Paper 2009/356

A Domain Extender for the Ideal Cipher

Jean-Sebastien Coron, Yevgeniy Dodis, Avradip Mandal, and Yannick Seurin


We describe the first domain extender for ideal ciphers, {\sl i.e.} we show a construction that is indifferentiable from a $2n$-bit ideal cipher, given a $n$-bit ideal cipher. Our construction is based on a $3$-round Feistel, and is more efficient than first building a $n$-bit random oracle from a $n$-bit ideal cipher and then a $2n$-bit ideal cipher from a $n$-bit random oracle (using a $6$-round Feistel). We also show that $2$ rounds are not enough for indifferentiability by exhibiting a simple attack. We also consider our construction in the standard model: we show that $2$ rounds are enough to get a $2n$-bit tweakable block-cipher from a $n$-bit tweakable block-cipher and we show that with $3$ rounds we can get beyond the birthday security bound.

Available format(s)
Publication info
Published elsewhere. Unknown where it was published
Ideal Cipher Modeldomain extender
Contact author(s)
jscoron @ gmail com
2009-07-21: received
Short URL
Creative Commons Attribution


      author = {Jean-Sebastien Coron and Yevgeniy Dodis and Avradip Mandal and Yannick Seurin},
      title = {A Domain Extender for the Ideal Cipher},
      howpublished = {Cryptology ePrint Archive, Paper 2009/356},
      year = {2009},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.