Characterization of EME with linear mixing

Abstract

EME is a SPRP or strong pseudorandom permutation construction which uses a nonlinear mixing in between two encryption layers. The designers of EME have shown that the construction is not SPRP secure if the mixing layer of EME is replaced by any linear mixing over a binary field. In this paper, we complete their observation by showing SPRP-insecurity even if we have linear mixing over any non-binary prime field. We have some positive result that PRP (pseudorandom permutation) and online PRP security can be achieved for certain types of linear mixing functions. In fact, we fully characterize all those linear mixing for which (online) PRP security is achieved and demonstrate attacks for all other linear mixing functions. © 2014 Springer International Publishing.