Efficient and Optimally Secure Key-Length Extension for Block Ciphers via Randomized Cascading

Gaži, Peter; Tessaro, Stefano

doi:10.1007/978-3-642-29011-4_6

Cited by 20 publications

(40 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This model has already been employed numerous times to analyze the security of key-length extending constructions, e.g. in [20,10,17,19]. …”

Section: Block Ciphers and The Key-length Extension Problemmentioning

confidence: 99%

Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers

Gaži

2013

Advances in Cryptology – CRYPTO 2013

Self Cite

View full text Add to dashboard Cite

Abstract. Cascading-based constructions represent the predominant approach to the problem of keylength extension for block ciphers. Besides the plain cascade, existing works also consider its modification containing key-whitening steps between the invocations of the block cipher, called randomized cascade or XOR-cascade. We contribute to the understanding of the security of these two designs by giving the following attacks and security proofs, assuming an underlying ideal block cipher with key length κ and block length n:-For the plain cascade of odd (resp. even) length we present a generic attack requiring roughlyn (resp. 2 κ+ −2 n ) queries, being a generalization of both the meet-in-the-middle attack on double encryption and the best known attack on triple cascade.-For XOR-cascade of odd (resp. even) length we prove security up to 2queries and also an improved bound 2 κ+ −1 n for the special case ∈ {3, 4} by relating the problem to the security of key-alternating ciphers in the random-permutation model. -Finally, for a natural class of sequential constructions where block-cipher encryptions are interleaved with key-dependent permutations, we show a generic attack requiring roughly 2 κ+ −1 n queries.Since XOR-cascades are sequential, this proves tightness of our above result for XOR-cascades of length ∈ {3, 4} as well as their optimal security within the class of sequential constructions. These results suggest that XOR-cascades achieve a better security/efficiency trade-off than plain cascades and should be preferred.

show abstract

“…This model has already been employed numerous times to analyze the security of key-length extending constructions, e.g. in [20,10,17,19]. …”

Section: Block Ciphers and The Key-length Extension Problemmentioning

confidence: 99%

Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers

Gaži

2013

Advances in Cryptology – CRYPTO 2013

Self Cite

View full text Add to dashboard Cite

show abstract

“…Looking at (9) it is possible to wonder whether anything substantial has been gained so far, or whether notations are simply being shuffled around; after all, Pr[X = τ ] and Pr Ω X [ω ∈ comp X (τ )] are "obviously the same thing" 4 (and the same for Y ). However the probability Pr Ω X [ω ∈ comp X (τ )] offers 1 More formally, the oracle is a deterministic function taking as input a query and a (large) random tape, where the random tape is sampled and fixed at the start of the experiment.…”

Section: Lower Bounding the Ratiomentioning

confidence: 99%

Tight Security Bounds for Key-Alternating Ciphers

Chen

Steinberger

2014

Lecture Notes in Computer Science

202

191

View full text Add to dashboard Cite

Abstract. A t-round key-alternating cipher (also called iterated Even-Mansour cipher ) can be viewed as an abstraction of AES. It defines a cipher E from t fixed public permutations P1, . . . , Pt : {0, 1} n → {0, 1} n and a key k = k0 · · · kt ∈ {0, 1} n(t+1) by setting. The indistinguishability of E k from a truly random permutation by an adversary who also has oracle access to the (public) random permutations P1, . . . , Pt was investigated in 1997 by Even and Mansour for t = 1 and for higher values of t in a series of recent papers. For t = 1, Even and Mansour proved indistinguishability security up to 2 n/2 queries, which is tight. Much later Bogdanov et al. (2011) conjectured that security should be 2 t t+1 n queries for general t, which matches an easy distinguishing attack (so security cannot be more). n for all even values of t, thus "barely" falling short of the desired 2 t t+1 n .Our contribution in this work is to prove the long-sought-for security bound of 2 t t+1n , up to a constant multiplicative factor depending on t. Our method is essentially an application of Patarin's H-coefficient technique.

show abstract

“…The ICM became increasingly popular after Black et al [12] used it to extensively analyze the security of the PGV block cipher-based compression functions [51]. Since then, the ICM has been used to prove the security of a variety of other block cipher-based hash functions [30,31,58,40,46], of key length extension methods for block ciphers [35,21,7,25,26], of symmetric encryption schemes [33], and even of some public-key protocols such as signature schemes [29], ring signature schemes [53], public-key encryption [34], and key exchange protocols [6]. Despite these numerous successful applications, one must not lose from sight that the ICM only gives heuristic insurance just as the ROM [14].…”

Section: Introductionmentioning

confidence: 99%

How to Construct an Ideal Cipher from a Small Set of Public Permutations

Lampe

Seurin

2013

Advances in Cryptology - ASIACRYPT 2013

View full text Add to dashboard Cite

Abstract. We show how to construct an ideal cipher with n-bit blocks and n-bit keys (i.e. a set of 2 n public n-bit permutations) from a small constant number of n-bit random public permutations. The construction that we consider is the single-key iterated Even-Mansour cipher, which encrypts a plaintext x ∈ {0, 1} n under a key k ∈ {0, 1} n by alternatively xoring the key k and applying independent random public n-bit permutations P1, . . . , Pr (this construction is also named a keyalternating cipher). We analyze this construction in the plain indifferentiability framework of Maurer, Renner, and Holenstein (TCC 2004), and show that twelve rounds are sufficient to achieve indifferentiability from an ideal cipher. We also show that four rounds are necessary by exhibiting attacks for three rounds or less.

show abstract

Efficient and Optimally Secure Key-Length Extension for Block Ciphers via Randomized Cascading

Cited by 20 publications

References 28 publications

Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers

Plain versus Randomized Cascading-Based Key-Length Extension for Block Ciphers

Tight Security Bounds for Key-Alternating Ciphers

How to Construct an Ideal Cipher from a Small Set of Public Permutations

Contact Info

Product

Resources

About