Tight Security Bounds for Key-Alternating Ciphers

A t-round key-alternating cipher (also called iterated Even-Mansour cipher) can be viewed as an abstraction of AES. It defines a cipher E from t fixed public permutations P 1,..., P t : {0,1} n → {0,1} n and a key k = k 0 ∥ ... ∥ k t ∈ {0,1} n(t + 1) by setting E k (x) = k t ⊕ P t (k t − 1 ⊕ P t − 1( ⋯ k 1 ⊕ P 1(k 0 ⊕ x) ⋯ )). The indistinguishability of E k from a truly random permutation by an adversary who also has oracle access to the (public) random permutations P 1, …, P t was investigated in 1997 by Even and Mansour for t = 1 and for higher values of t in a series of recent papers. For t = 1, Even and Mansour proved indistinguishability security up to 2 n/2 queries, which is tight. Much later Bogdanov et al. (2011) conjectured that security should be \(2^{\frac{t}{t+1}n}\) queries for general t, which matches an easy distinguishing attack (so security cannot be more). A number of partial results have been obtained supporting this conjecture, besides Even and Mansour’s original result for t = 1: Bogdanov et al. proved security of \(2^{\frac{2}{3}n}\) for t ≥ 2, Steinberger (2012) proved security of \(2^{\frac{3}{4}n}\) for t ≥ 3, and Lampe, Patarin and Seurin (2012) proved security of \(2^{\frac{t}{t+2}n}\) for all even values of t, thus “barely” falling short of the desired \(2^{\frac{t}{t+1}n}\).