On the provable security of BEAR and LION schemes

TL;DR

This paper proves that BEAR, LION, and LIONESS block ciphers are secure against any efficient known-plaintext key-recovery attack, even with multiple plaintext-ciphertext pairs, under weaker assumptions on the primitives.

Contribution

It extends previous security proofs by showing immunity to attacks with multiple plaintext-ciphertext pairs using weaker primitive assumptions.

Findings

Ciphers are immune to any efficient known-plaintext key-recovery attack with multiple pairs.

Security proof relies on weaker hypotheses about underlying primitives.

Discussion of Morin's attack on these ciphers.

Abstract

BEAR, LION and LIONESS are block ciphers presented by Biham and Anderson (1996), inspired by the famous Luby-Rackoff constructions of block ciphers from other cryptographic primitives (1988). The ciphers proposed by Biham and Anderson are based on one stream cipher and one hash function. Good properties of the primitives ensure good properties of the block cipher. In particular, they are able to prove that their ciphers are immune to any efficient known-plaintext key-recovery attack that can use as input only one plaintext-ciphertext pair. Our contribution is showing that these ciphers are actually immune to any efficient known-plaintext key-recovery attack that can use as input any number of plaintext-ciphertext pairs. We are able to get this improvement by using slightly weaker hypotheses on the primitives. We also discuss the attack by Morin (1996).