How to Construct an Ideal Cipher from a Small Set of Public - PowerPoint PPT Presentation

How to Construct an Ideal Cipher from a Small Set of Public Permutations Rodolphe Lampe and Yannick Seurin University of Versailles and ANSSI ASIACRYPT 2013 — December 3, 2013 Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 1 / 38

Summary Summary We show how to construct an ideal cipher from a small set of n -bit public random permutations { P 1 , . . . , P r } The construction we consider is the single-key iterated Even-Mansour cipher ( aka key-alternating cipher) with 12 rounds: k k k y x P 1 P 2 P 12 ⇒ this yields a family of 2 n permutations indexed by the n -bit key k from only 12 public n -bit permutations We show that this construction “behaves” as an ideal cipher with n -bit blocks and n -bit keys using the indifferentiability framework We also show that at least 4 rounds are necessary to achieve indifferentiability from an ideal cipher Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 2 / 38

Summary Summary We show how to construct an ideal cipher from a small set of n -bit public random permutations { P 1 , . . . , P r } The construction we consider is the single-key iterated Even-Mansour cipher ( aka key-alternating cipher) with 12 rounds: k k k y x P 1 P 2 P 12 ⇒ this yields a family of 2 n permutations indexed by the n -bit key k from only 12 public n -bit permutations We show that this construction “behaves” as an ideal cipher with n -bit blocks and n -bit keys using the indifferentiability framework We also show that at least 4 rounds are necessary to achieve indifferentiability from an ideal cipher Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 2 / 38

Summary Summary We show how to construct an ideal cipher from a small set of n -bit public random permutations { P 1 , . . . , P r } The construction we consider is the single-key iterated Even-Mansour cipher ( aka key-alternating cipher) with 12 rounds: k k k y x P 1 P 2 P 12 ⇒ this yields a family of 2 n permutations indexed by the n -bit key k from only 12 public n -bit permutations We show that this construction “behaves” as an ideal cipher with n -bit blocks and n -bit keys using the indifferentiability framework We also show that at least 4 rounds are necessary to achieve indifferentiability from an ideal cipher Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 2 / 38

Summary Summary We show how to construct an ideal cipher from a small set of n -bit public random permutations { P 1 , . . . , P r } The construction we consider is the single-key iterated Even-Mansour cipher ( aka key-alternating cipher) with 12 rounds: k k k y x P 1 P 2 P 12 ⇒ this yields a family of 2 n permutations indexed by the n -bit key k from only 12 public n -bit permutations We show that this construction “behaves” as an ideal cipher with n -bit blocks and n -bit keys using the indifferentiability framework We also show that at least 4 rounds are necessary to achieve indifferentiability from an ideal cipher Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 2 / 38

Outline Outline Background on the Iterated Even-Mansour Cipher 1 Indifferentiability of the IEM cipher 2 Formalizing the problem Which key schedule? At least 4 rounds are necessary Indifferentiability proof for 12 rounds 3 Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 3 / 38

Background on the Iterated Even-Mansour Cipher Outline Background on the Iterated Even-Mansour Cipher 1 Indifferentiability of the IEM cipher 2 Formalizing the problem Which key schedule? At least 4 rounds are necessary Indifferentiability proof for 12 rounds 3 Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 4 / 38

Background on the Iterated Even-Mansour Cipher Iterated Even-Mansour cipher ( aka key-alternating cipher) Iterated Even-Mansour (IEM) with r rounds: K K K γ 0 γ 1 γ r y x P 1 P 2 P r The P i ’s are public permutations on { 0 , 1 } n K ∈ { 0 , 1 } ℓ is the (master) key The γ i ’s are key derivation functions mapping K to n -bit values Also named key-alternating cipher Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 5 / 38

Background on the Iterated Even-Mansour Cipher Iterated Even-Mansour cipher ( aka key-alternating cipher) Iterated Even-Mansour (IEM) with r rounds: K K K γ 0 γ 1 γ r y x P 1 P 2 P r The P i ’s are public permutations on { 0 , 1 } n K ∈ { 0 , 1 } ℓ is the (master) key The γ i ’s are key derivation functions mapping K to n -bit values Also named key-alternating cipher Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 5 / 38

