How to Construct an Ideal Cipher from a Small Set of Public Permutations

  • Rodolphe Lampe
  • Yannick Seurin
Conference paper

DOI: 10.1007/978-3-642-42033-7_23

Part of the Lecture Notes in Computer Science book series (LNCS, volume 8269)
Cite this paper as:
Lampe R., Seurin Y. (2013) How to Construct an Ideal Cipher from a Small Set of Public Permutations. In: Sako K., Sarkar P. (eds) Advances in Cryptology - ASIACRYPT 2013. ASIACRYPT 2013. Lecture Notes in Computer Science, vol 8269. Springer, Berlin, Heidelberg


We show how to construct an ideal cipher with n-bit blocks and n-bit keys (i.e. a set of 2n public n-bit permutations) from a small constant number of n-bit random public permutations. The construction that we consider is the single-key iterated Even-Mansour cipher, which encrypts a plaintext x ∈ {0,1}n under a key k ∈ {0,1}n by alternatively xoring the key k and applying independent random public n-bit permutations P1,…, Pr (this construction is also named a key-alternating cipher). We analyze this construction in the plain indifferentiability framework of Maurer, Renner, and Holenstein (TCC 2004), and show that twelve rounds are sufficient to achieve indifferentiability from an ideal cipher. We also show that four rounds are necessary by exhibiting attacks for three rounds or less.


block cipher ideal cipher iterated Even-Mansour cipher key-alternating cipher indifferentiability 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Rodolphe Lampe
    • 1
  • Yannick Seurin
    • 2
  1. 1.University of VersaillesFrance
  2. 2.ANSSIParisFrance

Personalised recommendations