Tweakable block ciphers secure beyond the birthday bound in the ideal cipher model

Abstract

We propose a new construction of tweakable block ciphers from standard block ciphers. Our construction, dubbed XHX2, is the cascade of two independent XHX block ciphers, so it makes two calls to the underlying block cipher using tweak-dependent keys. We prove the security of XHX2 up to min($2^{2(n+m)/3},2^{n+m/2}$) queries (ignoring logarithmic factors) in the ideal cipher model, when the block cipher operates on n-bit blocks using m-bit keys. The XHX2 tweakable block cipher is the first construction that achieves beyond-birthday-bound security with respect to the input size of the underlying block cipher in the ideal cipher model.