Provable Security of (Tweakable) Block Ciphers Based on Substitution-Permutation Networks

Abstract

Substitution-Permutation Networks (SPNs) refer to a family of constructions which build a wn-bit block cipher from n-bit public permutations (often called S-boxes), which alternate keyless and "local" substitution steps utilizing such S-boxes, with keyed and "global" permutation steps which are non-cryptographic. Many widely deployed block ciphers are constructed based on the SPNs, but there are essentially no provable-security results about SPNs. In this work, we initiate a comprehensive study of the provable security of SPNs as (possibly tweakable) wn-bit block ciphers, when the underlying n-bit permutation is modeled as a public random permutation. When the permutation step is linear (which is the case for most existing designs), we show that 3 SPN rounds are necessary and sufficient for security. On the other hand, even 1-round SPNs can be secure when non-linearity is allowed. Moreover, 2-round non-linear SPNs can achieve "beyondbirthday" (up to 2 2n/3 adversarial queries) security, and, as the number of non-linear rounds increases, our bounds are meaningful for the number of queries approaching 2 n. Finally, our non-linear SPNs can be made tweakable by incorporating the tweak into the permutation layer, and provide good multiuser security. As an application, our construction can turn two public n-bit permutations (or fixed-key block ciphers) into a tweakable block cipher working on wn-bit inputs, 6n-bit key and an n-bit tweak (for any w ≥ 2); the tweakable block cipher provides security up to 2 2n/3 adversarial queries in the random permutation model, while only requiring w calls to each permutation, and 3w field multiplications for each wn-bit input.

Understanding the Related-Key Security of Feistel Ciphers from a Provable Perspective

“…A concurrent work of Cogliati et al shows how to construct wide-block TBC from SPNs [62]. They focus on (better) beyond-birthday bounds, while we proved ⊕-RKA security which may not be implied by tweakable pseudorandomness.…”

“…These results are complementary to ours. Since we identified concrete conditions, our work is closer to the series [53], [21], [62].…”

“…Finally, in the ideal model, key-schedule conditions that suffice for some level of security have been characterized for single-key security of Luby-Rackoff [72], KACs [53], and SPNs [62], for ⊕-RKA security of KACs [21], and for indifferentiability of Luby-Rackoff [11] and KACs, see [15] and the reference therein. These results are complementary to ours.…”

Machine-Checked Proofs for Cryptographic Standards

“…The notion of indifferentiability, introduced by Maurer, Renner and Holenstein [26] generalizes over the standard notion of indistinguishability by considering settings where the adversary has oracle access to both the construction and its underlying primitive. It has been used as a way of reducing concerns in the design of block ciphers (with proofs for Feistel networks [20,21] and substitutionpermutation networks [16]) and hash functions (with proofs for the Merkle-Damgård construction [18] and the Sponge construction [14]), in each case formally capturing the intuition that the construction does not introduce any structural vulnerabilities when the underlying primitive is seen as an ideal black-box. Definition 2.1 (Indifferentiability [26]).…”

On a Generalization of Substitution-Permutation Networks: The HADES Design Strategy

“…There is a huge amount of efficient designs that exploit this design strategy, including Rijndael/AES [ 20 ] which is perhaps the most important one. Theoretical aspects have been analyzed too, which include the asymptotic analysis by Miles and Viola [ 41 ], and more recent results in the provable security framework [ 16 , 26 ].

Fig.

…”