Encrypted davies-meyer and its dual: Towards optimal security using mirror theory

Abstract

At CRYPTO 2016, Cogliati and Seurin introduced the Encrypted Davies-Meyer construction, p2(p1(x)⊕x) for two n-bit permutations p1,p2, and proved security up to 22n/3. We present an improved security analysis up to 2n/(67n). Additionally, we introduce the dual of the Encrypted Davies-Meyer construction, p2(p1(x)) ⊕ p1(x), and prove even tighter security for this construction: 2n/67. We finally demonstrate that the analysis neatly generalizes to prove almost optimal security of the Encrypted Wegman-Carter with Davies-Meyer MAC construction. Central to our analysis is a modernization of Patarin’s mirror theorem and an exposition of how it relates to fundamental cryptographic problems.