Encrypted Davies-Meyer and Its Dual: Towards Optimal Security Using Mirror Theory

At CRYPTO 2016, Cogliati and Seurin introduced the Encrypted Davies-Meyer construction, p2(p1(x) ⊕ x) for two n-bit permutations p1, p2, and proved security up to 2 . We present an improved security analysis up to 2/(67n). Additionally, we introduce the dual of the Encrypted Davies-Meyer construction, p2(p1(x)) ⊕ p1(x), and prove even tighter security for this construction: 2/67. We finally demonstrate that the analysis neatly generalizes to prove almost optimal security of the Encrypted Wegman-Carter with Davies-Meyer MAC construction. Central to our analysis is a modernization of Patarin’s mirror theorem and an exposition of how it relates to fundamental cryptographic problems.