Tweaking a block cipher: multi-user beyond-birthday-bound security in the standard model

Abstract

In this paper, we present a generic construction to create a secure tweakable block cipher from a secure block cipher. Our construction is very natural, requiring four calls to the underlying block cipher for each call of the tweakable block cipher. Moreover, it is provably secure in the standard model while keeping the security degradation minimal in the multiuser setting. In more details, if the underlying blockcipher E uses n−bit blocks and 2n−bit keys, then our construction is proven secure against multiuser adversaries using up to roughly 2 n time and queries as long as E is a secure block cipher. Keywords tweakable block cipher • prp-to-prf conversion • multiuser security • XORP construction • standard model Mathematics Subject Classification (2000) 94A60 This is a post-peer-review, pre-copyedit version of an article published in Designs, Codes and Cryptography.

TNT: How to Tweak a Block Cipher

“…Concretely, standard assumption-based constructions typically tried to avoid tweak-dependent rekeying, which were deemed as (arguably) costly. Another shortage of rekeying is the unavoidable “hybrid security loss” in their security bounds [ 58 , 69 ] (some withstand this loss using carefully-chosen parameters [ 17 , 61 ]). Such a loss doesn’t appear in the ideal cipher model, and this is leveraged by many constructions for good bounds and efficiency at the same time.…”