Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion The Ideal Cipher Model (ICM) k We will model the underlying block cipher E as an ideal cipher y x E Ideal Block Cipher Model • family of uniformly random permutations E k ( · ) • independent for each key • given as an oracle to all parties (incl. adversaries) Generic Security • attacks cannot exploit any weakness of E ⇒ “generic” attacks Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 7 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion The Ideal Cipher Model (ICM) k We will model the underlying block cipher E as an ideal cipher y x E Ideal Block Cipher Model • family of uniformly random permutations E k ( · ) • independent for each key • given as an oracle to all parties (incl. adversaries) Generic Security • attacks cannot exploit any weakness of E ⇒ “generic” attacks Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 7 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key-Length Extension in the ICM k C P E E E q e q c q e q c 0 / 1 0 / 1 • q c construction queries to C k [ E ]( · ) or P ( · ) • q e ideal cipher queries to E ( · , · ) • it is computationally unbounded (information-theoretic sec.) • NB: generic attack with q e = 2 κ + n for any KLE scheme Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 8 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key-Length Extension in the ICM k C P E E E q e q c q e q c 0 / 1 0 / 1 • q c construction queries to C k [ E ]( · ) or P ( · ) • q e ideal cipher queries to E ( · , · ) • it is computationally unbounded (information-theoretic sec.) • NB: generic attack with q e = 2 κ + n for any KLE scheme Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 8 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key-Length Extension in the ICM k C P E E E q e q c q e q c 0 / 1 0 / 1 • q c construction queries to C k [ E ]( · ) or P ( · ) • q e ideal cipher queries to E ( · , · ) • it is computationally unbounded (information-theoretic sec.) • NB: generic attack with q e = 2 κ + n for any KLE scheme Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 8 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key-Length Extension in the ICM k C P E E E q e q c q e q c 0 / 1 0 / 1 • q c construction queries to C k [ E ]( · ) or P ( · ) • q e ideal cipher queries to E ( · , · ) • it is computationally unbounded (information-theoretic sec.) • NB: generic attack with q e = 2 κ + n for any KLE scheme Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 8 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Full vs. Partial Codebook Query Accounting • most previous work sets q c = 2 n ( full codebook of C [ E ] ) ⇒ q e is the only complexity measure • too restrictive! • number of pt/ct pairs can be limited (frequent rekeying) • mode of operation may impose q c ≪ 2 n • we aim at studying the entire plan ( q c , q e ) previous log 2 ( q e ) work κ + n κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 9 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Full vs. Partial Codebook Query Accounting • most previous work sets q c = 2 n ( full codebook of C [ E ] ) ⇒ q e is the only complexity measure • too restrictive! • number of pt/ct pairs can be limited (frequent rekeying) • mode of operation may impose q c ≪ 2 n • we aim at studying the entire plan ( q c , q e ) previous log 2 ( q e ) work κ + n κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 9 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Full vs. Partial Codebook Query Accounting • most previous work sets q c = 2 n ( full codebook of C [ E ] ) ⇒ q e is the only complexity measure • too restrictive! • number of pt/ct pairs can be limited (frequent rekeying) • mode of operation may impose q c ≪ 2 n • we aim at studying the entire plan ( q c , q e ) previous log 2 ( q e ) work κ + n κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 9 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Full vs. Partial Codebook Query Accounting • most previous work sets q c = 2 n ( full codebook of C [ E ] ) ⇒ q e is the only complexity measure • too restrictive! • number of