Takanori Isobe

At ASIACRYPT 2022, Hosoyamada et al. introduced a rigorous white-box incompressibility framework for symmetric-key primitives, formalizing notions such as wh-PRP, wh-SPRP, and wh-PRI, and establishing reductions that weak public indifferentiability implies white-box reduction in their framework. As a concrete example, they demonstrated that counter mode with SIV construction achieves white-box incompressibility. Extending these results to one-pass constructions appears to be considerably challenging. In particular, any construction that is vulnerable under nonce repetitions with respect to the AE security is incompatible in their white-box setting, thereby posing a fundamental obstacle to achieving white-box incompressibility for such schemes. We address this by considering a weaker notion of AE security and introducing the notion of delayed on-line AE (dOAE), a natural and strictly more expressive extension of on-line AEAD supported by many efficient designs. Within this framework, we analyze the authenticated cipher SAEB, introduced by Naito et al. at TCHES'18, that achieves dOAE security under nonce misuse. We prove that SAEB achieves a white-box delayed on-line PRI (wh-dOPRI), assuming the underlying block-cipher to be wh-PRP. To the best of our knowledge, this is the first result providing a mode-level white-box guarantee for an efficient single-pass AEAD construction.

We have developed a dynamic M–H measurement system for high-frequency characterization of magnetic materials. The system employs a solenoid-type excitation coil driven at 1.2 MHz, which can generate magnetic fields up to 0.5 T at its center, enabling full hysteresis measurements of most soft magnetic materials. The phase delay between the excitation current and pickup voltage signals is calibrated using a paramagnetic Dy²O³ powder, and both the magnetic moment and applied fields of the system are calibrated with a sphere of YIG single crystal as a standard. We measured Ni–Zn ferrite and confirmed that our system can reliably capture complete dynamic magnetization loops at megahertz frequencies, providing a powerful tool for both fundamental research and practical evaluation of soft magnetic materials.

We present MSX, a new family of 64/128-bit block ciphers. It aims to provide fast execution on microcontrollers and comes with a highly reliable argument on the resistance against basic differential/linear attacks, backed by the classical differential/linear probability analysis on Feistel ciphers and Vaudenay's decorrelation theory. MSX are classical (generalized) Feistel ciphers with a round function. Similar to many existing ARX ciphers, its round function uses arithmetic operations and does not have an S-box. A unique feature of MSX is its use of 32-bit integer multiplication, which enables proving an ideally strong differential/linear property by design. It could be interpreted as an application of Vaudenay's decorrelation theory. We provide a detailed security analysis on attacks beyond differential and linear ones and conduct a benchmark on a range of popular microcontrollers with a comparison to Speck, a top performer on microcontrollers. The results show MSX's good performance on 32-bit microcontrollers, maintaining a sufficiently large security margin. MSX aims at security under single key, and related-key security is not the focus.

We propose the first updatable white-box secure cipher, EWEMrl, and its natural extension EWEMxl, both achieving longevity against non-adaptive read-only malware. The notion of longevity, introduced by Koike et al., addresses continuous code leakage and is stronger than incompressibility. While Yoroi claimed longevity, but was broken by Isobe and Todo. Given the prevalence of continuous leakage, developing such ciphers is crucial in white-box cryptography. Precisely, we have the following. We first present EWEMr (Extended WEM against non-adaptive read-only adversaries), a generalization of WEM (White-box Even-Mansour). WEM is the first (and possibly only) white-box cipher based on EM, replacing its key addition layer with a secret Sbox. EWEMr achieves a high space-hardness bound in the non-adaptive model, with a new generic proof strategy, but does not provide longevity. Instead, it serves as the base for EWEMrl. We also present EWEMx, which uses EWEMr as subroutines and achieves a high space-hardness bound in the stronger adaptive model. While EWEMx does not achieve longevity, it is the base design for EWEMxl. We next propose EWEMrl, that achieves longevity against non-adaptive read-only malware. None of the existing ciphers, such as SPNbox and SPACE, is designed for longevity. We show that EWEMrl ensures (against non-adaptive read-only adversaries) (1) longevity, (2) high space-hardness in both known-space and chosen-space settings, and (3) security against hybrid code-lifting attacks. Finally, we introduce EWEMxl, a natural extension of EWEMrl with a structure similar to EWEMx. EWEMxl achieves (2) and (3) in the stronger adaptive model while maintaining (1) in the same non-adaptive and read-only setting. In summary, our proposals EWEMrl and EWEMxl provide longevity against non-adaptive read-only malware while ensuring security confidence in the black-box setting.

We propose a lightweight block cipher named BAKSHEESH, which draws inspiration from GIFT (CHES'17). BAKSHEESH runs for 35 rounds, which is 12.5 per cent fewer rounds compared to GIFT-128 whilst maintaining the same security claims against classical attacks. However, we also present an alternate (but equivalent) angle of BAKSHEESH that follows the heritage of ZORRO (CHES'13). In the GIFT heritage version, BAKSHEESH uses a 4-bit SBox that has a non-trivial Linear Structure (LS). In the alternate ZORRO heritage specification, it employs a 3-bit SBox and realises a partial non-linear layer. BAKSHEESH is suitable for efficient hardware and software implementations, and also offers an edge on side channel countermeasures and other niche applications. For instance, our study on the threshold implementation shows that BAKSHEESH offers a few-fold advantage over other lightweight ciphers. We therefore create a new paradigm of lightweight ciphers through adequate deliberation on the design choice and solidify it with appropriate security analysis and ample implementation/benchmark.

In this paper, we explore the potential of improving AES-based schemes by integrating SHA instructions alongside AES instructions, starting from the key observation that SHA instructions can be executed in parallel with AES instructions on modern processors. We investigate conditions for parallel execution, the invocation ratio, and overhead of type conversions, and then provide guidelines for efficient SHA instruction usage with AES instructions. Applying these guidelines, we integrate SHA round functions into the AES-based short-input hash functions of Simpira and Areion, resulting in approximately 50% faster performance by achieving security with fewer iterations. Besides, we apply integration of SHA instructions to AES-based AEAD schemes of AEGIS-128L, which supports a 256-bit tag but has recently been shown to fall short of providing full 256-bit forgery security. We demonstrate that hybrid schemes can achieve 256-bit forgery security for AEGIS-128L while preserving performance.

For expanding vehicle electrification and the use of renewable energy, high power density inverters are required. One of the ways to achieve high power density is by enhancing the switching frequency on the inverters, which can reduce the volume of passive components. By accelerating the switching frequency, the dead time ratio in one switching cycle increases, and dead time issues such as higher conduction losses caused by diode current become conspicuous. The dead time issues consequently limit the switching frequency on the inverters. Complementary inverters, which consist of n- and p-channel field effect transistors (FETs) in the same leg, have been proposed to resolve the issues by automatically minimizing the dead time. The n- and p-channel FETs, which exhibit equivalent performance, are required to fabricate the complementary inverters. However, wide-bandgap semiconductors such as SiC and GaN are unsuitable for the p-channel FETs because of their deep acceptor levels and low hole mobility. In contrast, diamond is the most promising candidate for the p-channel FETs due to its superior physical properties. In this study, a complementary half-bridge inverter was fabricated using a cascode diamond MOSFET and either an SiC MOSFET or a GaN HEMT, and fast power switching on the complementary half-bridge inverter with no intentional dead time at 100 kHz was successfully demonstrated. This result indicates that complementary inverters using diamond MOSFETs have the potential to overcome the dead time issues and achieve higher power density.