A t-round key-alternating cipher (also called iterated Even-Mansour cipher) can be viewed as an abstraction of AES. It defines a cipher E from t fixed public permutations P 1,..., P t : {0,1} n → {0,1} n and a key k = k 0 ∥ ... ∥ k t ∈ {0,1} n(t + 1) by setting E k (x) = k t ⊕ P t (k t − 1 ⊕ P t − 1( ⋯ k 1 ⊕ P 1(k 0 ⊕ x) ⋯ )). The indistinguishability of E k from a truly random permutation by an adversary who also has oracle access to the (public) random permutations P 1, …, P t was investigated in 1997 by Even and Mansour for t = 1 and for higher values of t in a series of recent papers. For t = 1, Even and Mansour proved indistinguishability security up to 2 n/2 queries, which is tight. Much later Bogdanov et al. (2011) conjectured that security should be $2^{\frac{t}{t+1}n}$ queries for general t, which matches an easy distinguishing attack (so security cannot be more). A number of partial results have been obtained supporting this conjecture, besides Even and Mansour’s original result for t = 1: Bogdanov et al. proved security of $2^{\frac{2}{3}n}$ for t ≥ 2, Steinberger (2012) proved security of $2^{\frac{3}{4}n}$ for t ≥ 3, and Lampe, Patarin and Seurin (2012) proved security of $2^{\frac{t}{t+2}n}$ for all even values of t, thus “barely” falling short of the desired $2^{\frac{t}{t+1}n}$.

/pdf/tight-security-bounds-for-key-alternating-ciphers-vbe69o9tn7.pdf

Tight Security Bounds for Key-Alternating Ciphers

Gentry’s “bootstrapping” technique (STOC 2009) constructs a fully homomorphic encryption (FHE) scheme from a “somewhat homomorphic” one that is powerful enough to evaluate its own decryption function. To date, it remains the only knownway of obtaining unboundedFHE. Unfortunately, bootstrapping is computationally very expensive, despite the great deal of effort that has been spent on improving its efficiency. The current state of the art, due to Gentry, Halevi, and Smart (PKC 2012), is able to bootstrap “packed” ciphertexts (which encrypt up to a linear number of bits) in time only quasilinear Õ(λ) = λ · log λ in the security parameter. While this performance is asymptotically optimal up to logarithmic factors, the practical import is less clear: the procedure composes multiple layers of expensive and complex operations, to the point where it appears very difficult to implement, and its concrete runtime appears worse than those of prior methods (all of which have quadratic or larger asymptotic runtimes). In this work we give simple, practical, and entirely algebraic algorithms for bootstrapping in quasilinear time, for both “packed” and “non-packed” ciphertexts. Our methods are easy to implement (especially in the non-packed case), and we believe that they will be substantially more efficient in practice than all prior realizations of bootstrapping. One of our main techniques is a substantial enhancement of the “ring-switching” procedure of Gentry et al. (SCN 2012), which we extend to support switching between two rings where neither is a subring of the other. Using this procedure, we give a natural method for homomorphically evaluating a broad class of structured linear transformations, including one that lets us evaluate the decryption function efficiently.

Advances in Cryptology – CRYPTO 2013

The best existing bounds on the concrete security of key-alternating ciphers Chen and Steinberger, EUROCRYPT '14 are only asymptotically tight, and the quantitative gap with the best existing attacks remains numerically substantial for concrete parameters. Here, we prove exact bounds on the security of key-alternating ciphers and extend them to XOR cascades, the most efficient construction for key-length extension. Our bounds essentially match, for any possible query regime, the advantage achieved by the best existing attack.

Our treatment also extends to the multi-user regime. We show that the multi-user security of key-alternating ciphers and XOR cascades is very close to the single-user case, i.e., given enough rounds, it does not substantially decrease as the number of users increases. On the way, we also provide the first explicit treatment of multi-user security for key-length extension, which is particularly relevant given the significant security loss of block ciphers even if ideal in the multi-user setting.

The common denominator behind our results are new techniques for information-theoretic indistinguishability proofs that both extend and refine existing proof techniques like the H-coefficient method.

