How to Enrich the Message Space of a Cipher

Abstract. Given (deterministic) ciphers E and E that can encipher messages of l and n bits, respectively, we construct a cipher E∗ = XLS[E, E] that can encipher messages of l + s bits for any s < n. Enciphering such a string will take one call to E and two calls to E. We prove that E∗ is a strong pseudorandom permutation as long as E and E are. Our construction works even in the tweakable and VIL (variable-input-length) settings. It makes use of a multipermutation (a pair of orthogonal Latin squares), a combinatorial object not previously used to get a provablesecurity result. Key words: Deterministic encryption, enciphering scheme, symmetric encryption, length-preserving encryption, multipermutation.

• Type: Conference
• Year: 2007
• Where: FSE
• Authors: Thomas Ristenpart, Phillip Rogaway
• Keywords: Cipher, Cipher E∗, Cryptography, FSE 2007, Strong Pseudorandom Permutation