On the Optimality of Non-Linear Computations of Length-Preserving Encryption Schemes

Abstract. It is well known that three and four rounds of balanced Feistel cipher or Luby-Rackoff (LR) encryption for two blocks messages are pseudorandom permutation (PRP) and strong pseudorandom permutation (SPRP) respectively. A block is n-bit long for some positive integer n and a (possibly keyed) block-function is a nonlinear function mapping all blocks to themselves, e.g. blockcipher. XLS (eXtended Latin Square) encryption defined over two block inputs with three blockcipher calls was claimed to be SPRP. However, later Nandi showed that it is not a SPRP. Motivating with these observations, we consider the following questions in this paper: What is the minimum number of invocations of block-functions required to achieve PRP or SPRP security over blocks inputs? To answer this question, we consider all those length-preserving encryption schemes, called linear encryption mode, for which only nonlinear operations are block-functions. Here, we prove the following results for these enc...

• Type: Journal
• Year: 2015
• Where: ASIACRYPT
• Authors: Mridul Nandi
• Keywords: ASIACRYPT 2015, Cryptology