Gilles Van Assche

Protocols in symmetric cryptography are often built from block ciphers, with a fixed input and output size, while variable sizes are handled through their modes of use. Incrementality, namely, the ability to efficiently compute the output for increasing inputs, or to request longer outputs, is often a property of the implementation rather than an explicit feature of a mode.

A doubly-extendable cryptographic keyed (or deck) function is a new kind of object that makes incrementality an integral part of its definition. Writing modes for various applications, such as authenticated encryption of a network channel or disk encryption with a wide block cipher, on top of a deck function turns out to be a simple exercise and leads to less error-prone implementations than on top of a block cipher. We illustrate this with the session-supporting authenticated encryption modes SANE and SANSE. (Sessions naturally protect a continuous flow of messages or a client-server dialog.)

While a deck function can be constructed from existing primitives, like a block cipher, we show two more natural ways of making a deck function in practice.

• The first one is based on the well-known permutation-based duplex construction, of which a nice instantiation is the Strobe protocol framework. Strobe was showcased in Noise+Strobe=Disco as an advantageous replacement to all kinds of primitives in the Noise protocol framework, resulting in much simpler specifications and a lighter implementation. Xoodyak, our candidate to the NIST Lightweight Cryptography competition, is another example.

• The second one is based on the recent Farfalle construction, which relies on the parallel application of a permutation. Farfalle's inherent parallelism yields deck functions that are at the same time simple and efficient on a wide range of platforms. In particular, we point out the nice performance of Kravatte and Xoofff, two deck functions based on the Keccak-p and the Xoodoo permutation, respectively. It is worth noting that Kravatte and Xoofff are much faster than AES-128 in software, and at least competitive with and often faster than AES-128 using dedicated AES instructions on the more recent Intel and AMD processors!

Since its adoption as the SHA-3 standard, Keccak has grown out of the mere hashing functionality. We present a consistent set of cryptographic functions, for fast hashing, pseudo-random bit generation, authentication or authenticated encryption, that enjoy very competitive safety margin vs speed ratios. We highlight the bases for the security of these functions and dive into their software implementations.

Beyond the FIPS 202 standard functions derived from Keccak (i.e., SHA-3 hash functions and SHAKE{128,256} extendable output functions), we present several interesting proposals, consistently based on the same permutation or its round function. Among others:

• For authenticated encryption, Ketje and Keyak are schemes that were selected for the third round of the CAESAR competition. In particular, Keyak proposes interesting features when protecting a stream of data flowing on a network. It exploits the parallelism in modern processors to achieve a high throughput.
• KangarooTwelve is a recently published arbitrary-output-length hash function. We designed it so that the implementation can automatically adapt to the available degree of parallelism. On Intel's Haswell and Skylake architectures, it achieves a speed below 1.5 cycles/byte for long inputs.

Two key aspects will be covered.

First, the essential goal of these functions is to remain secure despite advances in cryptanalysis. We will explain explain how we base the security on two strong pillars: the track record of third-party cryptanalysis and the generic security of the underlying construction.

Second, we will explore the Keccak Code Package and its two-level structure. The high-level cryptographic services are implemented in plain C, without any specific optimizations. The low-level services implement the permutations and the state input/output functions, for which we provide optimized code for different platforms. Another interesting topic to discuss is how the parallelism is exploited on modern processors with SIMD units.

In April 2014, the American National Institute of Standards and Technology (NIST) published the draft FIPS 202 standard for the SHA-3 hash functions and the SHAKE extendable-output functions (XOFs), all based on the Keccak sponge function. Since the selection of Keccak as the winner of the SHA-3 cryptographic open competition, NIST announced that they will exploit Keccak's abilities for other purposes than just hashing, including key derivation, pseudo-random bit generation, authentication and (authenticated) encryption.

A first part of the talk will be to give a summary of the current developments around Keccak and the FIPS 202 standard.

In the meantime, we have gathered the most efficient implementations of Keccak, SHA-3 hash functions and SHAKE XOFs in the Keccak Code Package. These open source implementations are organized in a way that aims satisfying both the developer of optimized code and the cryptographic user. Central to this organization is a specific internal interface that allows interchangeable optimized codes and a user-friendly set of external services.

As a second part of the talk, we will briefly present the current status of this development and how the FOSS community can benefit from (and contribute to) this effort.

This is a follow-up of the talk "Keccak: more than sha3sum" at FOSDEM 2013.

Recently, the American National Institute of Standards and Technology (NIST) announced the selection of Keccak as the winner of the SHA-3 Cryptographic Hash Algorithm Competition. This concluded an open competition that was remarkable both for its magnitude and the involvement of the cryptographic community. Public review is of paramount importance to increase the confidence in the new standard and to favor its quick adoption. The SHA-3 competition explicitly took this into account by giving open access to the candidate algorithms and everyone in the cryptographic community could try to break them, compare their performance, or simply give comments.

In this talk the authors of Keccak will introduce and highlight the strengths of their cryptographic primitive and explain how it can benefit to the FOSS community.

Although Keccak, as the SHA-3 standard, will coexist with the current standard SHA-2 hash function family, it is much more than just another "SHAxSUM" algorithm. Keccak relies at its core on a new construction, called the sponge construction, which allows for simpler and more flexible modes of use. The talk will illustrate this by giving various examples on how current software designs can benefit from this greater flexibility, e.g., for all the flavors of hashing, stream encryption, authentication, authenticated encryption and pseudo-random bit generation.

This talk will also focus on the different aspects that make the design of Keccak open, from the open source implementations on various platforms to initiatives to keep encouraging third-party cryptanalysis, such as the KeccakTools cryptanalysis software and the Crunchy Crypto Collision and Pre-image Contest.