pt/ct pairs can be limited (frequent rekeying) • mode of operation may impose q c ≪ 2 n • we aim at studying the entire plan ( q c , q e ) previous log 2 ( q e ) work κ + n this work κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 9 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Outline Context: Key-Length Extension for Block Ciphers Main Lemma Randomized Cascading Plain Cascading Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 10 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Randomized Key-Length Extension Schemes Very general class abiding to the following structure: k z φ 1 φ 2 φ r ρ 0 ρ 1 ρ r y x E E E z z z • the ρ i ’s are keyed permutations, potentially very simple (e.g. ρ i z ( x ) = x ⊕ z ) • encryption keys φ 1 ( k ) , . . . , φ r ( k ) can be deterministically related or independent Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 11 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Induced Sequential Cipher k z φ 1 φ 2 φ r ρ 0 ρ 1 ρ r y x E E E z z z • k fixed and known ⇒ C [ E ] = block cipher construction using • independent public permutations P 1 , . . . , P r • key z • ⇒ induced sequential cipher (ISC) of C, denoted C • generalization of a key-alternating cipher • well-studied design in the Random Permutation Model Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 12 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Induced Sequential Cipher z ρ 0 ρ 1 ρ r y x P 1 P 2 P r z z z • k fixed and known ⇒ C [ E ] = block cipher construction using • independent public permutations P 1 , . . . , P r • key z • ⇒ induced sequential cipher (ISC) of C, denoted C • generalization of a key-alternating cipher • well-studied design in the Random Permutation Model Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 12 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Induced Sequential Cipher z ρ 0 ρ 1 ρ r y x P 1 P 2 P r z z z • k fixed and known ⇒ C [ E ] = block cipher construction using • independent public permutations P 1 , . . . , P r • key z • ⇒ induced sequential cipher (ISC) of C, denoted C • generalization of a key-alternating cipher • well-studied design in the Random Permutation Model Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 12 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Induced Sequential Cipher z ρ 0 ρ 1 ρ r y x P 1 P 2 P r z z z • k fixed and known ⇒ C [ E ] = block cipher construction using • independent public permutations P 1 , . . . , P r • key z • ⇒ induced sequential cipher (ISC) of C, denoted C • generalization of a key-alternating cipher • well-studied design in the Random Permutation Model Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 12 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Induced Sequential Cipher z ρ 0 ρ 1 ρ r y x P 1 P 2 P r z z z • k fixed and known ⇒ C [ E ] = block cipher construction using • independent public permutations P 1 , . . . , P r • key z • ⇒ induced sequential cipher (ISC) of C, denoted C • generalization of a key-alternating cipher • well-studied design in the Random Permutation Model Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 12 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion KLE-to-ISC Lemma k z φ 1 φ 2 φ r ρ 0 ρ 1 ρ r y x E E E z z z Allows to reduce the security analysis of a randomized KLE C to the analysis of the Induced Sequential Cipher C Lemma For any M, ( q c , q e ) ≤ rq e Adv sprp M 2 κ + Adv sprp ( q c , M ) C C Optimizing M yields a bound that depends only on q c and q e . Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 13 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion KLE-to-ISC Lemma k z φ 1 φ 2 φ r ρ 0 ρ 1 ρ r y x E E E z z z Allows to reduce the security analysis of a randomized KLE C to the analysis of the Induced Sequential Cipher C Lemma For any M, ( q c , q e ) ≤ rq e Adv sprp M 2 κ + Adv sprp ( q c , M ) C C Optimizing M yields a bound that depends only on q c and q e . Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 13 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion KLE-to-ISC Lemma z ρ 0 ρ 1 ρ r y x P 1 P 2 P r z z z Allows to reduce the security analysis of a randomized KLE C to the analysis of the Induced Sequential Cipher C Lemma For any M, ( q c , q e ) ≤ rq e Adv sprp M 2 κ + Adv sprp ( q c , M ) C C Optimizing M yields a bound that depends only on q c and q e . Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 13 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion KLE-to-ISC Lemma z ρ 0 ρ 1 ρ r y x P 1 P 2 P r z z z Allows to reduce the security analysis of a randomized KLE C to the analysis of the Induced Sequential Cipher C Lemma For any M, ( q c , q e ) ≤ rq e Adv sprp M 2 κ + Adv sprp ( q c , M ) C C Optimizing M yields a bound that depends only on q c and q e . Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 13 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Outline Context: Key-Length Extension for Block Ciphers Main Lemma Randomized Cascading Plain Cascading Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 14 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key Whitening k y x E FX construction (generic DESX) log 2 ( q e ) κ + n • additional keys hide i./o. of E • suggested by Rivest Insec. • analyzed by [KR01] Sec. • secure when q c · q e ≪ 2 κ + n κ log 2 ( q c ) • same bound when z 0 = z 1 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 15 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key Whitening k z 0 z 1 y x E FX construction (generic DESX) log 2 ( q e ) κ + n • additional keys hide i./o. of E • suggested by Rivest Insec. • analyzed by [KR01] Sec. • secure when q c · q e ≪ 2 κ + n κ log 2 ( q c ) • same bound when z 0 = z 1 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 15 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key Whitening k z 0 z 1 y x E FX construction (generic DESX) log 2 ( q e ) κ + n • additional keys hide i./o. of E • suggested by Rivest Insec. • analyzed by [KR01] Sec. • secure when q c · q e ≪ 2 κ + n κ log 2 ( q c ) • same bound when z 0 = z 1 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 15 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key Whitening k z 0 z 1 y x E FX construction (generic DESX) log 2 ( q e ) κ + n • additional keys hide i./o. of E • suggested by Rivest Insec. • analyzed by [KR01] Sec. • secure when q c · q e ≪ 2 κ + n κ log 2 ( q c ) • same bound when z 0 = z 1 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 15 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Key Whitening k z z y x E FX construction (generic DESX) log 2 ( q e ) κ + n • additional keys hide i./o. of E • suggested by Rivest Insec. • analyzed by [KR01] Sec. • secure when q c · q e ≪ 2 κ + n κ log 2 ( q c ) • same bound when z 0 = z 1 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 15 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 2XOR construction [GT12] φ ( k ) k z z y x E E 2XOR construction log 2 ( q e ) FX • combines key-whitening and κ + n cascading • same whitening key z κ + n 2 • φ such that ∀ k , φ ( k ) � = k • [GT12] proved (tight) security κ log 2 ( q c ) for q c = 2 n and q e ≪ 2 κ + n / 2 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 16 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 2XOR construction [GT12] φ ( k ) k z z y x E E 2XOR construction log 2 ( q e ) FX • combines key-whitening and κ + n cascading • same whitening key z κ + n 2 • φ such that ∀ k , φ ( k ) � = k • [GT12] proved (tight) security κ log 2 ( q c ) for q c = 2 n and q e ≪ 2 κ + n / 2 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 16 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 2XOR construction [GT12] φ ( k ) k z z y x E E 2XOR construction log 2 ( q e ) FX • combines key-whitening and κ + n cascading • same whitening key z κ + n 2 • φ such that ∀ k , φ ( k ) � = k • [GT12] proved (tight) security κ log 2 ( q c ) for q c = 2 n and q e ≪ 2 κ + n / 2 n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 16 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Refined Analysis of 2XOR φ ( k ) k z z y x E E log 2 ( q e ) We (tightly) complete the picture: FX κ + n • for 1 ≤ q c ≤ 2 n / 2 : same security bound as FX κ + n 2 • for 2 n / 2 ≤ q