Paper 2015/091 Original: eprint.iacr.org/2015/091 ↗
Related-Key Forgeries for Prøst-OTR
Abstract
We present a forgery attack on Prøst-OTR in a related-key setting. Prøst is a family of authenticated encryption algorithms proposed as candidates in the currently ongoing CAESAR competition, and Prøst-OTR is one of the three variants of the Prøst design. The attack exploits how the Prøst permutation is used in an Even-Mansour construction in the Feistel-based OTR mode of operation. Given the ciphertext and tag for any two messages under two related keys K and K + Delta with related nonces, we can forge the ciphertext and tag for a modified message under K. If we can query ciphertexts for chosen messages under K + Delta, we can achieve almost universal forgery for K. The computational complexity is negligible.
Metadata
- Available format(s)
PDF- Category
- Secret-key cryptography
- Publication info
- Preprint.
- History
- 2024-06-07: last updated
- 2015-02-16: published
- Short URL
- https://ia.cr/2015/091
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2015/091,
author = {Christoph Dobraunig and Maria Eichlseder and Florian Mendel},
title = {Related-Key Forgeries for Prøst-OTR},
howpublished = {Cryptology {ePrint} Archive, Paper 2015/091},
year = {2015},
url = {https://eprint.iacr.org/2015/091}
}