library after refinements,
> mainly targeted for resource limited systems.
> I greatly appreciate any criticism, guidance, ideas and suggestions
> (especially improvements on reducing ram and cpu requirements and hardening
> against any timing/side channel attacks are welcomed, I suspect there are
> quite a few low hanging fruits at the moment).
>
> Emil Fihlman
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Tony Arcieri