[PDF] Top 20 Multi-Key Security: The Even-Mansour Construction Revisited

... the Even-Mansour block cipher avoids that round keys need to be precalculated and stored in memory, or that they need to be calculated ...the key schedule results in a higher key agility, ... See full document

... same construction lends itself to trivial distinguishing attacks, and one must consider alternatives if security in this model is ...the Even-Mansour construction was proved to be ... See full document

... Related-Key Security of XEX and TEM. XEX resists related-key attacks if the underlying blockcipher is sufficiently related-key ...if Even-Mansour is plugged into XEX, as is done ... See full document

... alternating key scheme which improve over exhaustive search by a significant ...mn-bit security can be achieved for n-bit iterated EM constructions with m independent keys? ... See full document

... as key exchange, public-key encryption and ...between security proofs for message authen- tication code in the single-user and in the multi-user ...the security proof for one user and ... See full document

... the key-schedule simply consists in xoring constants to the master key) in this ...Hence, construction (?) can be regarded as a “minimal” two-round Even-Mansour cipher delivering ... See full document

... Bob’s security to be ...the security game designed to capture query privacy in this setting [PZ13, ...every construction which realizes this syntax ...share key ∆ is generated. The share ... See full document

... TEM construction for any number r > 2 of rounds (a first, hopefully simpler step towards this goal would be to give a tight bound for the CLRW construction for r > ...iterated ... See full document

... Beware that several variations of this definition appear in the literature. Some- times Sign is allowed to maintain state, i.e., to output a new secret key that is then used as a replacement for the original ... See full document

... birthday-bound security for three rounds. In fact, the security of this construction caps at 2 n/2 queries independently of the number of ...iterated Even-Mansour cipher with the ... See full document

... RRA security), the simple randomized- encrypt-with-hash (REwH) scheme by Bellare et ...RRA security in the random oracle model (however, as will be explained below, this construction still suffers ... See full document

... information-theoretic security for symmetric-key en- cryption and key agreement protocols which are very fundamental primitives in ...information-theoretic security in various ways: some of ... See full document

... Evaluations. Even and Mansour [35, 36] proved that any attack on their construction requires about T block cipher evaluations and 2 n /D known ...a key recovery attack on the ... See full document

... of multi-user (mu) security, introduced by Biham [6] in symmetric cryptanalysis and by Bellare, Boldyreva, and Micali [3] in public-key cryptography, deals with such ...how security degrades ... See full document

... an Even-Mansour block cipher ...an Even- Mansour construction as a block cipher in otherwise secure modes of ...The Even-Mansour approach of creating a block cipher from a ... See full document

... This construction has also been shown to be (fully) indifferentiable from an ideal cipher for a sufficient number of rounds (five or twelve depending on the assumptions on the ...iterated ... See full document

... EM construction is indifferentiable from the ideal cipher when a single key is used throughout the ...in multi-stage settings and go on to note that the RKA game is ...the construction only, ... See full document

... tweakable Even-Mansour cipher with (ϵ, δ)-RKA-AXU-hash functions is related-key-secure up to D(D − 1)ϵ + 2DT δ queries, where D is the complexity of construction queries (data complexity) and ... See full document

... the multi-key setting is more close to practice than the broadcast and multi- user setting (also than the usual single-key/related key ...that even for a single user, she may ... See full document

... Historically, since the 1990s, the small private exponents had paid attention on RSA key generation. Wiener (1990) particularly introduced an attack on small private exponents. In the analysis of small private ... See full document