Paper 2026/2691

Revisiting Hash-ECB-Hash Enciphering: Plaintext Recovery Attacks on PEP and TET

Abstract

Storage encryption motivates tweakable enciphering schemes, which encrypt entire multi-block data units without length expansion and use a public tweak to identify their context. We revisit PEP (FSE 2006) and TET (CRYPTO 2007), two Hash-ECB-Hash schemes that combine parallel block-cipher calls with invertible mixing, and present classical distinguishing and plaintext-recovery attacks. For PEP, we exhibit a fixed public field satisfying the published parameter-selection rule whose generated position coefficients repeat. This yields a two-query algebraic distinguisher and recovery of a secret tweak-derived value using one encryption query. For the same instance, we recover target plaintexts over a specified range of complete-block lengths using at most nine encryption queries and one decryption query. Our PEP success bounds assume a uniformly random secret permutation and independently fixed target tweaks and plaintexts. For TET, we analyze two corrections of a previously reported mismatch between encryption and decryption. Both admit two-query distinguishers on messages with a partial final block. For tails of at least two bits, we obtain deterministic plaintext recovery using two decryption queries in one correction, or two encryption queries and one decryption query in the other. These TET attacks hold for every data permutation and valid parameter choice. The results expose failures of concrete coefficient generation and partial-block processing, and identify requirements for repairing these constructions.