Relaxing full-codebook security: A refined analysis of key-length extension schemes

Abstract

We revisit the security (as a pseudorandom permutation) of cascading-based constructions for block-cipher key-length extension. Previous works typically considered the extreme case where the adversary is given the entire codebook of the construction, the only complexity measure being the number qe of queries to the underlying ideal block cipher, representing adversary’s secret-key-independent computation. Here, we initiate a systematic study of the more natural case of an adversary restricted to adaptively learning a number qc of plaintext/ciphertext pairs that is less than the entire codebook. For any such qc, we aim to determine the highest number of block-cipher queries qe the adversary can issue without being able to successfully distinguish the construction (under a secret key) from a random permutation. More concretely, we show the following results for key-length extension schemes using a block cipher with n-bit blocks and κ-bit keys: – Plain cascades of length ℓ = 2r+1 are secure whenever qcqre ≪ 2r(κ+n), qc ≪ 2κ and qe ≪ 22κ. The bound for r = 1 also applies to two-key triple encryption (as used within Triple DES). – The r-round XOR-cascade is secure as long as qcqre ≪ 2r(κ+n), matching an attack by Gaži (CRYPTO 2013). – We fully characterize the security of Ga ži and Tessaro’s two-call 2XOR construction (EUROCRYPT 2012) for all values of qc, and note that the addition of a third whitening step strictly increases security for 2n/4 ≤ qc ≤ 23/4n. We also propose a variant of this construction without re-keying and achieving comparable security levels.