What is the security of multiple encryption using Even–Mansour scheme (XEX)?

Question

As I know, the best attack on single or double Even-Mansour scheme is N/2, being N the key size (or size of one of the two keys used).

I know that encrypting two times using this scheme is susceptible to Meet-in-the middle attacks, but if encrypting three or more times, what security in bit I will get for each layer added?

I'm asking this because XORs will be applied multiple times in the encipherment, maybe the security estimation may diverge from a "normal" block cipher like AES used multiple times; and I want to create a simple block cipher for encrypting my stuff with multiple layers of XORs and pseudo-random permutations.

Answer 1

This is better known as iterated Even-mansour or key-alternating cipher. From Theorem 1 of Hoang-Tessaro we have $$ \mathrm{Adv}^{\pm\mathrm{prp}}_{\mathrm{KAC}[\pi,t]} \le \frac{4^tqp_1\cdots p_t}{2^{nt}}\,, $$ for $t$ iterations of Even-Mansour on an $n$-bit permutation, where $q$ are the online queries, and $p_i$ are the offline queries to each individual permutation. This roughly translates to security up to $O(2^{nt/(t+1)})$ queries.

But the above is for independent permutations at each iteration, which is the easier to analyze case. In reality you're gonna use the same permutation for each iteration, which is more complicated to analyze. Chen et al. do this analsis for the 2-iteration case and show that it still reaches security up to $O(2^{2n/3})$ queries. Wu et al. did the same for the 3-iteration, showing it is secure up to $O(2^{3n/4})$ queries.