How secure is half-key Even-Mansour?

Single-key Even-Mansour is secure up to $$2^{0.5 \times n}$$. Where $$n$$ is permutation and key size.

Would using $$n/2$$-key retain same security as $$n$$-key?

Could the other half be used as a tweak?

• It is more or less what ChaCha20 does, half the state is the key and the other half is the tweak. What's being encrypted in the EM model just happens to be all zeroes. Commented Oct 14, 2023 at 15:42
• @LightTunnelEnd But ChaCha does not take any plaintext as input to permutation. So it is not exactly the same. Commented Oct 14, 2023 at 16:40
• Technically, the plaintext is the constants, nonce and counter. Or the plaintext is empty and they are the tweak. It's the same. ChaCha can be viewed a block cipher with half-EM used in CTR mode. Commented Oct 14, 2023 at 16:46
• @LightTunnelEnd But in ChaCha they never overlap. Every input has it own space. In classical Even-Mansour attacker can abuse the fact key and plaintext overlap and change input to permutation. Commented Oct 14, 2023 at 17:12

The security of Even-Mansour is actually given by $$\mathbf{Adv}^{\mathrm{SPRP}}_{EM}(\mathcal{D}) \le \frac{2 q_e q_p}{2^k}\,,$$ where $$q_e$$ is the number of encryption queries $$((m_1, c_1), \dots, (m_{q_e}, c_{q_e}))$$, $$q_p$$ the number of permutation queries $$((x_1, y_1), \dots, (x_{q_p}, y_{q_p}))$$, and $$k$$ the key size in bits.
To see this, note that the "bad event" to bound the probability of in this scheme is whether $$m_i \oplus k = x_j$$ or $$c_i \oplus k = y_j$$ for some $$i$$ and $$j$$. If the key is shorter than the block the attacker can fix both encryption and primitive queries to be equal in the parts not affected by the key, and the collision probability is then only dependent on the key size.