## Abstract

The Advanced Encryption Standard (AES) is the most widely used block cipher. The high level structure of AES can be viewed as a (10-round) key-alternating cipher, where a t-round key-alternating cipher KA_{t} consists of a small number t of fixed permutations P_{i} on n bits, separated by key addition: KA_{t}(K, m) = k_{t} ⊕ P _{t}(...k_{2} ⊕ P_{2}(k_{1} ⊕ P _{1}(k_{0} ⊕ m))...), where, (k_{0}..., k _{t}) are obtained from the master key K using some key derivation function. For t = 1, KA_{1} collapses to the well-known Even-Mansour cipher, which is known to be indistinguishable from a (secret) random permutation, if P_{1} is modeled as a (public) random permutation. In this work we seek for stronger security of key-alternating ciphers - indifferentiability from an ideal cipher - and ask the question under which conditions on the key derivation function and for how many rounds t is the key-alternating cipher KA_{t} indifferentiable from the ideal cipher, assuming P_{1},...,P_{t} are (public) random permutations? As our main result, we give an affirmative answer for t = 5, showing that the 5-round key-alternating cipher KA_{5} is indifferentiable from an ideal cipher, assuming P_{1},...,P_{5} are five independent random permutations, and the key derivation function sets all rounds keys k_{i} = f(K), where 0 ≤ i ≤ 5 and f is modeled as a random oracle. Moreover, when |K| = |m|, we show we can set f(K) = P_{0}(K)⊕K, giving an n-bit block cipher with an n-bit key, making only six calls to n-bit permutations P_{0},P_{1},P_{2},P_{3},P _{4},P_{5}.

Original language | English (US) |
---|---|

Title of host publication | Advances in Cryptology, CRYPTO 2013 - 33rd Annual Cryptology Conference, Proceedings |

Pages | 531-550 |

Number of pages | 20 |

Edition | PART 1 |

DOIs | |

State | Published - 2013 |

Event | 33rd Annual International Cryptology Conference, CRYPTO 2013 - Santa Barbara, CA, United States Duration: Aug 18 2013 → Aug 22 2013 |

### Publication series

Name | Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) |
---|---|

Number | PART 1 |

Volume | 8042 LNCS |

ISSN (Print) | 0302-9743 |

ISSN (Electronic) | 1611-3349 |

### Other

Other | 33rd Annual International Cryptology Conference, CRYPTO 2013 |
---|---|

Country/Territory | United States |

City | Santa Barbara, CA |

Period | 8/18/13 → 8/22/13 |

## Keywords

- Even-Mansour
- ideal cipher
- indifferentiability
- key-alternating cipher

## ASJC Scopus subject areas

- Theoretical Computer Science
- General Computer Science