1
$\begingroup$

A user of this forum answered in one of my questions and said that if the IV is kept secret in multiple encryption with CTR mode, the cost of breaking the scheme is $${2^{2 l_{key}}} 2 \cdot {2^{l_{iv}}}$$

Can the encryption operation in multiple-encryption with CTR mode be replaced by a non-cryptographic operation assuming the IV is kept secret?

I'm questioning this because I took a look in the Even–Mansour scheme and could see that the encryption operation can be replaced by a publicly known unkeyed permutation.

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Two remarks: Even-Mansour doesn't use an IV, so it is not secure as a normal cipher: identical plaintext blocks will end up as identical ciphertext unless the key is updated. Furthermore, the XOR with a key is basically working as a one time pad. Without a key, CTR mode is not even a cipher, as the block cipher is the only location where the key is actually used. $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 3, 2022 at 14:57

1 Answer 1

Reset to default
4
$\begingroup$

by a publicly known permutation...

No, that'd be a bad idea. Consider if the attacker received the two-block message:

$$M_0 \oplus \text{Perm}( IV ), M_1 \oplus \text{Perm}( IV+1 )$$

and also happened to know (or guess) $M_0$ (partial known plaintext). Then, he could recover $\text{Perm}(IV)$, and then invert the permutation to recover $IV$

Even-Mansour avoids this issue by adding an xor of secret data after the permutation...

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ True in the cases likely under consideration, but there are examples of permutations that are not easy to invert. e.g. RSA permutes residues mod $N$ and modular exponentiation mod $p$ permutes 1,…, $p-1$ $\endgroup$
    – Daniel S
    Commented Dec 3, 2022 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.