Forking tweakable Even-Mansour ciphers

Abstract

A forkcipher is a keyed, tweakable function mapping an $n$-bit input to a $2n$-bit output, which is equivalent to concatenating two outputs from two permutations. A forkcipher can be a useful primitive to design authenticated encryption schemes for short messages. A forkcpher is typically designed within the iterate-fork-iterate(IFI) paradigm, while the provable security of such a construction has not been widely explored.

In this paper, we propose a method of constructing a forkcipher using public permutations as its building primitives. It can be seen as applying the IFI approach to the tweakable Even-Mansour ciphers. So our construction is dubbed the forked tweakable Even-Mansour(FTEM) cipher. Our main result is to prove that a (1,1)-round FTEM cipher (applying a single-round TEM to a plaintext, followed by two independent copies of a single-round TEM) is secure up to $2^{{2n}/{3}}$ queries in the indistinguishability framework.