On the Indifferentiability of Key-Alternating Ciphers

Abstract

The Advanced Encryption Standard (AES) is the most widely used block cipher. The high level structure of AES can be viewed as a (10-round) key-alternating cipher, where a t-round key-alternating cipher KA _t consists of a small number t of fixed permutations P _i on n bits, separated by key addition:

$$ \text{KA}_t(K,m)= k_t\oplus P_t(\dots k_2\oplus P_2(k_1\oplus P_1(k_0 \oplus m))\dots), $$

where (k₀,…,k _t ) are obtained from the master key K using some key derivation function.

For t = 1, KA₁ collapses to the well-known Even-Mansour cipher, which is known to be indistinguishable from a (secret) random permutation, if P₁ is modeled as a (public) random permutation. In this work we seek for stronger security of key-alternating ciphers — indifferentiability from an ideal cipher — and ask the question under which conditions on the key derivation function and for how many rounds t is the key-alternating cipher KA _t indifferentiable from the ideal cipher, assuming P₁,…,P _t are (public) random permutations?

As our main result, we give an affirmative answer for t = 5, showing that the 5-round key-alternating cipher KA₅ is indifferentiable from an ideal cipher, assuming P₁,…,P₅ are five independent random permutations, and the key derivation function sets all rounds keys k _i  = f(K), where 0 ≤ i ≤ 5 and f is modeled as a random oracle. Moreover, when |K| = |m|, we show we can set f(K) = P₀(K) ⊕ K, giving an n-bit block cipher with an n-bit key, making only six calls to n-bit permutations P₀,P₁,P₂,P₃,P₄,P₅.