Authenticated encryption schemes which resist misuse of nonce at some desired level of privacy are two-pass or Mac-then-Encrypt constructions (inherently inefficient but provide full privacy) and online constructions like McOE, sponge-type authenticated encryptions (such as duplex) and COPA. Only the last one is almost parallelizable except that for associated data processing, the final block-cipher call is sequential (it needs to wait for the encryption of all the previous ones). In this paper, we design a new online secure authenticated encryption, called ELmD or Encrypt-Linear mix-Decrypt, which is completely (two-stage) parallel (even in associated data) and fully pipeline implementable. It also provides full privacy when associated data is not repeated. Like COPA, our construction is based on EME, an Encrypt-Mix-Encrypt type SPRP construction (secure against chosen plaintext and ciphertext). But unlike EME, we have used an online computable efficient linear mixing instead of a non-linear mixing. We have also provided the hardware implementation of the construction and compare the performance with similar constructions like COPA and EME2.

For almost one decade, the academic community has been working in the design and analysis of new lightweight primitives. This cryptography development aims to provide solutions tailored for resource-constrained devices. The U.S. National Institute of Standards and Technology (NIST) started an open process to create a Lightweight Cryptography Standardization portfolio. As a part of the process, the candidates must demonstrate their suitability for hardware implementation. Cost and performance are two of the criteria to be evaluated. In this work, we present the analysis of costs and performance in hardware implementations over five NIST LWC Round 2 candidates, COMET, ESTATE-AES/Gift, LOCUS, LOTUS, and Oribatida. Each candidate’s implementation was adapted to the Hardware API for Lightweight Cryptography for fair benchmarking of hardware cores. The results were generated for Xilinx Artix-7 xc7a12tcsg325-3. The results indicate that it is feasible to achieve the reduction of each solution below 2000 LUTs and 2000 slices where some of them (the variants of ESTATE-AES/Gift) are below 850 LUTs and 600 FF when they are included in the LWC CryptoCore.

Authenticated encryption algorithms offer privacy, authentication, and data integrity, as well. In recent years, they have received special attention after the call for submissions of Competition for Authenticated Encryption: Security, Applicability, and Robustness (CAESAR) was published. The CAESAR goal is to generate a portfolio with recommendations of authenticated encryption algorithms for three different scenarios: lightweight, high speed, and defense in deep. ELmD and COPA are two on-line authenticated encryption algorithms submitted to CAESAR; because of their similarities, they were merged as COLM during the third-round of CAESAR. COLM is a finalist in the use case 3 defense in depth. ELmD, COPA, and COLM are based on the ECB-mix-ECB structure, which is highly parallelizable and pipelineable. In this paper, we present optimized single-chip implementations of ELmD, COPA, and COLM using pipelining. For ELmD, we present implementations for eight combinations of its parameters set: for intermediate tags, fixed, variable tag length, and 10 and 6 AES rounds. COLM implementation is for variable tag length without intermediate tags. In the case of COPA, it does not have not parameters set. The implementation results with a Xilinx Virtex 6 FPGA show that ELmD is the best option concerning area and speed for single-chip implementation. The area of COPA and COLM are 1.65 and 1.69 times ELmD's respectively. Regarding throughput, the range of our implementations goes from 33.34 Gbits/s for COLM to more than 35 Gbits/s for several versions of ELmD.

Offset Codebook or OCB mode is a popular block cipher mode of operation for authenticated encryption. The latest version of this cipher, called OCB3, is one of the finalists in CAESAR. In this paper we explore the scope of random read access and out-of-sequence decryption in OCB. We observe that the current versions of OCB are inefficient in this respect owing to the ineptness of the underlying mask generating function (MGF). We propose new candidates for MGF based on AES round function, which are efficient in direct computation and provide comparable performance in the usual setting. Our schemes are not the obvious choices for MGF in conventional sense as they do not have optimal almost XOR universal (AXU) bound. In existing OCB designs the MGFs are required to have 2-n, i.e. optimal, AXU bound in order to upper bound the distinguishing advantage to O(σ2/2n), where n is the block size of the underlying block cipher and σ is the total number of blocks among all queries. We find this specific requirement too restrictive. We abstract the OCB design, termed as GOCB, to look into the universal notion required from the underlying MGF. We propose a relaxed notion of AXU, called locally imperfect XOR universal (LIXU) hash, which can be of independent interest. Using LIXU as the underlying MGF we recover reasonable security bounds for our schemes.