Minimizing the Two-Round Even-Mansour Cipher

摘要: The r-round (iterated) Even-Mansour cipher (also known as key-alternating cipher) defines a block from r fixed public n-bit permutations P1,…,P follows: given sequence of round keys k0,…,k , an plaintext x is encrypted by xoring key k0, applying permutation P1, k1, etc. (strong) pseudorandomness this construction in the random model (i.e., when are oracles that adversary can query black-box way) was studied number recent papers, culminating with work Chen and Steinberger (EUROCRYPT 2014), who proved indistinguishable truly up to \( \mathcal{O} (2^{\frac{rn}{r+1}})\) queries any adaptive (which optimal security bound since it matches simple distinguishing attack). All results entire line share common restriction they only hold under assumption independent. In particular, for two rounds, current state knowledge E(x) = k2 ⊕ P2(k1 P1(k0 x)) provably secure (2^{2n/3})\) adversary, three independent keys, P1 P2 permutations. paper, we ask whether one obtain similar two-round just permutation. Our answer positive: adequately derived master k, same P used place P2, prove qualitatively \widetilde{ } (in model). To best our knowledge, first “beyond birthday bound” result AES-like ciphers does not assume keys.