Abstract

In [1] a construction of a block cipher from a single pseudorandom permutation is proposed. In a complexity theoretical setting they prove that this scheme is secure against a polynomially bounded adversary. In this paper it is shown that this construction suffers from severe limitations that are immediately apparent if differential cryptanalysis [3] is performed. The fact that these limitations do not contradict the theoretical results obtained in [1] leads the authors to question the relevance of computational complexity theory in practical conventional cryptography. 1 Introduction The Even-Mansour construction is a block cipher. Let n be the blocklength. The cipher makes use of a publicly known permutation F where it is easy to compute F (X) and F \Gamma1 (X) for any given input X 2 f0; 1g n . The key consists of two n-bit subkeys K 1 and K 2 . The relation between a message M and its ciphertext C is given by C \Phi K 2 = F (M \Phi K 1 ). This is illustrated in figure 1. Trad...

Citations