A tweakable wide blockcipher is a construction which behaves in the same way as a tweakable blockcipher, with the difference that the actual block size is flexible. Due to this feature, a tweakable wide blockcipher can be directly used as a strong encryption scheme that provides full diffusion when encrypting plaintexts to ciphertexts and vice versa. Furthermore, it can be the basis of authenticated encryption schemes fulfilling the strongest security notions. In this paper, we present three instantiations of the docked double decker tweakable wide blockcipher: $$ ddd \text {-} AES $$ , $$ ddd \text {-} AES ^+$$ , and $$ bbb \text {-} ddd \text {-} AES $$ . These instances exclusively use similar building blocks as AES-GCM (AES and finite field multiplication), are designed for maximal parallelism, and hence, can make efficient use of existing hardware accelerators. $$ ddd \text {-} AES $$ is a birthday bound secure scheme, and $$ ddd \text {-} AES ^+$$ is an immediate generalization to allow for variable length tweaks. $$ bbb \text {-} ddd \text {-} AES $$ achieves security beyond the birthday bound provided that the same tweak is not used too often. Moreover, $$ bbb \text {-} ddd \text {-} AES $$ builds upon a novel conditionally beyond birthday bound secure pseudorandom function, a tweakable variant of the XOR of permutations, facilitating in the need to include a tweak in the AES evaluations without sacrificing flexibility in docked double decker. We furthermore introduce an authenticated encryption mode $$ aaa $$ specifically tailored to be instantiated with $$ ddd \text {-} AES $$ and $$ bbb \text {-} ddd \text {-} AES $$ , where special attention is given to how the nonce and associated data can be processed. We prove that this mode is secure in the nonce-respecting setting, in the nonce-misuse setting, as well as in the setting where random nonces are used. We finally present a comparison with other tweakable wide blockciphers, give a high-level idea of the efficiency potential of our schemes, and provide benchmarks that confirm this idea.

The Digital Security research department (part of Institute for Computing and Information Sciences) is engaged in research on computer security, including applied cryptography and security protocols, and the security and correctness of software.

Bart Mennink