Background on the Iterated Even-Mansour Cipher Iterated Even-Mansour cipher ( aka key-alternating cipher) Most (if not all) SPN ciphers can be described as key-alternating ciphers. E.g. for AES-128, one has r = 10, the γ i ’s are efficiently invertible permutations, and: P 1 = . . . = P 9 = SubBytes ◦ ShiftRows ◦ MixColumns P 10 = SubBytes ◦ ShiftRows When the P i ’s are fixed permutations, one can prove results like: the best differential characteristic over r ′ < r rounds has probability at most p the best linear approximation over r ′ < r rounds has probability at most p ′ This gives upper bounds on the distinguishing probability of very specific adversaries Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 6 / 38

Background on the Iterated Even-Mansour Cipher Iterated Even-Mansour cipher ( aka key-alternating cipher) Most (if not all) SPN ciphers can be described as key-alternating ciphers. E.g. for AES-128, one has r = 10, the γ i ’s are efficiently invertible permutations, and: P 1 = . . . = P 9 = SubBytes ◦ ShiftRows ◦ MixColumns P 10 = SubBytes ◦ ShiftRows When the P i ’s are fixed permutations, one can prove results like: the best differential characteristic over r ′ < r rounds has probability at most p the best linear approximation over r ′ < r rounds has probability at most p ′ This gives upper bounds on the distinguishing probability of very specific adversaries Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 6 / 38

Background on the Iterated Even-Mansour Cipher Analysis in the Random Permutation Model (RPM) Recently, a lot of results have been obtained in the Random Permutation Model: the P i ’s are viewed as oracles to which the adversary can make black-box queries (both to P i and P − 1 ). i Interpretation: gives a guarantee against any adversary which does not use particular properties of the P i ’s In fact, this model was already considered 15 years ago by Even and Mansour for r = 1 round: they showed that the following cipher is pseudorandom up to O ( 2 n / 2 ) queries of the adversary, when P 1 is a public random permutation: k 0 k 1 y x P 1 Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 7 / 38

Background on the Iterated Even-Mansour Cipher Analysis in the Random Permutation Model (RPM) Recently, a lot of results have been obtained in the Random Permutation Model: the P i ’s are viewed as oracles to which the adversary can make black-box queries (both to P i and P − 1 ). i Interpretation: gives a guarantee against any adversary which does not use particular properties of the P i ’s In fact, this model was already considered 15 years ago by Even and Mansour for r = 1 round: they showed that the following cipher is pseudorandom up to O ( 2 n / 2 ) queries of the adversary, when P 1 is a public random permutation: k 0 k 1 y x P 1 Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 7 / 38

Background on the Iterated Even-Mansour Cipher Pseudorandomness of the IEM cipher (in the RPM) The following results have been successively obtained for the pseudorandomness of the IEM cipher (notation: N = 2 n ): 1 2 ) queries [EM97] for r = 1 round, security up to O ( N 2 3 ) queries [BKL + 12] for r ≥ 2, security up to O ( N 3 4 ) queries [Ste13] for r ≥ 3, security up to O ( N r r + 2 ) queries [LPS12] for any even r , security up to O ( N r r + 1 ) queries [CS13] tight result: for r rounds, security up to O ( N Results for independent round keys ( k 0 , k 1 , . . . , k r ) k 0 k 1 k r y x P 1 P 2 P r Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 8 / 38

Background on the Iterated Even-Mansour Cipher Pseudorandomness of the IEM cipher (in the RPM) The following results have been successively obtained for the pseudorandomness of the IEM cipher (notation: N = 2 n ): 1 2 ) queries [EM97] for r = 1 round, security up to O ( N 2 3 ) queries [BKL + 12] for r ≥ 2, security up to O ( N 3 4 ) queries [Ste13] for r ≥ 3, security up to O ( N r r + 2 ) queries [LPS12] for any even r , security up to O ( N r r + 1 ) queries [CS13] tight result: for r rounds, security up to O ( N Results for independent round keys ( k 0 , k 1 , . . . , k r ) k 0 k 1 k r y x P 1 P 2 P r Lampe & Seurin (UVSQ & ANSSI) Ideal Cipher from Public Permutations 8 / 38