On the Indifferentiability of Key-Alternating Ciphers

Abstract

Abstract. The Advanced Encryption Standard (AES) is the most widely used block cipher. The high level structure of AES can be viewed as a (10-round) key-alternating cipher, where a t-round key-alternating cipher KAt consists of a small number t of fixed permutations Pi on n bits, separated by key addition:where (k0, . . . , kt) are obtained from the master key K using some key derivation function. For t = 1, KA1 collapses to the well-known Even-Mansour cipher, which is known to be indistinguishable from a (secret) random permutation, if P1 is modeled as a (public) random permutation. In this work we seek for stronger security of key-alternating ciphers -indifferentiability from an ideal cipher -and ask the question under which conditions on the key derivation function and for how many rounds t is the key-alternating cipher KAt indifferentiable from the ideal cipher, assuming P1, . . . , Pt are (public) random permutations? As our main result, we give an affirmative answer for t = 5, showing that the 5-round key-alternating cipher KA5 is indifferentiable from an ideal cipher, assuming P1, . . . , P5 are five independent random permutations, and the key derivation function sets all rounds keys ki = f (K), where 0 ≤ i ≤ 5 and f is modeled as a random oracle. Moreover, when |K| = |m|, we show we can set f (K) = P0(K) ⊕ K, giving an n-bit block cipher with an n-bit key, making only six calls to n-bit permutations P0, P1, P2, P3, P4, P5.

How to Construct an Ideal Cipher from a Small Set of Public Permutations

“…In a prior and independent work [2], Andreeva et al proved a result which is close and complementary to ours: they showed that the iterated Even-Mansour construction with five rounds and a key derivation function modeled as a random oracle is indifferentiable from an ideal cipher. Though significantly reducing the number of rounds required for the proof to go through, and lifting the restriction that the master key length be equal to the block length of the permutations, their technique puts a strong burden on the key derivation function, which can hardly be seen as close to a random oracle in most concrete block ciphers.…”

“…Together with the result of [2] discussed below, our main theorem validates the design strategy underlying SPNs and more generally key-alternating ciphers as a sound way to ensure security beyond pseudorandomness: it (theoretically) enables to achieve resistance against related-key, known-key and chosen-key attacks (that an ideal cipher can withstand). We stress that our result cannot be used as is to take concrete design decisions: first, our bounds (as is often the case with indifferentiability results) are extremely loose.…”

“…In fact, most key schedules, such as the one of AES, are "lightweight" and invertible, which makes our result (where the key derivation function has no cryptographic role) more relevant to practice. On the other hand, the bounds obtained by [2] are better: the number of queries, the running time, and the indistinguishability bound achieved by their simulator are respectively O(q 2 ), O(q 3 ), and O(q 10 /2 n ), while for our simulator they are respectively O(q 4 ), O(q 6 ), and O(q 12 /2 n ).…”

“…, k r ) from the master key using some cryptographic function (modeled as a random oracle for the indifferentiability proof). This was considered in an earlier and independent work by Andreeva et al [2] (see below for a discussion of their result). The second possibility (not relying on any cryptographic assumption about the key derivation function) is to "correlate" the round keys.…”

“…More importantly, a composition theorem [45] asserts that if C F is indifferentiable from G, then any cryptosystem proved secure when used with G remains secure when used with C F , therefore allowing modular proofs of security in idealized models. 2 Soon after its introduction, Coron et al [15] used the indifferentiability framework to revisit the design of a hash function from an ideal cipher: namely they showed that a number of variants of the Merkle-Damgård domain extension method [19,47], used with an ideal cipher in Davies-Meyer mode, are indifferentiable from a random oracle. The converse direction, i.e.…”