Xor–encrypt–xor
The xor–encrypt–xor (XEX) is a (tweakable) mode of operation of a block cipher. In tweaked-codebook mode with ciphertext stealing (XTS mode), it is one of the more popular modes of operation for whole-disk encryption. XEX is also a common form of key whitening, and part of some smart card proposals.[1][2]
History
[edit]In 1984, to protect DES against exhaustive search attacks, Ron Rivest proposed DESX: XOR a pre-whitening key to the plaintext, encrypt the result with DES using a secret key, and then XOR a postwhitening key to the encrypted result to produce the final ciphertext.[3]
In 1991, motivated by Rivest's DESX construction, Even and Mansour proposed a much simpler scheme (the "two-key Even–Mansour scheme"), which they suggested was perhaps the simplest possible block cipher: XOR the plaintext with a prewhitening key, apply a publicly known unkeyed permutation (in practice, a pseudorandom permutation) to the result, and then XOR a postwhitening key to the permuted result to produce the final ciphertext.[3][4][5][6]
Studying simple Even–Mansour style block ciphers gives insight into the security of Feistel ciphers (DES-like ciphers) and helps understand block cipher design in general.[7]
Orr Dunkelman, Nathan Keller, and Adi Shamir later proved it was possible to simplify the Even–Mansour scheme even further and still retain the same provable security, producing the "single-key Even–Mansour scheme": XOR the plaintext with the key, apply a publicly known unkeyed permutation to the result, and then XOR the same key to the permuted result to produce the final ciphertext.[3][8]
In 2004, Rogaway presented the XEX scheme with key and location-dependent "tweaks":[9]
_mode_encryption.svg)
Rogaway used XEX to allow efficient processing of consecutive blocks (with respect to the cipher used) within one data unit (e.g., a disk sector) for whole-disk encryption.[9]
Many whole-disk encryption systems – BestCrypt, dm-crypt, FreeOTFE, TrueCrypt, DiskCryptor, FreeBSD's geli, OpenBSD softraid disk encryption software, and Mac OS X Lion's FileVault 2 – support XEX-based tweaked-codebook mode with ciphertext stealing (XTS mode).
References
[edit]- ↑ Barış Ege, Elif Bilge Kavun, and Tolga Yalçın. "Memory Encryption for Smart Cards" Archived 2018-11-03 at the Wayback Machine. 2011.
- ↑ Emmanuel Prouff. "Smart Card Research and Advanced Applications". 2011, p. 201.
- 1 2 3 Orr Dunkelman, Nathan Keller, and Adi Shamir. "Minimalism in Cryptography: The Even–Mansour Scheme Revisited".
- ↑ Even, Shimon; Mansour, Yishay (1991). Written at Fujiyoshida, Japan. A construction of a cipher from a single pseudorandom permutation. Advances in Cryptology - ASIACRYPT '91: International Conference on the Theory and Application of Cryptology. Berlin, Heidelberg: Springer Berlin Heidelberg. pp. 210–224. ISBN 9783540573326.
- ↑ Even, Shimon; Mansour, Yishay (June 1997). "A construction of a cipher from a single pseudorandom permutation". Journal of Cryptology. 10 (3): 151–161. doi:10.1007/s001459900025.
- ↑ Joan Daemen, Laboratorium Esat. "Limitations of the Even–Mansour Construction". 1992. doi:10.1007/3-540-57332-1_46
- ↑ Craig Gentry and Zulfikar Ramzan. "Eliminating Random Permutation Oracles in the Even–Mansour Cipher" Archived 2017-08-10 at the Wayback Machine. 2004.
- ↑ Orr Dunkelman; Nathan Keller; and Adi Shamir. "Eurocrypt 2012: Minimalism in Cryptography: The Even-Mansour Scheme Revisited".
- 1 2 Rogaway, Phillip (2004-09-24). "Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC" (PDF).
 | This cryptography-related article is a stub. You can help Wikipedia by adding missing information. |