2
$\begingroup$

The MEM-AEAD construction uses a 4-round Blake2b permutation in masked Even-Mansour mode as a (tweakable) block cipher.

4 rounds of the Blake2b permutation are already broken to my knowledge. Why are the designers justified in their choice?

$\endgroup$
  • 1
    $\begingroup$ for use in a hash function it would be broken, but for use in a block cipher environment it should be fine, NORX is also 4 rounds of essentially the same permutation. I do however prefer a keyed permutation in an XEX cipher $\endgroup$ – Richie Frame Apr 28 '16 at 10:28
  • $\begingroup$ @RichieFrame what about a reduced round Blake or Blake2b permutation with the data to be hashed as key? $\endgroup$ – Demi May 2 '16 at 15:25
2
$\begingroup$

4 rounds of Blake2b is essentially equivalent to 8 rounds of ChaCha in terms of complexity (a Blake2 round is close to a ChaCha double-round), and that has not yet been broken. Like Richie Frame wrote in a comment, NORX also claims to get away with 4 Blake2 rounds.

One reason ciphers get away with less is that in hash functions all inputs are known and (except for constants) under the attacker's control. In ciphers the key is secret and, unless you take into account related-key attacks and such, not under the attacker's control.

|improve this answer|||||
$\endgroup$
  • $\begingroup$ MEM is not a stream cipher, but an Even-Mansour block cipher $\endgroup$ – Demi Apr 28 '16 at 14:58
  • $\begingroup$ @Demetri, fixed, though the more interesting modes are. $\endgroup$ – otus Apr 28 '16 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.