Cryptology ePrint Archive: Report 2013/823
Another Look at XCB
Debrup Chakraborty and Vicente Hernandez-Jimenez and Palash Sarkar
Abstract: XCB is a tweakable enciphering scheme (TES) which was first proposed in 2004. The scheme was modified in 2007. We call these
two versions of XCB as XCBv1 and XCBv2 respectively. XCBv2 was later proposed as a standard for encryption of sector oriented
storage media in IEEE-std 1619.2 2010. There is no known proof of security for XCBv1 but the authors provided a concrete security bound for XCBv2 and
a ``proof'' for justifying the bound. In this paper we show that XCBv2 is not secure as a TES by showing an easy distinguishing attack on it.
For XCBv2 to be secure, the message space should contain only messages whose lengths are multiples of the block length of the block cipher.
For such restricted message spaces also, the bound that the authors claim is not justified. We show this by pointing out some errors in the proof.
For XCBv2 on full block messages, we provide a new security analysis. The resulting bound that can be proved
is much worse than what has been claimed by the authors.
Further, we provide the first concrete security bound for XCBv1, which holds for all message lengths. In terms of known security bounds,
both XCBv1 and XCBv2 are worse compared to existing alternative TES.
Category / Keywords: secret-key cryptography / Mode of operation, Tweakable enciphering scheme, XCB, IEEE 1619.2
Date: received 4 Dec 2013, last revised 13 Dec 2013
Contact author: debrup at cs cinvestav mx
Available format(s): PDF | BibTeX Citation
Version: 20131213:070354 (All versions of this report)
Short URL: ia.cr/2013/823
Discussion forum: Show discussion | Start new discussion
[ Cryptology ePrint archive ]