Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
There was some article published by on the IACR's website that outlined a block cipher that only used the "master" key and no round keys. I can't recall the cipher's name, not that it matters, nor do I know if it had been subjected to cryptanalysis.
If one has a block cipher that has an $n$-bit key and an $n$-bit block size, what would be some ways that a secure one could be made that does not use key expansion?
The Even-Mansour construction gives you a block cipher from public, unkeyed permutations $P_1, \ldots, P_n$. It works like:
$$ x \mapsto \cdots P_2(P_1(x \oplus k_0) \oplus k_1) \cdots \oplus k_n $$
In original/traditional Even-Mansour, the round keys $k_i$ are independent. But recently there have been many papers studying the security of various "minimalistic" variants of Even-Mansour (basically any variant where the round keys are not independent).
The most minimal variant uses a "trivial key schedule" where $k_0 = k_1 = \cdots = k_n$. This variant naturally leads to a cipher that has no need for key expansion (key size is naturally equal to the block size). The following recent paper shows the security of 5-round Even-Mansour with trivial key schedule:
Yuanxi Dai, Yannick Seurin, John Steinberger, Aishwarya Thiruvengadam: Indifferentiability of Iterated Even-Mansour Ciphers with Non-Idealized Key-Schedules: Five Rounds are Necessary and Sufficient, Crypto 2017
