Chosen-Key Secure Even-Mansour Cipher from a Single Permutation

Authors

  • Shanjie Xu Key Laboratory of Cryptologic Technology and Information Security of Ministry of Education, Shandong University, Qingdao, Shandong, China; School of Cyber Science and Technology, Shandong University, Qingdao, Shandong, China
  • Qi Da Key Laboratory of Cryptologic Technology and Information Security of Ministry of Education, Shandong University, Qingdao, Shandong, China; School of Cyber Science and Technology, Shandong University, Qingdao, Shandong, China
  • Chun Guo Key Laboratory of Cryptologic Technology and Information Security of Ministry of Education, Shandong University, Qingdao, Shandong, China; School of Cyber Science and Technology, Shandong University, Qingdao, Shandong, China; Shandong Research Institute of Industrial Technology, Jinan, Shandong, China

DOI:

https://doi.org/10.46586/tosc.v2023.i1.244-287

Keywords:

blockcipher, sequential indifferentiability, Even-Mansour cipher

Abstract

At EUROCRYPT 2015, Cogliati and Seurin proved that the 4-round Iterated Even-Mansour (IEM) cipher with Independent random Permutations and no key schedule EMIP4(k, u) = k⊕p4 ( k⊕p3 ( k⊕p2 (k⊕p1 (ku)))) is sequentially indifferentiable from an ideal cipher, which implies chosen-key security in the sense of correlation intractability. In practice, however, blockciphers such as the AES typically employ the same permutation at each round. To bridge the gap, we prove that the 4-round IEM cipher EMSP[φ]p4 (k, u) = k4⊕p (k3⊕p (k2⊕p(k1⊕p(k0u)))), whose round keys ki = φi(k) are derived using an affine permutation φ : {0, 1}n → {0, 1}n with certain properties, is sequentially indifferentiable from an ideal cipher. The function φ can be a linear orthomorphism, or φ(k) := ka for some fixed integer a using cyclic shift. To our knowledge, this is the first indifferentiability-type result for blockciphers using identical round functions.

Downloads

Published

2023-03-10

Issue

Section

Articles

How to Cite

Chosen-Key Secure Even-Mansour Cipher from a Single Permutation. (2023). IACR Transactions on Symmetric Cryptology, 2023(1), 244-287. https://doi.org/10.46586/tosc.v2023.i1.244-287