Minimizing Even-Mansour Ciphers for Sequential Indifferentiability (Without Key Schedules)

Xu, Shanjie; Da, Qi; Guo, Chun

doi:10.1007/978-3-031-22912-1_6

Cited by 4 publications

(3 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note that, both [XDG22] and this paper build over [CS15b]. In fact, our result can be seen as a generalization of [XDG22], for larger key (key size ≥ rn-bit for r ≥ 1) and typical linear TWEAKEY schedules. Table 1.1 gives a comparison of the three results.…”

Section: Rounds Primitives Key Size Complex Boundsmentioning

confidence: 78%

“…The indifferentiability of Even-Mansour ciphers has been an active area of research with a series of papers proving both indifferentiability [ABD + 13, LS13a, DSST17, GL16] and its sequential counterpart [CS15b,CS16,XDG22]. Interestingly though all these works, either consider a trivial key schedule, where the round keys are the same as the master key, and hence the master key size is same as the permutation input size, say n, or employ independent random oracles to derive the round keys from the master key.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

On Large Tweaks in Tweakable Even-Mansour with Linear Tweak and Key Mixing

Cogliati,

Ethan,

Jha

et al. 2023

ToSC

View full text Add to dashboard Cite

In this paper, we provide the first analysis of the Iterated Tweakable Even-Mansour cipher with linear tweak and key (or tweakey) mixing, henceforth referred as TEML, for an arbitrary tweak(ey) size kn for all k ≥ 1, and arbitrary number of rounds r ≥ 2. Note that TEML captures the high-level design paradigm of most of the existing tweakable block ciphers (TBCs), including SKINNY, Deoxys, TweGIFT, TweAES etc. from a provable security point of view. At ASIACRYPT 2015, Cogliati and Seurin initiated the study of TEML by showing that 4-round TEML with a 2n-bit uniform at random key, and n-bit tweak is secure up to 22n/3 queries. In this work, we extend this line of research in two directions. First, we propose a necessary and sufficient class of linear tweakey schedules to absorb mn-bit tweak(ey) material in a minimal number of rounds, for all m ≥ 1. Second, we give a rigorous provable security treatment for r-round TEML, for all r ≥ 2. In particular, we first show that the 2r-round TEML with a (2r + 1)n-bit key, αn-bit tweak, and a special class of tweakey schedule is IND-CCA secure up to O(2r−α/r n) queries. Our proof crucially relies on the use of the coupling technique to upper-bound the statistical distance of the outputs of TEML cipher from the uniform distribution. Our main echnical contribution is a novel approach for computing the probability of failure in coupling, which could be of independent interest for deriving tighter bounds in coupling-based security proofs. Next, we shift our focus to the chosen-key setting, and show that (r + 3)-round TEML, with rn bits of tweakey material and a special class of tweakey schedule, offers some form of resistance to chosen-key attacks. We prove this by showing that r + 3 rounds of TEML are both necessary and sufficient for sequential indifferentiability. As a consequence of our results, we provide a sound provable security footing for the TWEAKEY framework, a high level design rationale of popular TBC.

show abstract

Section: Rounds Primitives Key Size Complex Boundsmentioning

confidence: 78%

Section: Introductionmentioning

confidence: 99%

On Large Tweaks in Tweakable Even-Mansour with Linear Tweak and Key Mixing

Cogliati,

Ethan,

Jha

et al. 2023

ToSC

View full text Add to dashboard Cite

show abstract

“…Unfortunately, this is insecure even w.r.t. seq-indifferentiability [XDG23]: by acting as the involved evaluations in all the t rounds, a single permutation-evaluation p(x) = y already yields a full t-round EMSP t enciphering y → (x, y) → ... → (x, y) t times → x with k = x ⊕ y. Xu et al [XDG23] thus only proved seq-indifferentiability for a 4-round IEM variant using 2 permutations, which still falls short of addressing the single permutation problem.…”

Section: Our Contributionsmentioning

confidence: 99%

Chosen-Key Secure Even-Mansour Cipher from a Single Permutation

Guo

2023

ToSC

View full text Add to dashboard Cite

At EUROCRYPT 2015, Cogliati and Seurin proved that the 4-round Iterated Even-Mansour (IEM) cipher with Independent random Permutations and no key schedule EMIP4(k, u) = k⊕p4 ( k⊕p3 ( k⊕p2 (k⊕p1 (k⊕u)))) is sequentially indifferentiable from an ideal cipher, which implies chosen-key security in the sense of correlation intractability. In practice, however, blockciphers such as the AES typically employ the same permutation at each round. To bridge the gap, we prove that the 4-round IEM cipher EMSP[φ]p4 (k, u) = k4⊕p (k3⊕p (k2⊕p(k1⊕p(k0⊕u)))), whose round keys ki = φi(k) are derived using an affine permutation φ : {0, 1}n → {0, 1}n with certain properties, is sequentially indifferentiable from an ideal cipher. The function φ can be a linear orthomorphism, or φ(k) := k≫a for some fixed integer a using cyclic shift. To our knowledge, this is the first indifferentiability-type result for blockciphers using identical round functions.

show abstract

Feistel Ciphers Based on a Single Primitive

Tsuji,

Iwata

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Minimizing Even-Mansour Ciphers for Sequential Indifferentiability (Without Key Schedules)

Cited by 4 publications

References 33 publications

On Large Tweaks in Tweakable Even-Mansour with Linear Tweak and Key Mixing

On Large Tweaks in Tweakable Even-Mansour with Linear Tweak and Key Mixing

Chosen-Key Secure Even-Mansour Cipher from a Single Permutation

Feistel Ciphers Based on a Single Primitive

Contact Info

Product

Resources

About