Block Ciphers and Tweakable Block Ciphers Sample Clauses

Block Ciphers and Tweakable Block Ciphers. A block cipher with key size κ and state size n is a function E ∈ iperm(κ, n). For fixed key k ∈ {0, 1}κ we denote Ek(·) = E(k, ·), and its inverse is denoted ˜ x x ˜ ˜ ˜ · · · E−1(·). A tweakable block cipher with key size κ, tweak size τ , and state size n is a function E ∈ iperm(κ, τ, n). For fixed key k ∈ {0, 1}n and t ∈ {0, 1}1 we denote Ek(t, )= E(k, t, ), and its inverse is denoted E−1(t, ). ∈ ∈ Let κ, n N and let E iperm(κ, n) be a block cipher. The advantage of a distinguisher in breaking the SPRP (strong pseudorandom permutation) security of E is defined as E Advsprp(D)= Pr DEk± = 1 − Pr Dp± = 1 , (3) $ $ where the probabilities are taken over the random drawing of k ←− {0, 1}n, ←− D D p perm(n), and the randomness used by . The resources that may use are typically expressed in terms of query complexity (to the oracle) and time complexity (for offline computations). ˜ As block ciphers are a special case of tweakable block ciphers with tweak space of size 1 (τ = 0), the security definition straightforwardly generalizes to the latter. Let κ, τ, n ∈ N and let E ∈ iperm(κ, τ, n) be a tweakable block cipher. The advantage of a distinguisher D in breaking the STPRP (strong tweakable pseudorandom permutation) security of E is defined as ˜E Advstprp(D)= Pr DE˜k± = 1 − Pr Dp˜± = 1 , (4) $ $ where the probabilities are taken over the random drawing of k ←− {0, 1}n, (τ, n), and the randomness used by D. The resources that D may use p˜ ←− iperm‌ are typically bounded as before.