**A Synthetic Indifferentiability Analysis of Interleaved Double-Key Even-Mansour Ciphers**

*Chun Guo and Dongdai Lin*

**Abstract: **Iterated Even-Mansour scheme (IEM) is a generalization of the basic 1-round proposal (ASIACRYPT '91). The scheme can use one key, two keys, or completely independent keys.

Most of the published security proofs for IEM against relate-key and chosen-key attacks focus on the case where all the round-keys are derived from a single master key. Whereas results beyond this barrier are relevant to the cryptographic problem whether a secure blockcipher with key-size twice the block-size can be built by mixing two \emph{relatively independent} keys into IEM and iterating sufficiently many rounds, and this strategy actually has been used in designing blockciphers for a long-time.

This work makes the first step towards breaking this barrier and considers IEM with Interleaved Double \emph{independent} round-keys: $$\text{IDEM}_r((k_1,k_2),m)=k_i\oplus (P_r(\ldots k_1\oplus P_2(k_2\oplus P_1(k_1\oplus m))\ldots)),$$ where $i=2$ when $r$ is odd, and $i=1$ when $r$ is even. As results, this work proves that 15 rounds can achieve (full) indifferentiability from an ideal cipher with $O({q^{8}}/{2^n})$ security bound. This work also proves that 7 rounds is sufficient and necessary to achieve sequential-indifferentiability (a notion introduced at TCC 2012) with $O({q^{6}}/{2^n})$ security bound, so that $\text{IDEM}_{7}$ is already correlation intractable and secure against any attack that exploits evasive relations between its input-output pairs.

**Category / Keywords: **blockcipher, ideal cipher, indifferentiability, key-alternating cipher, Even-Mansour cipher, correlation intractability.

**Original Publication**** (with major differences): **IACR-ASIACRYPT-2015

**Date: **received 6 Sep 2015, last revised 6 Sep 2015

**Contact author: **guochun at iie ac cn

**Available format(s): **PDF | BibTeX Citation

**Version: **20150906:213737 (All versions of this report)

**Short URL: **ia.cr/2015/861

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]