How to enrich the message space of a cipher

Abstract

Given (deterministic) ciphers ε and E that can encipher messages of l and n bits, respectively, we construct a cipher ε* = XLS[ε, E] that can encipher messages of l + s bits for any s < n. Enciphering such a string will take one call to ε and two calls to E. We prove that ε* is a strong pseudorandom permutation as long as ε and E are. Our construction works even in the tweakable and VIL (variable-input-length) settings. It makes use of a multipermutation (a pair of orthogonal Latin squares), a combinatorial object not previously used to get a provable-security result. © International Association for Cryptologic Research 2007.