4

Wikipedia claims that given an unkeyed permutation $p$ (presumably of the same size as the key) this is safe: $p(m \oplus k) \oplus k$ Why isn't this construction used instead of XEX? Surely unkeyed permutations should be faster than keyed ones since they do not have a key schedule, is there some issue not mentioned by the wikipedia page?

It also raises the question, given a block cipher $e$, would $e_{k_1}(m \oplus k_2)$ (without the outer xor) be safe? My interest is specifically about full-disk encryption.

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
Bob Semple
  • 143
  • 4

1 Answers1

4

Why isn't this construction used instead of XEX?

Because XEX takes a block cipher and constructs a tweakable block cipher out of it, whereas this construction, usually called Even-Mansour, takes a permutation and constructs a block cipher out of it.

Surely unkeyed permutations should be faster than keyed ones since they do not have a key schedule, is there some issue not mentioned by the wikipedia page?

This is a difficult question. This is because security models are way harder to construct for unkeyed permutations than for keyed ones - because you don't have a knowledge advantage over the adversary. Because of this lack of an advantage, public permutations tend to be slower in fact, e.g. the fastest one I know is Gimli which is still beaten by AES. Also note that the key-schedule is a one time cost and usually can be amortized quite well if you don't change the key often - which normally you don't do.

In fact this speed disadvantage is theoretically expected given that we can construct block ciphers from the most minimal cryptographic primitive - One Way Functions but cannot construct collision-resistant hash functions froms them which we can from publicly secure permutations. So there's something "intrinsic" that makes public permutations a stronger tool than block ciphers and this usually mean we have to do more computational work to construct it.

It also raises the question, given a block cipher e, would ek1(m⊕k2) (without the outer xor) be safe?

Yes, it would yield another block cipher (a PRP assuming the block cipher is a PRP itself) with a longer key. Though note that it does not yield a SPRP (a PRP where the inverse is also a PRP). If you were to take the $k_2$ as a tweak, I don't think this would yield a (strong) tweakable block cipher unlike XEX due to a lack of preprocessing of the tweak which may be non-random.

SEJPM
  • 46,697
  • 9
  • 103
  • 214