Tag Info

Yes, but. While EME is a secure block cipher, its security is not as good as a regular block cipher of that size would be. Theorem 1 of the linked paper shows that the adversary has an advantage after ~$2^{n/2}$ oracle queries, which is expected with an $n$-bit block cipher, rather than $2^{m/2}$ as we would desire for an $m$-bit wide block cipher. Since ...