5
$\begingroup$

I've read that we can study the security of modes of operation by assuming the use of an ideal block cipher. I've also seen a paper suggesting that the ideal cipher model could be something else than an ideal block cipher.

Are there protocols relying on an encryption mode and whose the proofs have been done by assuming that this encryption mode is ideal, that is, we don't consider an ideal block cipher, but rather an ideal encryption scheme ?

Finally, what could be an ideal cipher with respect to an encryption scheme ? For a block cipher, this is a random permutation (we have an elf wich fills a table step by step to describe this random permutation). What would this elf do in the case of an ideal encryption scheme ?

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ An ideal encryption scheme is an encryption scheme which is assumed to meet the security properties the scheme strives to fulfill. This is less concrete than an imaginary elf performing tasks, and depends on what the encryption scheme is. Let's take the CTR mode of operation, for instance, which is built on top of a block cipher. A security property of this scheme could be "given any reasonable number of plaintext/ciphertext pairs encrypted with the same key, an observer cannot recover the key" or something along those lines. $\endgroup$
    – Thomas
    Commented Jun 8, 2013 at 13:40
  • 2
    $\begingroup$ Also, cryptography is usually designed bottom-up. Encryption schemes generally assume ideal underlying primitives will lead to all security properties being achieved, in other words, schemes and protocols are firmly grounded in theory (within the framework of some cryptographic model, here the ideal cipher model). It is when you instantiate those protocols with actual, imperfect block ciphers/hash functions that you leave the realm of theoretical cryptography and hope your primitives are "ideal enough" to be secure with respect to your adversary. $\endgroup$
    – Thomas
    Commented Jun 8, 2013 at 13:43
  • $\begingroup$ Your characterization of an ideal block cipher in the last paragraph is a bit off --- an ideal block cipher is a set of random permutations, one for each possible key. So the elf would have a set of tables. $\endgroup$
    – Seth
    Commented Jun 8, 2013 at 19:29
  • $\begingroup$ @Thomas : $\;\;$ There are also $\:(t,\hspace{-0.02 in}\epsilon)$-PRPs$\:$ and constructive reductions. $\hspace{1.55 in}$ $\endgroup$
    – user991
    Commented Jun 8, 2013 at 20:37
  • $\begingroup$ @Seth : $\:$ Technically it would be a list of tables. $\;\;\;$ $\endgroup$
    – user991
    Commented Jun 8, 2013 at 20:38

1 Answer 1

Reset to default
4
$\begingroup$

The ideal cipher model is a way of modeling of block cipher (i.e. a keyed permutation family) which is very close to the modelization of a hash function by a random oracle. In fact, these two models are even equivalent (see http://arxiv.org/abs/1011.1264).

Recall that a random oracle is a "magic box" with for any new input outputs a purely random value (for repeated inputs, the oracle just repeats itself). A ideal cipher behave similarly given a new input pair (K,x), the ideal cipher outputs a random value y, with a small caveat: instead of being chosen at random for a fixed set, y is chosen among the values which have not yet been used for the key K.

Ideal ciphers can appear in security proofs to show that a mode of operation is secure with a "perfect" blockcipher. In particular, when working in the ideal cipher model, you implicitely assume that your blockcipher is secure against related-key attacks.

However, as with the random oracle model, it is possible to construct cryptographic primitives (albeit artificial ones), which are secure in the ideal cipher model and insecure when instantiated with any real blockcipher. For this reason, proofs in the regular security model (where the blockcipher keyed with a random key is indistinguishable from a random permutation) are considered to be much more representative of real-life security.

If you are interested by proofs in the ideal models (RO or ideal cipher), look for papers about indifferentiability.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.