Improved domain extender for the ideal cipher

We study the security of symmetric primitives against key-correlated attacks (KCA), whereby an adversary can arbitrarily correlate keys, messages, and ciphertexts. Security against KCA is required whenever a primitive should securely encrypt key-dependent data, even when it is used under related keys. KCA is a strengthening of the previously considered notions of related-key attack (RKA) and key-dependent message (KDM) security. This strengthening is strict, as we show that 2-round Even–Mansour fails to be KCA secure even though it is both RKA and KDM secure. We provide feasibility results in the ideal-cipher model for KCAs and show that 3-round Even–Mansour is KCA secure under key offsets in the random-permutation model. We also give a natural transformation that converts any authenticated encryption scheme to a KCA-secure one in the random-oracle model. Conceptually, our results allow for a unified treatment of RKA and KDM security in idealized models of computation.

Download Full-text

Security of Even–Mansour Ciphers under Key-Dependent Messages

IACR Transactions on Symmetric Cryptology ◽

10.46586/tosc.v2017.i2.84-104 ◽

2017 ◽

pp. 84-104

Author(s):

Pooya Farshim ◽

Louiza Khati ◽

Damien Vergnaud

Keyword(s):

Independent Interest ◽

Ideal Cipher ◽

Disk Encryption ◽

Modular Framework ◽

Full Disk ◽

The Ideal

The iterated Even–Mansour (EM) ciphers form the basis of many blockcipher designs. Several results have established their security in the CPA/CCA models, under related-key attacks, and in the indifferentiability framework. In this work, we study the Even–Mansour ciphers under key-dependent message (KDM) attacks. KDM security is particularly relevant for blockciphers since non-expanding mechanisms are convenient in setting such as full disk encryption (where various forms of key-dependency might exist). We formalize the folklore result that the ideal cipher is KDM secure. We then show that EM ciphers meet varying levels of KDM security depending on the number of rounds and permutations used. One-round EM achieves some form of KDM security, but this excludes security against offsets of keys. With two rounds we obtain KDM security against offsets, and using different round permutations we achieve KDM security against all permutation-independent claw-free functions. As a contribution of independent interest, we present a modular framework that can facilitate the security treatment of symmetric constructions in models that allow for correlated inputs.

Download Full-text

The Security of Multiple Encryption in the Ideal Cipher Model

Advances in Cryptology – CRYPTO 2014 - Lecture Notes in Computer Science ◽

10.1007/978-3-662-44371-2_2 ◽

2014 ◽

pp. 20-38 ◽

Cited By ~ 10

Author(s):

Yuanxi Dai ◽

Jooyoung Lee ◽

Bart Mennink ◽

John Steinberger

Keyword(s):

Multiple Encryption ◽

Ideal Cipher ◽

Ideal Cipher Model ◽

The Ideal

Download Full-text

Block Cipher in the Ideal Cipher Model: A Dedicated Permutation Modeled as a Black-Box Public Random Permutation

Symmetry ◽

10.3390/sym11121485 ◽

2019 ◽

Vol 11 (12) ◽

pp. 1485

Author(s):

Yasir Nawaz ◽

Lei Wang

Keyword(s):

Block Cipher ◽

Random Permutation ◽

Secret Key ◽

Pseudorandom Permutation ◽

Ideal Cipher ◽

Xor Operation ◽

Beyond Birthday Bound ◽

Symmetric Key Cryptography ◽

Ideal Cipher Model ◽

The Ideal

Designing a secure construction has always been a fascinating area for the researchers in the field of symmetric key cryptography. This research aimed to make contributions to the design of secure block cipher in the ideal cipher model whose underlying primitive is a family of n − b i t to n − b i t random permutations indexed by secret key. Our target construction of a secure block ciphers denoted as E [ s ] is built on a simple XOR operation and two block cipher invocations, under the assumptions that the block cipher in use is a pseudorandom permutation. One out of these two block cipher invocations produce a subkey that is derived from the secret key. It has been accepted that at least two block cipher invocations with XOR operations are required to achieve beyond birthday bound security. In this paper, we investigated the E [ s ] instances with the advanced proof technique and efficient block cipher constructions that bypass the birthday-bound up to 2 n provable security was achieved. Our study provided new insights to the block cipher that is beyond birthday bound security.

Download Full-text