/pdf/key-alternating-ciphers-and-key-length-extension-exact-1cn4ck4rfl.pdf

Key-Alternating Ciphers and Key-Length Extension: Exact Bounds and Multi-user Security

We propose the Synthetic Counter-in-Tweak $$\mathsf {SCT}$$ mode, which turns a tweakable block cipher into a nonce-based authenticated encryption scheme with associated data. The $$\mathsf {SCT}$$ mode combines in a SIV-like manner a Wegman-Carter MAC inspired from $$\mathsf {PMAC}$$ for the authentication part and a new counter-like mode for the encryption part, with the unusual property that the counter is applied on the tweak input of the underlying tweakable block cipher rather than on the plaintext input. Unlike many previous authenticated encryption modes, $$\mathsf {SCT}$$ enjoys provable security beyond the birthday bound and even upi¾?to roughly $$2^n$$ tweakable block cipher calls, where n is the block length, when the tweak length is sufficiently large in the nonce-respecting scenario where nonces are never repeated. In addition, $$\mathsf {SCT}$$ ensures security upi¾?to the birthday bound even when nonces are reused, in the strong nonce-misuse resistance sense MRAE of Rogaway and Shrimpton EUROCRYPTi¾?2006. To the best of our knowledge, this is the first authenticated encryption mode that provides at the same time close-to-optimal security in the nonce-respecting scenario and birthday-bound security for the nonce-misuse scenario. While two passes are necessary to achieve MRAE-security, our mode enjoys a number of desirable features: it is simple, parallelizable, it requires the encryption direction only, it is particularly efficient for small messages compared to other nonce-misuse resistant schemes no precomputation is required and it allows incremental update of associated data.

/pdf/counter-in-tweak-authenticated-encryption-modes-for-4ch19hia5n.pdf

Counter-in-Tweak: Authenticated Encryption Modes for Tweakable Block Ciphers

Proving tight bounds on information-theoretic indistinguishability is a central problem in symmetric cryptography. This paper introduces a new method for information-theoretic indistinguishability proofs, called “the chi-squared method”. At its core, the method requires upper-bounds on the so-called $\chi ^2$ divergence (due to Neyman and Pearson) between the output distributions of two systems being queries. The method morally resembles, yet also considerably simplifies, a previous approach proposed by Bellare and Impagliazzo (ePrint, 1999), while at the same time increasing its expressiveness and delivering tighter bounds.

/pdf/information-theoretic-indistinguishability-via-the-chi-3fvi09dio3.pdf

Information-Theoretic Indistinguishability via the Chi-Squared Method

We analyze the security of the iterated Even-Mansour cipher (a.k.a. key-alternating cipher), a very simple and natural construction of a blockcipher in the random permutation model. This construction, first considered by Even and Mansour (J. Cryptology, 1997) with a single permutation, was recently generalized to use t permutations in the work of Bogdanov et al. (EUROCRYPT 2012). They proved that the construction is secure up to $ \mathcal{O} (N^{2/3})$ queries (where N is the domain size of the permutations), as soon as the number t of rounds is 2 or more. This is tight for t=2, however in the general case the best known attack requires Ω(Nt/(t+1)) queries. In this paper, we give asymptotically tight security proofs for two types of adversaries:

1 for non-adaptive chosen-plaintext adversaries, we prove that the construction achieves an optimal security bound of $ \mathcal{O} (N^{t/(t+1)})$ queries;

2 for adaptive chosen-plaintext and ciphertext adversaries, we prove that the construction achieves security up to $ \mathcal{O} (N^{t/(t+2)})$ queries (for t even). This improves previous results for t≥6.

Our proof crucially relies on the use of a coupling to upper-bound the statistical distance of the outputs of the iterated Even-Mansour cipher to the uniform distribution.

/pdf/an-asymptotically-tight-security-analysis-of-the-iterated-2jthq7ovyg.pdf

An asymptotically tight security analysis of the iterated even-mansour cipher

We study how to construct efficient tweakable block ciphers in the Random Permutation model, where all parties have access to public random permutation oracles. We propose a construction that combines, more efficiently than by mere black-box composition, the CLRW construction (which turns a traditional block cipher into a tweakable block cipher) of Landecker et al. (CRYPTO 2012) and the iterated Even-Mansour construction (which turns a tuple of public permutations into a traditional block cipher) that has received considerable attention since the work of Bogdanov et al. (EUROCRYPT 2012). More concretely, we introduce the (one-round) tweakable Even-Mansour (TEM) cipher, constructed from a single n-bit permutation P and a uniform and almost XOR-universal family of hash functions $(H_k)$ from some tweak space to $\{0,1\}^n$, and defined as $(k,t,x)\mapsto H_k(t)\oplus P(H_k(t)\oplus x)$, where k is the key, t is the tweak, and x is the n-bit message, as well as its generalization obtained by cascading r independently keyed rounds of this construction. Our main result is a security bound up to approximately $2^{2n/3}$ adversarial queries against adaptive chosen-plaintext and ciphertext distinguishers for the two-round TEM construction, using Patarin’s H-coefficients technique. We also provide an analysis based on the coupling technique showing that asymptotically, as the number of rounds r grows, the security provided by the r-round TEM construction approaches the information-theoretic bound of $2^n$ adversarial queries.

