7
$\begingroup$

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical.

Is there a generic method of combining two blocks together in such a way that two 64 bit blocks can be seen as one 128 block? Is there an efficient method that could be used for CTR mode of operation (the underlying primitive for most popular AEAD ciphers)?

Improve this question
$\endgroup$
1
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$
    – mikeazo
    Commented Jun 20, 2015 at 17:01

2 Answers 2

Reset to default
6
$\begingroup$

There are two well-known Encryption modes, that can construct a $mn$-bit tweakable blockciphers from a $n$-bit blockcipher ($n=64$ for DES) with $1\le m\le n$.

The older one is CMC, being not parallelizable.
It was superseeded by Encrypt-Mix-Encrypt (EME), which is parallelizable.
The basic idea of the two algorithms is to encrypt each block of input data once, then perform a nonlinear transformation on the resulting bits and feed those into the second round of blockcipher calls. This is neccessary as otherwise attacks on the schemes would be possible. For the stong linking of the two input and output blocks, double encryption can't be avoided.

As EME requires $2m+1$ blockcipher calls, in your case $m=2$, $5$ calls to DES are neccessary for each block of data.

As DES is slow compared to AES, using AES for 128-bit modes and Threefish for larger modes is preferrable.

Besides the performance issues with EME ($>2$ times the work) there also seem to be patent issues with EME.

Improve this answer
$\endgroup$
1
  • $\begingroup$ I believe the patent issues have been resolved (the patent for EME2 was abandoned). $\endgroup$
    – forest
    Commented Mar 7, 2018 at 7:27
4
$\begingroup$

In addition to the tweakable enciphering schemes in the comments, I'll leave this reference here: https://eprint.iacr.org/2009/356.pdf

It essentially shows (in the ideal cipher model) that using an n-bit block cipher in a three-round Feistel construction gives you a 2n-bit block cipher.

Improve this answer
$\endgroup$
3
  • 2
    $\begingroup$ The same paper shows that you can construct a 2n-bit TBC out of an n-bit TBC using two rounds, which might be the answer @Maarten_Bodewes is looking for (since a TBC can be used as a traidtional blockcipher). So that works out to be two blockcipher calls plus two 64-bit finite field operations (assuming LRW) or four blockcipher calls (assuming XEX). $\endgroup$
    – Seth
    Commented Jun 19, 2015 at 21:47
  • $\begingroup$ @Seth Do I read this correctly? Could I do with a 2 round Feistel network to achieve a doubling of the block size, with the restriction that I should not use the block cipher for anything else? $\endgroup$
    – Maarten Bodewes ♦
    Commented Jun 20, 2015 at 0:46
  • $\begingroup$ Almost. It's a Feistel network, except that you encrypt the left half with the right half as the tweak, instead of using a PRF-then-XOR approach. See the left side of Figure 5 of the linked PDF (pg 11). You'll only get a q^2/2^64 security bound, though. (If you were to start with a TBC that had beyond-birthday-bound security, you could instead use a three-round Feistel construction to avoid this problem. But this would probably be far too slow). $\endgroup$
    – Seth
    Commented Jun 21, 2015 at 0:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.