A Construction of a Cipher from a Single Psuedorandom Permutation

Shannon defined a. random cipher as a collection of randomly cho­ sen permutations, one for each value of the key. We suggest a scheme for a block cipher which uses only one ran­ domly chosen permutation, F. The key, consisting of two blocks, K I and K 2 is used in the following way: The message block is XORed with K I before applying F, and the outcome is XORed with K2, to produce the cryptogram block. This removes the need to store, or generate a multitude of permutations. Although the resulting cipher is not random, we claim that it is secure. First, it is shown that if F is chosen randomly then, with high probability the scheme is secure against any polynomial-time algorith­ mic attack. Next, it is shown that if F is chosen pseudorandomly, the system remains secure against oracle-type attacks. The scheme may lead to a system more efficient than systems such as the DES and its siblings, since the designer has to worry about one thing only: How to implement one pseudorandomly chosen permuta­ tion. This may be easier than getting one for each key. lComp. Sci. Dept., Technion, Israel Institute of Technology, Haifa, Israel 32000. Supported by the Fund for the Promotion of Research at the Technion, and by Bellcore, Morristown, NJ. E-address: [email protected] 2IBM T.J. Watson Research Center, Yorktown Heights, NY. E-address: [email protected].