An Extension of Cook's Elastic Cipher — mentioned by eternaleye

Wed, 18 Oct 2017 00:07:16 GMT

From everything I've seen, the security requirements of "true" RAE are exactly SPRP - that's certainly how Rogaway has framed it. To the best of my knowledge, that's why he designed AEZ under the encode-then-encipher paradigm - encode the plaintext with \tau trailing zero bits, then encipher it with (what is intended to be) a length-preserving SPRP. Being an SPRP, the inverse is also a PRP, and thus any adulteration of the ciphertext results in a pseudorandom decryption, preventing RUP (and causing the trailing zeroes to fail to validate). Constructing the SPRP then becomes the interesting…

Paper and discussion history. A mention is not an endorsement.

An Extension of Cook's Elastic Cipher · HackerPapers discussions

An Extension of Cook's Elastic Cipher — mentioned by eternaleye