Balanced permutations Even–Mansour ciphers

Shoni Gilboa, Shay Gueron, Mridul Nandi

Research output: Contribution to journalArticlepeer-review


The r-rounds Even–Mansour block cipher is a generalization of the well known Even–Mansour block cipher to r iterations. Attacks on this construction were described by Nikolić et al. and Dinur et al. for r = 2, 3. These attacks are only marginally better than brute force but are based on an interesting observation (due to Nikolić et al.): for a “typical” permutation P, the distribution of P(x) ⊕ x is not uniform. This naturally raises the following question. Let us call permutations for which the distribution of P(x) ⊕ x is uniformly “balanced” — is there a sufficiently large family of balanced permutations, and what is the security of the resulting Even–Mansour block cipher? We show how to generate families of balanced permutations from the Luby–Rackoff construction and use them to define a 2n-bit block cipher from the 2-round Even–Mansour scheme. We prove that this cipher is indistinguishable from a random permutation of {0, 1}2n, for any adversary who has oracle access to the public permutations and to an encryption/decryption oracle, as long as the number of queries is o(2n/2). As a practical example, we discuss the properties and the performance of a 256-bit block cipher that is based on our construction, and uses the Advanced Encryption Standard (AES), with a fixed key, as the public permutation.

Original languageEnglish
Article number2
Pages (from-to)1-17
Number of pages17
Issue number1
StatePublished - Jun 2017

Bibliographical note

Funding Information:
Acknowledgments: This research was supported by the PQCRYPTO project, which was partially funded by the European Commission Horizon 2020 research Programme, grant #645622, and by the Bar Ilan University Center for Research in Applied Cryptography and Cyber Security in conjunction with the Israel National Cyber Bureau in the Prime Minister’s Office.

Publisher Copyright:
© 2016 by the authors. Licensee MDPI, Basel, Switzerland.

Copyright 2021 Elsevier B.V., All rights reserved.


  • Even
  • Mansour; block-cipher; Luby
  • Rackoff


Dive into the research topics of 'Balanced permutations Even–Mansour ciphers'. Together they form a unique fingerprint.

Cite this