/pdf/tweaking-even-mansour-ciphers-21v9up8u3e.pdf

Tweaking Even-Mansour Ciphers

The r-round (iterated) Even-Mansour cipher (also known as key-alternating cipher) defines a block cipher from r fixed public n-bit permutations P1,…,P r as follows: given a sequence of n-bit round keys k0,…,k r , an n-bit plaintext x is encrypted by xoring round key k0, applying permutation P1, xoring round key k1, etc. The (strong) pseudorandomness of this construction in the random permutation model (i.e., when the permutations P1,…,P r are public random permutation oracles that the adversary can query in a black-box way) was studied in a number of recent papers, culminating with the work of Chen and Steinberger (EUROCRYPT 2014), who proved that the r-round Even-Mansour cipher is indistinguishable from a truly random permutation up to $ \mathcal{O} (2^{\frac{rn}{r+1}})$ queries of any adaptive adversary (which is an optimal security bound since it matches a simple distinguishing attack). All results in this entire line of work share the common restriction that they only hold under the assumption that the round keys k0,…,k r and the permutations P1,…,P r are independent. In particular, for two rounds, the current state of knowledge is that the block cipher E(x) = k2 ⊕ P2(k1 ⊕ P1(k0 ⊕ x)) is provably secure up to $ \mathcal{O} (2^{2n/3})$ queries of the adversary, when k0, k1, and k2 are three independent n-bit keys, and P1 and P2 are two independent random n-bit permutations. In this paper, we ask whether one can obtain a similar bound for the two-round Even-Mansour cipher from just one n-bit key and one n-bit permutation. Our answer is positive: when the three n-bit round keys k0, k1, and k2 are adequately derived from an n-bit master key k, and the same permutation P is used in place of P1 and P2, we prove a qualitatively similar $ \widetilde{ \mathcal{O} } (2^{2n/3})$ security bound (in the random permutation model). To the best of our knowledge, this is the first “beyond the birthday bound” security result for AES-like ciphers that does not assume independent round keys.

/pdf/minimizing-the-two-round-even-mansour-cipher-1ftwha9s5f.pdf

Minimizing the Two-Round Even-Mansour Cipher

We show how to construct an ideal cipher with n-bit blocks and n-bit keys i.e. a set of 2 n public n-bit permutations from a small constant number of n-bit random public permutations. The construction that we consider is the single-key iterated Even-Mansour cipher, which encrypts a plaintext xi¾?∈i¾?{0,1} n under a key ki¾?∈i¾?{0,1} n by alternatively xoring the key k and applying independent random public n-bit permutations P 1,', P r this construction is also named a key-alternating cipher. We analyze this construction in the plain indifferentiability framework of Maurer, Renner, and Holenstein TCC 2004, and show that twelve rounds are sufficient to achieve indifferentiability from an ideal cipher. We also show that four rounds are necessary by exhibiting attacks for three rounds or less.

/pdf/how-to-construct-an-ideal-cipher-from-a-small-set-of-public-oer071y5dg.pdf

How to Construct an Ideal Cipher from a Small Set of Public Permutations

Given $k$ independent pseudorandom permutations $f_1,\ldots ,f_k$ over $\{0,1\}^n$, it is natural to define a pseudorandom function by XORing the permutations: $f_1\oplus \ldots \oplus f_k$. In [9] Stefan Lucks studied the security of this PRF. In this paper we improve the security bounds of [9] by using different proof techniques.

/pdf/the-indistinguishability-of-the-xor-of-k-permutations-1huol5u2cm.pdf

Rodolphe Lampe

Papers

An asymptotically tight security analysis of the iterated even-mansour cipher

Tweaking Even-Mansour Ciphers

Minimizing the Two-Round Even-Mansour Cipher

How to Construct an Ideal Cipher from a Small Set of Public Permutations

The Indistinguishability of the XOR of k Permutations