The LED Block Cipher

100

Abstract. This paper considers-for the first time-the concept of keyalternating ciphers in a provable security setting. Key-alternating ciphers can be seen as a generalization of a construction proposed by Even and Mansour in 1991. This construction builds a block cipher P X from an n-bit permutation P and two n-bit keys k0 and k1, settingHere we consider a (natural) extension of the EvenMansour construction with t permutations P1, . . . , Pt and t + 1 keys, k0, . . . , kt. We demonstrate in a formal model that such a cipher is secure in the sense that an attacker needs to make at least 2 2n/3 queries to the underlying permutations to be able to distinguish the construction from random. We argue further that the bound is tight for t = 2 but there is a gap in the bounds for t > 2, which is left as an open and interesting problem. Additionally, in terms of statistical attacks, we show that the distribution of Fourier coefficients for the cipher over all keys is close to ideal. Lastly, we define a practical instance of the construction with t = 2 using AES referred to as AES 2 . Any attack on AES 2 with complexity below 2 85 will have to make use of AES with a fixed known key in a non-black box manner. However, we conjecture its security is 2 128 .

Section: Conclusion Open Problems and Future Workmentioning

confidence: 99%

Key-Alternating Ciphers in a Provable Setting: Encryption Using a Small Number of Public Permutations

Bogdanov

Knudsen

Leander

et al. 2012

100

“…This case is interesting since it is the two-round analogue of the "alternating" key-schedule of LED-128 [GPPR11] (which has twelve rounds), where the master key K = (k, k ) is twice as long as the block length, and round keys k and k are alternatively xored to the state. This setting is intermediate between the case of perfectly independent round keys and the case of an n-bit master key (in particular, the sum-capture theorem is only required to upper bound |BadK 1 |).…”

Section: B Probability Of Bad Transcripts For Two Alternated Independmentioning

confidence: 99%

Minimizing the Two-Round Even-Mansour Cipher

Chen

Lampe

Lee

et al. 2014

Abstract. The r-round (iterated) Even-Mansour cipher (also known as key-alternating cipher) defines a block cipher from r fixed public n-bit permutations P1, . . . , Pr as follows: given a sequence of n-bit round keys k0, . . . , kr, an n-bit plaintext x is encrypted by xoring round key k0, applying permutation P1, xoring round key k1, etc. The (strong) pseudorandomness of this construction in the random permutation model (i.e., when the permutations P1, . . . , Pr are public random permutation oracles that the adversary can query in a black-box way) was studied in a number of recent papers, culminating with the work of Chen and Steinberger (EURO-CRYPT 2014), who proved that the r-round Even-Mansour cipher is indistinguishable from a truly random permutation up to O(2 rn r+1 ) queries of any adaptive adversary (which is an optimal security bound since it matches a simple distinguishing attack). All results in this entire line of work share the common restriction that they only hold under the assumption that the round keys k0, . . . , kr and the permutations P1, . . . , Pr are independent. In particular, for two rounds, the current state of knowledge is that the block cipher E(x) = k2 ⊕ P2(k1 ⊕ P1(k0 ⊕ x)) is provably secure up to O(2 2n/3 ) queries of the adversary, when k0, k1, and k2 are three independent n-bit keys, and P1 and P2 are two independent random n-bit permutations. In this paper, we ask whether one can obtain a similar bound for the two-round Even-Mansour cipher from just one n-bit key and one n-bit permutation. Our answer is positive: when the three n-bit round keys k0, k1, and k2 are adequately derived from an n-bit master key k, and the same permutation P is used in place of P1 and P2, we prove a qualitatively similar O(2 2n/3 ) security bound (in the random permutation model). To the best of our knowledge, this is the first "beyond the birthday bound" security result for AES-like ciphers that does not assume independent round keys.

“…Also, the lightweight hash function PHOTON [5] and the block cipher LED [7] use MDS matrices based on Eq. (1).…”

Section: Definitionmentioning

confidence: 99%

Recursive Diffusion Layers for Block Ciphers and Hash Functions

Sajadieh

Dakhilalian

Mala

et al. 2012

Abstract. Many modern block ciphers use maximum distance separable (MDS) matrices as the main part of their diffusion layers. In this paper, we propose a new class of diffusion layers constructed from several rounds of Feistel-like structures whose round functions are linear. We investigate the requirements of the underlying linear functions to achieve the maximal branch number for the proposed 4 × 4 words diffusion layer. The proposed diffusion layers only require word-level XORs, rotations, and they have simple inverses. They can be replaced in the diffusion layer of the block ciphers MMB and Hierocrypt to increase their security and performance, respectively. Finally, we try to extend our results for up to 8 × 8 words diffusion layers.