Length-doubling ciphers and tweakable ciphers

Abstract

We motivate and describe a mode of operation HEM (resp., THEM) that turns a n-bit blockcipher into a variable-input-length cipher (resp., tweakable cipher) that acts on strings of [n..2n - 1] bits. Both HEM and THEM are simple and intuitive and use only two blockcipher calls, while prior work at least takes three. We prove them secure in the sense of strong PRP and tweakable strong PRP, assuming the underlying blockcipher is a strong PRP. © 2012 Springer-Verlag.