



01696nas a2200145   4500008004100000245005300041210005100094260001500145520127900160100001901439700001401458700001901472700002201491856003701513       2022                        eng d00aPost-Quantum Security of the Even-Mansour Cipher0 aPostQuantum Security of the EvenMansour Cipher  c12/14/20213 a<p>The Even-Mansour cipher is a simple method for constructing a (keyed) pseudorandom permutation E from a public random permutation~P:{0,1}n&rarr;{0,1}n. It is secure against classical attacks, with optimal attacks requiring qE queries to E and qP queries to P such that qE&sdot;qP&asymp;2n. If the attacker is given \emph{quantum} access to both E and P, however, the cipher is completely insecure, with attacks using qE,qP=O(n) queries known. In any plausible real-world setting, however, a quantum attacker would have only \emph{classical} access to the keyed permutation~E implemented by honest parties, even while retaining quantum access to~P. Attacks in this setting with qE&sdot;q2P&asymp;2n are known, showing that security degrades as compared to the purely classical case, but leaving open the question as to whether the Even-Mansour cipher can still be proven secure in this natural, &quot;post-quantum&quot; setting. We resolve this question, showing that any attack in that setting requires qE&sdot;q2P+qP&sdot;q2E&asymp;2n. Our results apply to both the two-key and single-key variants of Even-Mansour. Along the way, we establish several generalizations of results from prior work on quantum-query lower bounds that may be of independent interest.&nbsp;</p>1 aAlagic, Gorjan1 aBai, Chen1 aKatz, Jonathan1 aMajenz, Christian  uhttps://arxiv.org/abs/2112.0753001152nas a2200157   4500008004100000245007900041210006900120260001400189520065900203100001900862700001400881700001900895700002200914700002000936856003800956       2022                        eng d00aPost-Quantum Security of the (Tweakable) FX Construction, and Applications0 aPostQuantum Security of the Tweakable FX Construction and Applic  c8/29/20223 a<p>The FX construction provides a way to increase the effective key length of a block cipher E. We prove security of a tweakable version of the FX construction in the post-quantum setting, i.e., against a quantum attacker given only classical access to the secretly keyed construction while retaining quantum access to E, a setting that seems to be the most relevant one for real-world applications. We then use our results to prove post-quantum security&mdash;in the same model&mdash;of the (plain) FX construction, Elephant (a finalist of NIST&#39;s lightweight cryptography standardization effort), and Chaskey (an ISO-standardized lightweight MAC</p>1 aAlagic, Gorjan1 aBai, Chen1 aKatz, Jonathan1 aMajenz, Christian1 aStruck, Patrick  uhttps://eprint.iacr.org/2022/1097