Paper 2009/356

A Domain Extender for the Ideal Cipher

Jean-Sebastien Coron and Yevgeniy Dodis and Avradip Mandal and Yannick Seurin

Abstract

We describe the first domain extender for ideal ciphers, {\sl i.e.} we show a construction that is indifferentiable from a $2n$-bit ideal cipher, given a $n$-bit ideal cipher. Our construction is based on a $3$-round Feistel, and is more efficient than first building a $n$-bit random oracle from a $n$-bit ideal cipher and then a $2n$-bit ideal cipher from a $n$-bit random oracle (using a $6$-round Feistel). We also show that $2$ rounds are not enough for indifferentiability by exhibiting a simple attack. We also consider our construction in the standard model: we show that $2$ rounds are enough to get a $2n$-bit tweakable block-cipher from a $n$-bit tweakable block-cipher and we show that with $3$ rounds we can get beyond the birthday security bound.