An improved security bound for HCTR

Abstract

HCTR was proposed by Wang, Feng and Wu in 2005. It is a mode of operation which provides a tweakable strong pseudorandom permutation. Though HCTR is quite an efficient mode, the authors showed a cubic security bound for HCTR which makes it unsuitable for applications where tweakable strong pseudorandom permutations are required. In this paper we show that HCTR has a better security bound than what the authors showed. We prove that the distinguishing advantage of an adversary in distinguishing HCTR and its inverse from a random permutation and its inverse is bounded above by 4.5 σ 2/2 n , where n is the block-length of the block-cipher and σ is the number of n-block queries made by the adversary (including the tweak). © 2008 Springer-Verlag Berlin Heidelberg.