Towards Making Luby-Rackoff Ciphers Optimal and Practical

Patel, Sarvar; Ramzan, Zulfikar; Sundaram, Ganapathy S.

doi:10.1007/3-540-48519-8_13

Cited by 29 publications

(33 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The L-R construction inspired a considerable amount of research, see [7] for a summary of existing works on this topic. One direction of research is to use less than 4 different pseudo-random functions, or to use less than 4 calls to these functions in one encryption, see [7,11,16,17]. However in these papers the proven security is still m 2 n/2 .…”

Section: Introductionmentioning

confidence: 99%

Luby-Rackoff: 7 Rounds Are Enough for 2 n(1 − ε) Security

Patarin

2003

Advances in Cryptology - CRYPTO 2003

View full text Add to dashboard Cite

Abstract. In [3] M. Luby and C. Rackoff have proved that 3-round random Feistel schemes are secure against all adaptative chosen plaintext attacks when the number of queries is m 2 n/2 . Moreover, 4-round random Feistel schemes are also secure against all adaptative chosen plaintext and chosen ciphertext attacks when m 2 n/2 . It was shown later that these bounds are tight for 3 and 4 rounds (see [9] or [1]). In this paper our main results are that for every ε > 0, when m 2 n(1−ε) : -for 4 rounds or more, a random Feistel scheme is secure against known plaintext attacks (KPA). -for 7 rounds or more it is secure against all adaptative chosen plaintext attacks (CPA). -for 10 rounds or more it is secure against all adaptative chosen plaintext and chosen ciphertext attacks (CPCA). These results achieve the optimal value of m, since it is always possible to distinguish a random Feistel cipher from a truly random permutation with O(2 n ) queries, given sufficient computing power. This paper solves an open problem of [1,9] and [17]. It significantly improves the results of [13] that proves the security against only 2 3n 4 queries for 6 rounds, and the results of [6] in which the 2 n(1−ε) security is only obtained when the number of rounds tends to infinity. The proof technique used in this paper is also of independent interest and can be applied to other schemes.

show abstract

Section: Introductionmentioning

confidence: 99%

Luby-Rackoff: 7 Rounds Are Enough for 2 n(1 − ε) Security

Patarin

2003

Advances in Cryptology - CRYPTO 2003

View full text Add to dashboard Cite

show abstract

“…Patel etc. further discussed the function of universal hash functions in the Feistel construction [20]. Bellare and Rogaway [1] used a special pseudorandom function and a special encryption mode to construct a variable-input-length cipher.…”

Section: Related Workmentioning

confidence: 99%

HCTR: A Variable-Input-Length Enciphering Mode

Wang

Feng

2005

Information Security and Cryptology

View full text Add to dashboard Cite

Abstract. This paper proposes a blockcipher mode of operation, HCTR, which is a length-preserving encryption mode. HCTR turns an n-bit blockcipher into a tweakable blockcipher that supports arbitrary variable input length which is no less than n bits. The tweak length of HCTR is fixed and can be zero. We prove that HCTR is a strong tweakable pseudorandom permutation ( sprp), when the underlying blockcipher is a strong pseudorandom permutation (sprp). HCTR is shown to be a very efficient mode of operation when some pre-computations are taken into consideration. Arbitrary variable input length brings much flexibility in various application environments. HCTR can be used in disk sector encryption, and other length-preserving encryptions, especially for the message that is not multiple of n bits.

show abstract

“…Another option of speeding up MTC4 is to follow the approach of [21,22] and require less computation in the first and last round functions. The following algorithm is a straightforward application of the ideas of Patel, et al [21] to MTC4.…”

Section: Reduced Manticore4 (Rmtc4)mentioning

confidence: 99%

“…The following algorithm is a straightforward application of the ideas of Patel, et al [21] to MTC4. Reduced Manticore4 (RMTC4) is a four-round Feistel construction, where the second and third round functions are cryptographic hash functions, but the first and last rounds are not.…”

Section: Reduced Manticore4 (Rmtc4)mentioning

confidence: 99%

“…In [2,17], the authors examine three round ciphers, while Lim [15] looks at four round constructions. Naor and Reingold [19] and Patel, Ramzan, and Sundaram [21] examine replacing some of the hash functions used in the various rounds with less expensive function calls. Section 3 presents a reduced computation version of MTC4, RMTC4, which uses a more efficient function for rounds 1 and 4.…”

Section: Contents 1 Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Manticore and CS mode : parallelizable encryption with joint cipher-state authentication.

Torgerson¹,

Draelos²,

Schroeppel³

et al. 2004

View full text Add to dashboard Cite

We describe a new mode of encryption with inexpensive authentication, which uses information from the internal state of the cipher to provide the authentication. Our algorithms have a number of benefits: 1) the encryption has properties similar to CBC mode, yet the encipherment and authentication can be parallelized and/or pipelined, 2) the authentication overhead is minimal, and 3) the authentication process remains resistant against some IV reuse. We offer a Manticore class of authenticated encryption algorithms based on cryptographic hash functions, which support variable block sizes up to twice the hash output length and variable key lengths. A proof of security is presented for the MTC4 and Pepper algorithms. We then generalize the construction to create the Cipher-State (CS) mode of encryption that uses the internal state of any round-based block cipher as an authenticator. We provide hardware and software performance estimates for all of our constructions and give a concrete example of the CS mode of encryption that uses AES as the encryption primitive and adds a small speed overhead (10-15%) compared to AES alone.3

show abstract

Towards Making Luby-Rackoff Ciphers Optimal and Practical

Cited by 29 publications

References 10 publications

Luby-Rackoff: 7 Rounds Are Enough for 2 n(1 − ε) Security

Luby-Rackoff: 7 Rounds Are Enough for 2 n(1 − ε) Security

HCTR: A Variable-Input-Length Enciphering Mode

Manticore and CS mode : parallelizable encryption with joint cipher-state authentication.

Contact Info

Product

Resources

About