c ≤ 2 n : secure when q e ≪ 2 κ + n / 2 κ log 2 ( q c ) n 0 n 2 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 17 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Refined Analysis of 2XOR φ ( k ) k z z y x E E log 2 ( q e ) We (tightly) complete the picture: FX κ + n 2XOR • for 1 ≤ q c ≤ 2 n / 2 : same security bound as FX κ + n 2 • for 2 n / 2 ≤ q c ≤ 2 n : secure when q e ≪ 2 κ + n / 2 κ log 2 ( q c ) n 0 n 2 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 17 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Refined Analysis of 2XOR φ ( k ) k z z y x E E log 2 ( q e ) We (tightly) complete the picture: FX κ + n 2XOR • for 1 ≤ q c ≤ 2 n / 2 : same security bound as FX κ + n 2 • for 2 n / 2 ≤ q c ≤ 2 n : secure when q e ≪ 2 κ + n / 2 κ log 2 ( q c ) n 0 n 2 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 17 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps φ ( k ) k z z z y x E E 3XOR construction • add a final whitening step • induced sequential cipher = 2-round Even-Mansour cipher with identical keys ⇒ analyzed by [CLL + 14] • we can apply the KLE-to-ISC Lemma Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps z z z y x P 1 P 2 3XOR construction • add a final whitening step • induced sequential cipher = 2-round Even-Mansour cipher with identical keys ⇒ analyzed by [CLL + 14] • we can apply the KLE-to-ISC Lemma Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps z z z y x P 1 P 2 3XOR construction • add a final whitening step • induced sequential cipher = 2-round Even-Mansour cipher with identical keys ⇒ analyzed by [CLL + 14] • we can apply the KLE-to-ISC Lemma Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps φ ( k ) k z z z y x E E log 2 ( q e ) 2XOR (tight) κ + n κ + 3 n 4 κ + 2 n 3 κ + n log 2 ( q c ) 2 n 0 n n 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps φ ( k ) k z z z y x E E log 2 ( q e ) 2XOR (tight) κ + n 3XOR κ + 3 n 4 κ + 2 n 3 κ + n log 2 ( q c ) 2 n 0 n n 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps φ ( k ) k z z z y x E E log 2 ( q e ) 2XOR (tight) κ + n 3XOR κ + 3 n 4 κ + 2 n 3 κ + n log 2 ( q c ) 2 n 0 n n 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps φ ( k ) k z z z y x E E log 2 ( q e ) 2XOR (tight) κ + n 3XOR Gaži’s generic attack [Gaz13] κ + 3 n 4 κ + 2 n 3 κ + n log 2 ( q c ) 2 n 0 n n 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion 3XOR: Final Whitening Step Helps φ ( k ) k z z z y x E E log 2 ( q e ) κ + n 3XOR Gaži’s generic attack [Gaz13] Insec. ? κ + 3 n 4 κ + 2 n 3 Sec. ? κ + n log 2 ( q c ) 2 n 0 n n 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 18 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion A 2-call Construction without Rekeying φ ( k ) k z z z y x E E • drawback of 2XOR and 3XOR constructions: call the block cipher E with two distinct keys • we propose a construction calling E twice with the same key • π is a linear orthomorphism • security bound qualitatively similar to 3XOR Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 19 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion A 2-call Construction without Rekeying k k z π ( z ) z y x E E • drawback of 2XOR and 3XOR constructions: call the block cipher E with two distinct keys • we propose a construction calling E twice with the same key • π is a linear orthomorphism • security bound qualitatively similar to 3XOR Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 19 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion A 2-call Construction without Rekeying k k z π ( z ) z y x E E • drawback of 2XOR and 3XOR constructions: call the block cipher E with two distinct keys • we propose a construction calling E twice with the same key • π is a linear orthomorphism • security bound qualitatively similar to 3XOR Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 19 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion A 2-call Construction without Rekeying k k z π ( z ) z y x E E • drawback of 2XOR and 3XOR constructions: call the block cipher E with two distinct keys • we propose a construction calling E twice with the same key • π is