ZCZ – Achieving n-bit SPRP Security with a Minimal Number of Tweakable-Block-Cipher Calls

Bhaumik, Ritam; List, Eik; Nandi, Mridul

doi:10.1007/978-3-030-03326-2_12

Cited by 7 publications

(4 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Unlike their work, this paper considers a fixed input length that is determined by the block and tweak lengths of the underlying TBC. Related to the enciphering scheme using a TBC, Bhaumik et al [BLN18] Table 1: Summary of our results and other related block ciphers based only on a TBC. (n, t) in TBC denotes an n-bit TBC with t-bit tweaks.…”

Section: Related Workmentioning

confidence: 89%

“…The primal purpose is to construct a highly secure block cipher with the minimal number of TBC calls. Related to [BLN18], Dutta and Nandi [DN18] presented a construction of a tweakable enciphering scheme which also has BBB security. The work of [DN18] can be seen as a construction of a variable-input-length TBC from a fixed-input-length TBC.…”

Section: Constructionmentioning

confidence: 99%

See 1 more Smart Citation

Iterative Block Ciphers from Tweakable Block Ciphers with Long Tweaks

Nakamichi

Iwata

2020

ToSC

View full text Add to dashboard Cite

We consider a problem of constructing a secure block cipher from a tweakable block cipher (TBC) with long tweaks. Given a TBC with n-bit blocks and Γn-bit tweaks for Γ ≥ 1, one of the constructions by Minematsu in DCC 2015 shows that a simple iteration of the TBC for 3d rounds yields a block cipher with dn-bit blocks that is secure up to 2dn/2 queries, where d = Γ + 1. In this paper, we show three results.1. Iteration of 3d − 2 rounds is enough for the security up to 2dn/2 queries, i.e., the security remains the same even if we reduce the number of rounds by two.2. When the number of queries is limited to 2n, d+1 rounds are enough, and with d + l rounds for 1 ≤ l ≤ d − 1, the security bound improves as l grows.3. A d-round construction gives a block cipher secure up to 2n/2 queries, i.e., it achieves the classical birthday-bound security. Our results show that a block cipher with beyond-birthday-bound (BBB) security (with respect to n) is obtained as low as d + 1 rounds, and we draw the security spectrum of d + l round version in the range of 1 ≤ l ≤ d−1 and l = 2d−2 for BBB security, and l = 0 for birthday-bound security.

show abstract

Section: Related Workmentioning

confidence: 89%

Section: Constructionmentioning

confidence: 99%

Iterative Block Ciphers from Tweakable Block Ciphers with Long Tweaks

Nakamichi

Iwata

2020

ToSC

View full text Add to dashboard Cite

show abstract

“…Owing to their versatility, tweakable block ciphers have a broad range of applicability, most notably in authenticated encryption schemes [LRW11,Rog04,PS16], and message authentication codes [Nai15, IMPS17, CLS17, GLN19, CLL22]. Apart from these, TBCs have also been employed to achieve other symmetric-key security goals, e.g., [Min09,RZ11,JN18,BLN18].…”

Section: Introductionmentioning

confidence: 99%

On Large Tweaks in Tweakable Even-Mansour with Linear Tweak and Key Mixing

Cogliati,

Ethan,

Jha

et al. 2023

ToSC

View full text Add to dashboard Cite

In this paper, we provide the first analysis of the Iterated Tweakable Even-Mansour cipher with linear tweak and key (or tweakey) mixing, henceforth referred as TEML, for an arbitrary tweak(ey) size kn for all k ≥ 1, and arbitrary number of rounds r ≥ 2. Note that TEML captures the high-level design paradigm of most of the existing tweakable block ciphers (TBCs), including SKINNY, Deoxys, TweGIFT, TweAES etc. from a provable security point of view. At ASIACRYPT 2015, Cogliati and Seurin initiated the study of TEML by showing that 4-round TEML with a 2n-bit uniform at random key, and n-bit tweak is secure up to 22n/3 queries. In this work, we extend this line of research in two directions. First, we propose a necessary and sufficient class of linear tweakey schedules to absorb mn-bit tweak(ey) material in a minimal number of rounds, for all m ≥ 1. Second, we give a rigorous provable security treatment for r-round TEML, for all r ≥ 2. In particular, we first show that the 2r-round TEML with a (2r + 1)n-bit key, αn-bit tweak, and a special class of tweakey schedule is IND-CCA secure up to O(2r−α/r n) queries. Our proof crucially relies on the use of the coupling technique to upper-bound the statistical distance of the outputs of TEML cipher from the uniform distribution. Our main echnical contribution is a novel approach for computing the probability of failure in coupling, which could be of independent interest for deriving tighter bounds in coupling-based security proofs. Next, we shift our focus to the chosen-key setting, and show that (r + 3)-round TEML, with rn bits of tweakey material and a special class of tweakey schedule, offers some form of resistance to chosen-key attacks. We prove this by showing that r + 3 rounds of TEML are both necessary and sufficient for sequential indifferentiability. As a consequence of our results, we provide a sound provable security footing for the TWEAKEY framework, a high level design rationale of popular TBC.

show abstract

“…On the other hand, comparison turns difficult for SPRPs using field multiplications (e.g.,[NR99]) or tweakable blockciphers (e.g.,[BLN18]). …”

mentioning

confidence: 99%

Provable Security of SP Networks with Partial Non-Linear Layers

Guo

Standaert²,

Wang

et al. 2021

ToSC

View full text Add to dashboard Cite

Motivated by the recent trend towards low multiplicative complexity blockciphers (e.g., Zorro, CHES 2013; LowMC, EUROCRYPT 2015; HADES, EUROCRYPT 2020; MALICIOUS, CRYPTO 2020), we study their underlying structure partial SPNs, i.e., Substitution-Permutation Networks (SPNs) with parts of the substitution layer replaced by an identity mapping, and put forward the first provable security analysis for such partial SPNs built upon dedicated linear layers. For different instances of partial SPNs using MDS linear layers, we establish strong pseudorandom security as well as practical provable security against impossible differential attacks. By extending the well-established MDS code-based idea, we also propose the first principled design of linear layers that ensures optimal differential propagation. Our results formally confirm the conjecture that partial SPNs achieve the same security as normal SPNs while consuming less non-linearity, in a well-established framework.

show abstract

ZCZ – Achieving n-bit SPRP Security with a Minimal Number of Tweakable-Block-Cipher Calls

Cited by 7 publications

References 29 publications

Iterative Block Ciphers from Tweakable Block Ciphers with Long Tweaks

Iterative Block Ciphers from Tweakable Block Ciphers with Long Tweaks

On Large Tweaks in Tweakable Even-Mansour with Linear Tweak and Key Mixing

Provable Security of SP Networks with Partial Non-Linear Layers

Contact Info

Product

Resources

About