Security of Even–Mansour Ciphers under Key-Dependent Messages

Authors

  • Pooya Farshim École normale supérieure (ENS) , The French National Centre for Scientific Research (CNRS) & INRIA, PSL Research University, Paris, France
  • Louiza Khati École normale supérieure (ENS) , The French National Centre for Scientific Research (CNRS) & INRIA, PSL Research University, Paris, France; Oppida, Montigny Le Bretonneux, France
  • Damien Vergnaud École normale supérieure (ENS) , The French National Centre for Scientific Research (CNRS) & INRIA, PSL Research University, Paris, France

DOI:

https://doi.org/10.13154/tosc.v2017.i2.84-104

Keywords:

Even–Mansour, KDM security, Ideal Cipher, Provable Security

Abstract

The iterated Even–Mansour (EM) ciphers form the basis of many blockcipher designs. Several results have established their security in the CPA/CCA models, under related-key attacks, and in the indifferentiability framework. In this work, we study the Even–Mansour ciphers under key-dependent message (KDM) attacks. KDM security is particularly relevant for blockciphers since non-expanding mechanisms are convenient in setting such as full disk encryption (where various forms of key-dependency might exist). We formalize the folklore result that the ideal cipher is KDM secure. We then show that EM ciphers meet varying levels of KDM security depending on the number of rounds and permutations used. One-round EM achieves some form of KDM security, but this excludes security against offsets of keys. With two rounds we obtain KDM security against offsets, and using different round permutations we achieve KDM security against all permutation-independent claw-free functions. As a contribution of independent interest, we present a modular framework that can facilitate the security treatment of symmetric constructions in models that allow for correlated inputs.

Published

2017-06-19

Issue

Section

Articles

How to Cite

Security of Even–Mansour Ciphers under Key-Dependent Messages. (2017). IACR Transactions on Symmetric Cryptology, 2017(2), 84-104. https://doi.org/10.13154/tosc.v2017.i2.84-104