a linear orthomorphism • security bound qualitatively similar to 3XOR Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 19 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E Xor-Cascade Encryption: XCE • independent whitening keys, distinct encryption keys • induced sequential cipher = iterated Even-Mansour cipher ⇒ tightly analyzed by Chen and Steinberger [CS14] • r -round XCE is secure as long as q c · q r e ≪ 2 r ( κ + n ) • matched by Gaži’s attack [Gaz13] Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) z 0 z 1 z r y x P 1 P 2 P r Xor-Cascade Encryption: XCE • independent whitening keys, distinct encryption keys • induced sequential cipher = iterated Even-Mansour cipher ⇒ tightly analyzed by Chen and Steinberger [CS14] • r -round XCE is secure as long as q c · q r e ≪ 2 r ( κ + n ) • matched by Gaži’s attack [Gaz13] Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E Xor-Cascade Encryption: XCE • independent whitening keys, distinct encryption keys • induced sequential cipher = iterated Even-Mansour cipher ⇒ tightly analyzed by Chen and Steinberger [CS14] • r -round XCE is secure as long as q c · q r e ≪ 2 r ( κ + n ) • matched by Gaži’s attack [Gaz13] Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E Xor-Cascade Encryption: XCE • independent whitening keys, distinct encryption keys • induced sequential cipher = iterated Even-Mansour cipher ⇒ tightly analyzed by Chen and Steinberger [CS14] • r -round XCE is secure as long as q c · q r e ≪ 2 r ( κ + n ) • matched by Gaži’s attack [Gaz13] Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E log 2 ( q e ) κ + n r = + ∞ r = 3 κ + 2 n 3 r = 2 κ + n r = 1 (FX) 2 κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E log 2 ( q e ) κ + n r = + ∞ r = 3 κ + 2 n 3 r = 2 κ + n r = 1 (FX) 2 κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E log 2 ( q e ) κ + n r = + ∞ r = 3 κ + 2 n 3 r = 2 κ + n r = 1 (FX) 2 κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E log 2 ( q e ) κ + n r = + ∞ r = 3 κ + 2 n 3 r = 2 κ + n r = 1 (FX) 2 κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Independent Whitening Keys (XOR-Cascade) φ 1 ( k ) φ 2 ( k ) φ r ( k ) z 0 z 1 z r y x E E E log 2 ( q e ) κ + n r = + ∞ r = 3 κ + 2 n 3 r = 2 κ + n r = 1 (FX) 2 κ log 2 ( q c ) n 0 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 20 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Outline Context: Key-Length Extension for Block Ciphers Main Lemma Randomized Cascading Plain Cascading Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 21 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Plain Cascade Encryption k 1 k 2 k 3 k ℓ y x E E E E Cascade Encryption • encrypt ℓ times with independent keys • ℓ = 2 does not help (meet-in-the-middle attack [DH77]) • security gain starting from ℓ = 3 [BR06] • tight bound for q c = 2 n [DLMS14]: for odd ℓ , secure when q e ≪ 2 κ + ℓ − 1 ℓ + 1 n Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 22 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Plain Cascade Encryption k 1 k 2 k 3 k ℓ y x E E E E Cascade Encryption • encrypt ℓ times with independent keys • ℓ = 2 does not help (meet-in-the-middle attack [DH77]) • security gain starting from ℓ = 3 [BR06] • tight bound for q c = 2 n [DLMS14]: for odd ℓ , secure when q e ≪ 2 κ + ℓ − 1 ℓ + 1 n Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 22 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Plain Cascade Encryption k 1 k 2 k 3 k ℓ y x E E E E Cascade Encryption • encrypt ℓ times with independent keys • ℓ = 2 does not help (meet-in-the-middle attack [DH77]) • security gain starting from ℓ = 3 [BR06] • tight bound for q c = 2 n [DLMS14]: for odd ℓ , secure when q e ≪ 2 κ + ℓ − 1 ℓ + 1 n Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 22 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Plain Cascade Encryption k 1 k 2 k 3 k ℓ y x E E E E Cascade Encryption • encrypt ℓ times with independent keys • ℓ = 2 does not help (meet-in-the-middle attack [DH77]) • security gain starting from ℓ = 3 [BR06] • tight bound for q c = 2 n [DLMS14]: for odd ℓ , secure when q e ≪ 2 κ + ℓ − 1 ℓ + 1 n Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 22 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Our Analysis of Plain Cascade Encryption k 1 k 2 k 3 k 4 k 5 y x E E E E E • use 2 independent ideal ciphers E , E ′ (key-domain separation) • reveal function table of E ′ for free ⇒ randomized KLE • apply the KLE-to-ISC Lemma • generalize analysis of key-alternating ciphers of [CS14] • our result: plain cascade of length ℓ = 2 r + 1 is secure when q c · q r e ≪ 2 r ( κ + n ) , q c ≪ 2 κ , q e ≪ 2 2 κ Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 23 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Our Analysis of Plain Cascade Encryption k 1 k 2 k 3 k 4 k 5 y x E ′ E E ′ E E ′ • use 2 independent ideal ciphers E , E ′ (key-domain separation) • reveal function table of E ′ for free ⇒ randomized KLE • apply the KLE-to-ISC Lemma • generalize analysis of key-alternating ciphers of [CS14] • our result: plain cascade of length ℓ = 2 r + 1 is secure when q c · q r e ≪ 2 r ( κ + n ) , q c ≪ 2 κ , q e ≪ 2 2 κ Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 23 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Our Analysis of Plain Cascade Encryption k 1 k 2 k 3 k 4 k 5 y x E ′ E E ′ E E ′ • use 2 independent ideal ciphers E , E ′ (key-domain separation) • reveal function table of E ′ for free ⇒ randomized KLE • apply the KLE-to-ISC Lemma • generalize analysis of key-alternating ciphers of [CS14] • our result: plain cascade of length ℓ = 2 r + 1 is secure when q c · q r e ≪ 2 r ( κ + n ) , q c ≪ 2 κ , q e ≪ 2 2 κ Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 23 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Our Analysis of Plain Cascade Encryption k 1 k 3 k 5 y x P 2 P 4 E ′ E ′ E ′ • use 2 independent ideal ciphers E , E ′ (key-domain separation) • reveal function table of E ′ for free ⇒ randomized KLE • apply the KLE-to-ISC Lemma • generalize analysis of key-alternating ciphers of [CS14] • our result: plain cascade of length ℓ = 2 r + 1 is secure when q c · q r e ≪ 2 r ( κ + n ) , q c ≪ 2 κ , q e ≪ 2 2 κ Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 23 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Our Analysis of Plain Cascade Encryption k 1 k 3 k 5 y x P 2 P 4 E ′ E ′ E ′ • use 2 independent ideal ciphers E , E ′ (key-domain separation) • reveal function table of E ′ for free ⇒ randomized KLE • apply the KLE-to-ISC Lemma • generalize analysis of key-alternating ciphers of [CS14] • our result: plain cascade of length ℓ = 2 r + 1 is secure when q c · q r e ≪ 2 r ( κ + n ) , q c ≪ 2 κ , q e ≪ 2 2 κ Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 23 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Our Analysis of Plain Cascade Encryption k 1 k 3 k 5 y x P 2 P 4 E ′ E ′ E ′ • use 2 independent ideal ciphers E , E ′ (key-domain separation) • reveal function table of E ′ for free ⇒ randomized KLE • apply the KLE-to-ISC Lemma • generalize analysis of key-alternating ciphers of [CS14] • our result: plain cascade of length ℓ = 2 r + 1 is secure when q c · q r e ≪ 2 r ( κ + n ) , q c ≪ 2 κ , q e ≪ 2 2 κ Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 23 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion The Case of Triple Encryption k 1 k 2 k 3 y x E E E • our bound: log 2 ( q e ) κ + n q c ≪ 2 κ 2 κ q e ≪ 2 2 κ q c · q e ≪ 2 κ + n κ + n 2 • when 2 n / 2 ≤ q c ≤ 2 n ⇒ [DLMS14] bound applies κ log 2 ( q c ) ( q e ≪ 2 κ + n / 2 ) κ n n 0 2 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 24 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion The Case of Triple Encryption k 1 k 2 k 3 y x E E E • our bound: log 2 ( q e ) κ + n q c ≪ 2 κ 2 κ q e ≪ 2 2 κ q c · q e ≪ 2 κ + n κ + n 2 • when 2 n / 2 ≤ q c ≤ 2 n ⇒ [DLMS14] bound applies κ log 2 ( q c ) ( q e ≪ 2 κ + n / 2 ) κ n n 0 2 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 24 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion The Case of Triple Encryption k 1 k 2 k 3 y x E E E • our bound: log 2 ( q e ) κ + n q c ≪ 2 κ 2 κ q e ≪ 2 2 κ q c · q e ≪ 2 κ + n κ + n 2 • when 2 n / 2 ≤ q c ≤ 2 n ⇒ [DLMS14] bound applies κ log 2 ( q c ) ( q e ≪ 2 κ + n / 2 ) κ n n 0 2 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 24 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion The Case of Triple Encryption k 1 k 2 k 3 y x E E E • our bound: log 2 ( q e ) κ + n q c ≪ 2 κ ? 