Version 6.1.2
Quasor is a high-security Authenticated Encryption with Associated Data (AEAD) scheme designed for modern applications where robustness and defense-in-depth are paramount. It is built on a Duplex Sponge construction using SHAKE256 and incorporates several advanced features to provide strong protection against both implementation errors and sophisticated attacks.
The primary design goals achieved in this version are:
The master key K for the cipher is derived from a user-provided password and a unique salt using Argon2id.
password (variable length) and a unique salt (minimum 8 bytes).Argon2id function is called with its default secure parameters to produce a 32-byte (256-bit) master key K.Quasor v6.1 implements explicit domain separation to prevent cross-operation attacks and improve security analysis. All operations use 4-byte ASCII domain separators:
These domain separators ensure that different cryptographic operations cannot interfere with each other, providing defense-in-depth against implementation errors and cryptanalytic attacks.
The duplex sponge maintains internal state through explicit mode tracking:
Implementations MUST:
Inputs:
Quasor instance containing the master key K.P.A.Procedure:
Nonce Derivation (SIV):
a. A 128-bit nonce N is derived by computing the keyed hash of the associated data and the plaintext using a secure, unambiguous serialization.
| b. The exact structure to be hashed is: len(A) | A | len(P) | P, where len() is the length in bytes, encoded as a 64-bit little-endian integer. |
c. For large inputs, the hashing of P is automatically parallelized using Rayon for high performance.
Initialization:
a. A new SHAKE256 sponge instance is initialized.
b. The domain separator INIT is absorbed first for operation isolation.
c. The master key K, the derived nonce N, and the associated data A are absorbed into the sponge.
d. The rekey counter is initialized to 0.
Encryption, Duplexing, and Rekeying:
a. The domain separator ENCR is absorbed to indicate the start of encryption operations.
b. The plaintext P is processed sequentially in efficient chunks of 1024 bytes.
c. For each chunk, a keystream of the same size is squeezed from the sponge and XORed with the plaintext to produce ciphertext. The original plaintext chunk is then absorbed back into the sponge’s state.
d. After each REKEY_INTERVAL (64 KiB) of data is processed, a rekeying step is performed:
Tag Generation:
a. After all plaintext has been processed, the domain separator AUTH is absorbed.
b. A 32-byte authentication tag T is squeezed from the sponge’s final state.
Outputs:
CTN (must be stored with the ciphertext)Inputs:
Quasor instance containing the master key K.N (16 bytes).C.A.T.Procedure:
Initialization & Decryption:
a. The decryption process mirrors the encryption process exactly: the sponge is initialized with the INIT domain separator, followed by K, N, and A.
b. The rekey counter is initialized to 0.
c. The domain separator ENCR is absorbed to indicate the start of decryption operations.
d. The ciphertext is processed sequentially to reconstruct the plaintext, with identical rekeying steps performed along the way (including domain separation and counter incrementation).
Tag Verification:
a. After all ciphertext is processed, the domain separator AUTH is absorbed.
b. An expected tag T’ is squeezed from the sponge’s final state.
c. The received tag T must be compared to the computed tag T’ using a constant-time equality function. This is a critical step to prevent timing side-channel attacks. If they do not match, the process aborts, and an error is returned.
Nonce Verification:
a. If the tag is valid, the SIV nonce is re-derived using the newly decrypted plaintext P and the same length-prefixed serialization as in encryption.
b. This re-derived nonce N’ is compared to the received nonce N using constant-time comparison. If they do not match, the process aborts, and an error is returned. This final check ensures the integrity of the entire message.
Output:
P (on success) or an authentication error.The v6.1 rekeying protocol includes several improvements over previous versions:
perform_rekey():
1. sponge.absorb(DOMAIN_RKEY)
2. sponge.absorb(rekey_counter.to_le_bytes())
3. ephemeral_key = sponge.squeeze(32)
4. sponge.absorb(ephemeral_key)
5. rekey_counter += 1
Constant-Time Operations: All comparisons of cryptographic secrets (specifically, the authentication tag and the SIV nonce) must be performed in constant time. This mitigates timing side-channel attacks.
Sequential Duplexing: The core encryption/decryption loop is intentionally sequential. While parallelizing this step is possible in some sponge modes, it would break the specific duplex construction used here. Parallelism is safely used in the SIV nonce derivation step.
Memory-Hard KDF: Using Argon2id makes Quasor highly resistant to password cracking attempts.
Nonce-Misuse Resistance (SIV): By deriving the nonce deterministically from the message content, Quasor prevents the catastrophic key-reuse vulnerabilities that plague many other AEADs.
Enhanced Forward Secrecy: The automatic rekeying mechanism with counter-based state ensures that a compromise of the cipher’s state at any given time does not compromise previously encrypted data, and prevents state repetition attacks.
Domain Separation: Explicit domain separation prevents cross-operation attacks and makes security analysis more straightforward by ensuring different operations cannot interfere with each other.
Secure Memory: The Quasor struct and its internal states use the zeroize crate to securely overwrite sensitive key material in memory as soon as it goes out of scope.
Password: "QuasorKATPassword"
Salt: "QuasorKATSalt123"
Associated Data: "KnownAnswerTestAD"
Plaintext: "This is the official test vector for the Quasor AEAD."
Expected Results (v6.1):
Nonce: [to be generated with domain separation implementation]
Ciphertext: [to be generated with domain separation implementation]
Tag: [to be generated with domain separation implementation]
Password: [32 zero bytes]
Salt: [16 zero bytes]
Associated Data: [empty]
Plaintext: [empty]
Expected Results (v6.1):
Nonce: [to be generated with domain separation implementation]
Ciphertext: [empty]
Tag: [to be generated with domain separation implementation]