Re: [Cfrg] SHA256 based AEAD construction

You might have a look at this paper, which specifies an AEAD scheme based
on hash functions (instantiated with SHA-256, but also usable with e.g.
SHA-3) as part of their pursuit of additional security properties (ccAEAD,
which adds a commitment scheme).

https://eprint.iacr.org/2019/016.pdf

On Mon, Feb 18, 2019 at 3:17 PM Fihlman Emil <emil.fihlman@aalto.fi> wrote:

> Hi
>
> Let me first apologise if this is not the correct forum (if so, any
> pointers towards a place of discussion are appreciated).
>
> I recently implemented a SHA256 based AEAD crypto (base file
> https://emil.fi/d/sha256.c and a test program / simple utility
> https://emil.fi/d/sha256crypt.c).
>
> In a nutshell:
> We make an intermediate key kv by taking sha256(key|vector), which is then
> used to
> a) generate a random keystream by taking sha256(kv|counter), with which
> input is xorred by and
> b) take a hmac of the ciphertext for authentication.
>
> This concept is nothing new nor special. Some positives provided by this
> scheme are a) the base key is in the system only for a brief moment, b)
> it's very, very simple and easy to audit and use.
>
> My current idea is to release this as a foss library after refinements,
> mainly targeted for resource limited systems.
> I greatly appreciate any criticism, guidance, ideas and suggestions
> (especially improvements on reducing ram and cpu requirements and hardening
> against any timing/side channel attacks are welcomed, I suspect there are
> quite a few low hanging fruits at the moment).
>
> Emil Fihlman
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Tony Arcieri