Suppose that:

  • $\boldsymbol{K} \in \{0, 1\}^{\ell_{K}}$.
  • $\boldsymbol{IV} \in \{0, 1\}^{\ell_{IV}}$.
  • $\boldsymbol{I} \in \{0, 1\}^{\ell_{I}}$.
  • $\boldsymbol{X} \in \{0, 1\}^{\ell_{X}}$.
  • $E(K, X): \boldsymbol{K} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
  • $D(K, X): \boldsymbol{K} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
  • $E$ and $D$ are the encryption and decryption functions of a secure block cipher.
  • $\widetilde{E}(K, IV, X): \boldsymbol{K} \times \boldsymbol{IV} \times \boldsymbol{I} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
  • $\widetilde{D}(K, IV, I, X): \boldsymbol{K} \times \boldsymbol{IV} \times \boldsymbol{I} \times \boldsymbol{X} \rightarrow \boldsymbol{X}$.
  • $\widetilde{E}(K, IV, I, X) = \widetilde{D}(K, IV, I, X) = E(E(E(K, IV), \lfloor I \div 2^{0.5 \times \ell_{I}} \rfloor), I) \oplus X$.
  • $CT_{i} = \widetilde{E}(K, IV, i, PT_{i})$.
  • $PT_{i} = \widetilde{E}(K, IV, i, CT_{i})$.

The birthday bound applies to counter mode, so the maximum number of blocks that can be safely encrypted using it is $2^{n}$ where $n$ is the block size in bits of the cipher that is used. The scheme above presents a modification to counter mode that uses several block cipher calls. The key used to encrypt the counter is regenerated from the upper half of the counter every time $2^{0.5 \times \ell_{I}}$ blocks have been encipher/deciphered. What is the security bound of this mode. My intuition tells me it is $2^{\ell_{X}}$. Am I correct?

  • $\begingroup$ First of all, the crypt-analysis of full cipher designs is considered off topic. But if you're going to describe such a mode, you should descrie it well. I presume that $l_{IV}$ is the same as $b$, the block size. I don't see precisely how $l_I$ can be $l_X \over b$ in your scheme, but I presume it is. The concatenation of blocks is entirely missing. As it is curretly written I don't see how an answer can be composed without guesswork. $\endgroup$ – Maarten Bodewes Dec 11 '17 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.