Band 10, Heft 3-4

Two Boolean functions are affine equivalent if one can be obtained from the other by applying an affine transformation to the input variables. For a long time, there have been efforts to investigate the affine equivalence of Boolean functions. Due to the complexity of the general problem, only affine equivalence under certain groups of permutations is usually considered. Boolean functions which are invariant under the action of cyclic rotation of the input variables are known as rotation symmetric (RS) Boolean functions. Due to their speed of computation and the prospect of being good cryptographic Boolean functions, this class of Boolean functions has received a lot of attention from cryptographic researchers. In this paper, we study affine equivalence for the simplest rotation symmetric Boolean functions, called MRS functions, which are generated by the cyclic permutations of a single monomial. Using Pólya’s enumeration theorem, we compute the number of equivalence classes, under certain large groups of permutations, for these MRS functions in any number n of variables. If n is prime, we obtain the number of equivalence classes under the group of all permutations of the variables.

In [2], Bellare, Pietrzak and Rogaway proved an O⁢(ℓ⁢q2/2n)${O(\ell q^{2}/2^{n})}$ bound for the PRF (pseudorandom function) security of the CBC-MAC based on an n -bit random permutation Π, provided ℓ<2n/3${\ell<2^{n/3}}$. Here an adversary can make at most q prefix-free queries each having at most ℓ${\ell}$ many “blocks” (elements of {0,1}n${\{0,1\}^{n}}$). In the same paper an O⁢(ℓo⁢(1)⁢q2/2n)${O(\ell^{o(1)}q^{2}/2^{n})}$ bound for EMAC (or encrypted CBC-MAC) was proved, provided ℓ<2n/4${\ell<2^{n/4}}$. Both proofs are based on structure graphs representing all collisions among “intermediate inputs” to Π during the computation of CBC. The problem of bounding PRF-advantage is shown to be reduced to bounding the number of structure graphs satisfying certain collision patterns. In the present paper, we show that [2, Lemma 10], stating an important result on structure graphs, is incorrect. This is due to the fact that the authors overlooked certain structure graphs. This invalidates the proofs of the PRF bounds. In [31], Pietrzak improved the bound for EMAC by showing a tight bound O⁢(q2/2n)${O(q^{2}/2^{n})}$ under the restriction that ℓ<2n/8${\ell<2^{n/8}}$. As he used the same flawed lemma, this proof also becomes invalid. In this paper, we have revised and sometimes simplified these proofs. We revisit structure graphs in a slightly different mathematical language and provide a complete characterization of certain types of structure graphs. Using this characterization, we show that PRF security of CBC-MAC is about σ⁢q/2n${\sigma q/2^{n}}$ provided ℓ<2n/3${\ell<2^{n/3}}$ where σ is the total number of blocks in all queries. We also recover tight bound for PRF security of EMAC with a much relaxed constraint (ℓ<2n/4${\ell<2^{n/4}}$) than the original (ℓ<2n/8${\ell<2^{n/8}}$).

In 2002, An et al. [1] proposed three generic conversions of signcryption, ℰ⁢t⁢𝒮${\mathcal{E}t\mathcal{S}}$, 𝒮⁢t⁢ℰ${\mathcal{S}t\mathcal{E}}$ and 𝒞⁢t⁢ℰ&𝒮${\mathcal{C}t\mathcal{E}\&\mathcal{S}}$ from the primitive encryption scheme and signature scheme. But, the security proof of confidentiality in the 𝒞⁢t⁢ℰ&𝒮${\mathcal{C}t\mathcal{E}\&\mathcal{S}}$ paradigm was ambiguous. In this paper, we revisit these paradigms again and provide a more transparent proof for the aforementioned paradigm. None of these paradigms preserves both stronger securities: strong unforgeability and IND-CCA security. We extend the above paradigms to new signcryption paradigms, ℰ⁢t⁢𝒮⁢t⁢𝒮${\mathcal{E}t\mathcal{S}t\mathcal{S}}$, 𝒮⁢t⁢ℰ⁢t⁢𝒮${\mathcal{S}t\mathcal{E}t\mathcal{S}}$ and 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮${\mathcal{C}t\mathcal{E}\&\mathcal{S}t\mathcal{S}}$, by applying one-time signature (OTS) cautiously at the outside layer. In these new paradigms, the stronger security of the primitive encryption and signature schemes are maintained. We also obtain a new paradigm, “Encrypt and Sign then Sign (ℰ&𝒮⁢t⁢𝒮${\mathcal{E}\&\mathcal{S}t\mathcal{S}}$)”, which is surprisingly better than the 𝒞⁢t⁢ℰ&𝒮⁢t⁢𝒮${\mathcal{C}t\mathcal{E}\&\mathcal{S}t\mathcal{S}}$ paradigm in all aspects except that ℰ&𝒮⁢t⁢𝒮${\mathcal{E}\&\mathcal{S}t\mathcal{S}}$ does not guarantee the non-repudiation. Moreover, the IND-CCA security and strong unforgeability of the proposed signcryptions are achieved from the IND-gCCA secure encryption scheme and weak unforgeable signature scheme, respectively. Further, we extend these paradigms to capture signcryptions in attribute-based setting, also known as attribute-based signcryption (ABSC). We show that the IND-CCA security and strong unforgeability under chosen message attack of ABSC can be obtained from IND-CPA security of ABE and unforgeability under no message attack of ABS, respectively. Furthermore, our generic constructions are applicable to a combined setup , where the public parameters and keys for the primitives ABS and ABE are identical. The security of all the generic constructions is proven in the standard model.