# Upper bound of this derivative of counter mode?

Suppose that:

• $\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$.
• $\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$.
• $\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$.
• $\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$.
• $E(K, X): \boldsymbol{K} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
• $D(K, X): \boldsymbol{K} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
• $E$ and $D$ are the encryption and decryption functions of a secure block cipher.
• $\widetilde{E}(K, IV, X): \boldsymbol{K} \times \boldsymbol{IV} \times \boldsymbol{I} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
• $\widetilde{D}(K, IV, I, X): \boldsymbol{K} \times \boldsymbol{IV} \times \boldsymbol{I} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
• $\widetilde{E}(K, IV, I, X) = \widetilde{D}(K, IV, I, X) = E(E(E(K, IV), \lfloor I \div 2^{0.5 \times \ell_{I}} \rfloor), I) \oplus X$.
• $CT_{i} = \widetilde{E}(K, IV, i, PT_{i})$.
• $PT_{i} = \widetilde{E}(K, IV, i, CT_{i})$.

The birthday bound applies to counter mode, so the maximum number of blocks that can be safely encrypted using it is $2^{n}$ where $n$ is the block size in bits of the cipher that is used. The scheme above presents a modification to counter mode that uses several block cipher calls. The key used to encrypt the counter is regenerated from the upper half of the counter every time $2^{0.5 \times \ell_{I}}$ blocks have been encipher/deciphered. What is the security bound of this mode. My intuition tells me it is $2^{\ell_{X}}$. Am I correct?

• First of all, the crypt-analysis of full cipher designs is considered off topic. But if you're going to describe such a mode, you should descrie it well. I presume that $l_{IV}$ is the same as $b$, the block size. I don't see precisely how $l_I$ can be $l_X \over b$ in your scheme, but I presume it is. The concatenation of blocks is entirely missing. As it is curretly written I don't see how an answer can be composed without guesswork. – Maarten Bodewes Dec 11 '17 at 22:46