There was some article published by on the IACR's website that outlined a block cipher that only used the "master" key and no round keys. I can't recall the cipher's name, not that it matters, nor do I know if it had been subjected to cryptanalysis.

If one has a block cipher that has an $n$-bit key and an $n$-bit block size, what would be some ways that a secure one could be made that does not use key expansion?


1 Answer 1


The Even-Mansour construction gives you a block cipher from public, unkeyed permutations $P_1, \ldots, P_n$. It works like:

$$ x \mapsto \cdots P_2(P_1(x \oplus k_0) \oplus k_1) \cdots \oplus k_n $$

In original/traditional Even-Mansour, the round keys $k_i$ are independent. But recently there have been many papers studying the security of various "minimalistic" variants of Even-Mansour (basically any variant where the round keys are not independent).

The most minimal variant uses a "trivial key schedule" where $k_0 = k_1 = \cdots = k_n$. This variant naturally leads to a cipher that has no need for key expansion (key size is naturally equal to the block size). The following recent paper shows the security of 5-round Even-Mansour with trivial key schedule:

Yuanxi Dai, Yannick Seurin, John Steinberger, Aishwarya Thiruvengadam: Indifferentiability of Iterated Even-Mansour Ciphers with Non-Idealized Key-Schedules: Five Rounds are Necessary and Sufficient, Crypto 2017


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.