Cryptology ePrint Archive: Report 2013/823

Another Look at XCB

Debrup Chakraborty and Vicente Hernandez-Jimenez and Palash Sarkar

Abstract: XCB is a tweakable enciphering scheme (TES) which was first proposed in 2004. The scheme was modified in 2007. We call these two versions of XCB as XCBv1 and XCBv2 respectively. XCBv2 was later proposed as a standard for encryption of sector oriented storage media in IEEE-std 1619.2 2010. There is no known proof of security for XCBv1 but the authors provided a concrete security bound for XCBv2 and a ``proof'' for justifying the bound. In this paper we show that XCBv2 is not secure as a TES by showing an easy distinguishing attack on it. For XCBv2 to be secure, the message space should contain only messages whose lengths are multiples of the block length of the block cipher. For such restricted message spaces also, the bound that the authors claim is not justified. We show this by pointing out some errors in the proof. For XCBv2 on full block messages, we provide a new security analysis. The resulting bound that can be proved is much worse than what has been claimed by the authors. Further, we provide the first concrete security bound for XCBv1, which holds for all message lengths. In terms of known security bounds, both XCBv1 and XCBv2 are worse compared to existing alternative TES.

Category / Keywords: secret-key cryptography / Mode of operation, Tweakable enciphering scheme, XCB, IEEE 1619.2

Date: received 4 Dec 2013, last revised 13 Dec 2013

Contact author: debrup at cs cinvestav mx

Available format(s): PDF | BibTeX Citation

Version: 20131213:070354 (All versions of this report)

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]