The Preimage Security of Double-Block-Length Compression Functions

Armknecht, Frederik; Fleischmann, Ewan; Krause, Matthias; Lee, Jooyoung; Stam, Martijn; Steinberger, John P.

doi:10.1007/978-3-642-25385-0_13

Cited by 43 publications

(61 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ultimately, the only 4-round, 4-tripwire simulator for which we didn't find an attack is the simulator with the (asymmetric) tripwire configuration (1,2), (3,2), (3,4), (1,4) (and its symmetric counterpart). However, since we could not foresee a manageable termination argument for this simulator, we ultimately reverted to five rounds.…”

Section: Simulator Overviewmentioning

confidence: 99%

“…We use the wish list methodology of [1]. We consider the probability of a simulator to make a winning query to IC.…”

Section: Attacks On Kamentioning

confidence: 99%

“…For this we use the "tripwire" concept. Informally, a tripwire is an ordered pair of the form (i, i + 1) or (i + 1, i) or (1,5) or (5, 1) (for a 5-round cipher). "Installing a tripwire (i, j)" means the simulator will complete paths for k-adjacencies detected between positions i and j and for which the j-query is made after the i-query.…”

Section: Simulator Overviewmentioning

confidence: 99%

“…, k 4 ∈ Z gives rise to a connected component of 4 edges in a bipartite graph called B 2 . (In fact, the way B 2 is defined, the edges have endpoints y 1 1 , x 12 3 , y 23 1 , x 34 3 , y 4 1 and are labeled by the values k 1 , . .…”

Section: Randomness Mapping (High-level Overview)mentioning

confidence: 99%

“…Except for the 4-round tripwire simulator with tripwires (1, 2), (3, 2), (3,4), (1,4) and its symmetric counterpart, other 4-round, 4-tripwire simulators can easily be attacked by variants of the attacks above (but we omit the case analysis).…”

Section: Attack On the 4-roundmentioning

confidence: 99%

See 4 more Smart Citations

On the Indifferentiability of Key-Alternating Ciphers

Andreeva

Bogdanov

Dodis

et al. 2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The Advanced Encryption Standard (AES) is the most widely used block cipher. The high level structure of AES can be viewed as a (10-round) key-alternating cipher, where a t-round key-alternating cipher KAt consists of a small number t of fixed permutations Pi on n bits, separated by key addition:where (k0, . . . , kt) are obtained from the master key K using some key derivation function. For t = 1, KA1 collapses to the well-known Even-Mansour cipher, which is known to be indistinguishable from a (secret) random permutation, if P1 is modeled as a (public) random permutation. In this work we seek for stronger security of key-alternating ciphers -indifferentiability from an ideal cipher -and ask the question under which conditions on the key derivation function and for how many rounds t is the key-alternating cipher KAt indifferentiable from the ideal cipher, assuming P1, . . . , Pt are (public) random permutations? As our main result, we give an affirmative answer for t = 5, showing that the 5-round key-alternating cipher KA5 is indifferentiable from an ideal cipher, assuming P1, . . . , P5 are five independent random permutations, and the key derivation function sets all rounds keys ki = f (K), where 0 ≤ i ≤ 5 and f is modeled as a random oracle. Moreover, when |K| = |m|, we show we can set f (K) = P0(K) ⊕ K, giving an n-bit block cipher with an n-bit key, making only six calls to n-bit permutations P0, P1, P2, P3, P4, P5.

show abstract

Section: Simulator Overviewmentioning

confidence: 99%

“…We use the wish list methodology of [1]. We consider the probability of a simulator to make a winning query to IC.…”

Section: Attacks On Kamentioning

confidence: 99%

Section: Simulator Overviewmentioning

confidence: 99%

Section: Randomness Mapping (High-level Overview)mentioning

confidence: 99%

Section: Attack On the 4-roundmentioning

confidence: 99%

See 3 more Smart Citations

On the Indifferentiability of Key-Alternating Ciphers

Andreeva

Bogdanov

Dodis

et al. 2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Variable message encryption through blockcipher compression function

Chen

Mazumder

Miyaji

et al. 2016

Concurrency and Computation

View full text Add to dashboard Cite

Summary A constrained device is an emerging technology that has enormous applications in our daily life such as access control, inventory control, luggage tracking, bar‐code reader, and IoT. However, it has certain drawbacks of low memory and less computing power. Thus, one of the cracking challenges is to provide efficient and secure cryptographic solution for the constrained device in the aspect of security issue. An (n,n) blockcipher‐based cryptographic compression function is applicable to provide provable security to the constrained device. Though, there are many constructions of (n,n) blockcipher such as MDC‐2, MDC‐4, MJH, Bart‐12, and SKS‐15. However, most of the familiar schemes are not suitable for short and variable message encryption without padding because of their internal structures. Furthermore, the security margin is provided based on blocklength rather than the flexible size of message. In this paper, we present two different (n,n) blockcipher compression function schemes. The first scheme (FS) satisfies better efficiency such as less call of blockcipher, less key scheduling, and higher efficiency rate. On the contrary, the second scheme (SS) has upper security bound. Moreover, both of the schemes are suitable for small and variable message encryption (message size = tn|t < 1,n:blocklength), which is handy for the constrained device. The collision and preimage security bound of the FS are O(2tn/2) and O(2tn). In addition, the SS's collision resistance and preimage resistance are bounded by O(2tn) and O(22tn). Moreover, the efficiency rate of the proposed two schemes are respectively t and t/3. The numbers of key scheduling are 2 for the constructions of FS and SS. We use two calls of blockcipher in the FS. On the contrary, three calls of blockcipher are used in the SS. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Optimally Indifferentiable Double-Block-Length Hashing Without Post-processing and with Support for Longer Key Than Single Block

Naito

2019

Progress in Cryptology – LATINCRYPT 2019

View full text Add to dashboard Cite

The Preimage Security of Double-Block-Length Compression Functions

Cited by 43 publications

References 10 publications

On the Indifferentiability of Key-Alternating Ciphers

On the Indifferentiability of Key-Alternating Ciphers

Variable message encryption through blockcipher compression function

Optimally Indifferentiable Double-Block-Length Hashing Without Post-processing and with Support for Longer Key Than Single Block

Contact Info

Product

Resources

About