Chosen-Key Secure Even-Mansour Cipher from a Single Permutation
Shanjie Xu, Qi Da, Chun Fen Guo · IACR Transactions on Symmetric Cryptology · 2023
At EUROCRYPT 2015, Cogliati and Seurin proved that the 4-round Iterated Even-Mansour (IEM) cipher with Independent random Permutations and no key schedule EMIP4(k, u) = k⊕p4 ( k⊕p3 ( k⊕p2 (k⊕p1 (k⊕u)))) is sequentially indifferentiable from an ideal cipher, which implies chosen-key security in the sense of correlation intractability. In practice, however, blockciphers such as the AES typically employ the same permutation at each round. To bridge the gap, we prove that the 4-round IEM cipher EMSP[φ]p4 (k, u) = k4⊕p (k3⊕p (k2⊕p(k1⊕p(k0⊕u)))), whose round keys ki = φi(k) are derived using an affine permutation φ : {0, 1}n → {0, 1}n with certain properties, is sequentially indifferentiable from an ideal cipher. The function φ can be a linear orthomorphism, or φ(k) := k≫a for some fixed integer a using cyclic shift. To our knowledge, this is the first indifferentiability-type result for blockciphers using identical round functions.