2 κ q e ≪ 2 2 κ q c · q e ≪ 2 κ + n κ + n 2 • when 2 n / 2 ≤ q c ≤ 2 n ⇒ [DLMS14] bound applies κ log 2 ( q c ) ( q e ≪ 2 κ + n / 2 ) κ n n 0 2 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 24 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion I log 2 ( q e ) κ + n κ + 3 n 4 κ + 2 n 3 κ + n 2 κ log 2 ( q c ) n n n 0 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 25 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion I log 2 ( q e ) FX (tight) κ + n κ + 3 n 4 κ + 2 n 3 κ + n 2 κ log 2 ( q c ) n n n 0 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 25 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion I log 2 ( q e ) FX (tight) κ + n 2XOR (tight) κ + 3 n 4 κ + 2 n 3 κ + n 2 κ log 2 ( q c ) n n n 0 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 25 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion I log 2 ( q e ) FX (tight) κ + n 2XOR (tight) triple encryption κ + 3 n 4 κ + 2 n 3 κ + n 2 κ log 2 ( q c ) n n n 0 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 25 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion I log 2 ( q e ) FX (tight) κ + n 2XOR (tight) triple encryption κ + 3 n 3XOR 4 κ + 2 n 3 κ + n 2 κ log 2 ( q c ) n n n 0 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 25 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion I log 2 ( q e ) FX (tight) κ + n 2XOR (tight) triple encryption κ + 3 n 3XOR 4 2-r. xor-cascade (tight) κ + 2 n 3 (ind. whit. keys) κ + n 2 κ log 2 ( q c ) n n n 0 2 n 3 n 4 2 3 4 Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 25 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion II • our results seem to advocate in favor of xor-cascade rather than plain cascade • e.g. triple encryption (3 E -calls) has similar security as • FX (1 E -call) for q c ≤ 2 n / 2 • 2XOR (2 E -calls) for 2 n / 2 ≤ q c ≤ 2 n • but this is in the ideal cipher model (information-theoretic) • FX seems to have other “computational” issues (see time-memory-data trade-off by Dinur, EC 2015) Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 26 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion II • our results seem to advocate in favor of xor-cascade rather than plain cascade • e.g. triple encryption (3 E -calls) has similar security as • FX (1 E -call) for q c ≤ 2 n / 2 • 2XOR (2 E -calls) for 2 n / 2 ≤ q c ≤ 2 n • but this is in the ideal cipher model (information-theoretic) • FX seems to have other “computational” issues (see time-memory-data trade-off by Dinur, EC 2015) Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 26 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion II • our results seem to advocate in favor of xor-cascade rather than plain cascade • e.g. triple encryption (3 E -calls) has similar security as • FX (1 E -call) for q c ≤ 2 n / 2 • 2XOR (2 E -calls) for 2 n / 2 ≤ q c ≤ 2 n • but this is in the ideal cipher model (information-theoretic) • FX seems to have other “computational” issues (see time-memory-data trade-off by Dinur, EC 2015) Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 26 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion Conclusion II • our results seem to advocate in favor of xor-cascade rather than plain cascade • e.g. triple encryption (3 E -calls) has similar security as • FX (1 E -call) for q c ≤ 2 n / 2 • 2XOR (2 E -calls) for 2 n / 2 ≤ q c ≤ 2 n • but this is in the ideal cipher model (information-theoretic) • FX seems to have other “computational” issues (see time-memory-data trade-off by Dinur, EC 2015) Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 26 / 29
Key-Length Extension Main Lemma Randomized Cascading Plain Cascading Conclusion The end. . . Thanks for your attention! Comments or questions? Gaži, Lee, Seurin, Steinberger, Tessaro Relaxing Full-Codebook Security FSE 2015 27 / 29
Recommend
More recommend
