Characterization of EME with Linear Mixing
- 605 Downloads
EME is a SPRP or strong pseudorandom permutation construction which uses a nonlinear mixing in between two encryption layers. The designers of EME have shown that the construction is not SPRP secure if the mixing layer of EME is replaced by any linear mixing over a binary field. In this paper, we complete their observation by showing SPRP-insecurity even if we have linear mixing over any non-binary prime field. We have some positive result that PRP (pseudorandom permutation) and online PRP security can be achieved for certain types of linear mixing functions. In fact, we fully characterize all those linear mixing for which (online) PRP security is achieved and demonstrate attacks for all other linear mixing functions.
KeywordsEME SPRP (online) PRP Distinguishing Attack
Unable to display preview. Download preview PDF.
- 1.– (no editor): CAESAR: Competition for Authenticated Encryption: Security, Applicability, and Robustness, http://competitions.cr.yp.to/caesar.html. Citations here: §1.3
- 4.Bernstein, D.J.: A short proof of the unpredictability of cipher block chaining (2005), http://cr.yp.to/papers.html#easycbc. Citations here: §2.3
- 7.Datta, N., Nandi, M.: Misuse Resistant Parallel Authenticated Encryptions. To be published in ACISP 2014 (2013), http://eprint.iacr.org/2013/767. Citations here: §1.3, §3
- 13.Luby, M., Racko, C.: How to construct pseudorandom permutations from pseudorandom functions. SIAM Journal of Computing, 373–386 (1988). Citations here: §1.1Google Scholar
- 14.McGrew, D., Fluhrer, S.: The Extended Codebook (XCB) Mode of Operation (2004), http://eprint.iacr.org/2004/278. Citations here: §1
- 16.Nandi, M.: An Efficient SPRP-secure Construction based on Pseudo Random Involution (2008), http://eprint.iacr.org/2008/092. Citations here: §1
- 17.Naor, M., Reingold, O.: On the construction of pseudorandom permutations: Luby-Racko revisited. Journal of Cryptology, 29–66 (1999). Citations here: §1Google Scholar
- 20.Vaudenay, S.: Decorrelation: A Theory for Block Cipher Security. Journal of Cryptology, 249–286 (2003)Google Scholar