Cryptology ePrint Archive: Report 2017/475

Security of Even--Mansour Ciphers under Key-Dependent Messages

Pooya Farshim and Louiza Khati and Damien Vergnaud

Abstract: The iterated Even--Mansour (EM) ciphers form the basis of many block cipher designs. Several results have established their security in the CPA/CCA models, under related-key attacks, and in the indifferentiability framework. In this work, we study the Even--Mansour ciphers under key-dependent message (KDM) attacks. KDM security is particularly relevant for block ciphers since non-expanding mechanisms are convenient in setting such as full disk encryption (where various forms of key-dependency might exist). We formalize the folklore result that the ideal cipher is KDM secure. We then show that EM ciphers meet varying levels of KDM security depending on the number of rounds and permutations used. One-round EM achieves some form of KDM security, but this excludes security against offsets of keys. With two rounds we obtain KDM security against offsets, and using different round permutations we achieve KDM security against all permutation-independent claw-free functions. As a contribution of independent interest, we present a modular framework that can facilitate the security treatment of symmetric constructions in models such as RKA or KDM that allow for correlated inputs.

Category / Keywords: Even--Mansour. KDM security. Ideal Cipher. Provable Security

Original Publication (in the same form): IACR-TOSC ISSUE 2-2017

Date: received 28 May 2017

Contact author: pooya fashim at ens fr, louiza khati@di ens fr, damien vergnaud@ens fr, pooya farshim@gmail com

Available format(s): PDF | BibTeX Citation

Version: 20170528:232339 (All versions of this report)

Short URL: ia.cr/2017/475

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]