Join Log in
Score:0
J. Doe avatar Crypto

Are there any block ciphers (like AES) which are (or can be) commutative under composition for different keys?

at flag
J. Doe

Let $BC$ be a block cipher with similar security as AES (in ECB mode). This $BC$ is applied to a message $m$ of same bit size. The result is a cipher $c$.

e.g.;

$$BC(key_A,m) = c_A$$ $$BC(key_B,m) = c_B$$

I'm looking for a $BC$ with: $$BC(key_A,c_B) = c_{BA}$$ $$BC(key_B,c_A) = c_{AB}$$ where $$c_{AB}=c_{BA}$$ but for the majority: $$c_{A}\not=c_{B}$$

Is there any way to construct keys $key_A, key_A$ with this property for a suitable $BC$?

(Or at least for a big subgroup of the elements)

This questions includes an answer (from Thomas) to a similar question: Are there any secure commutative ciphers?

But as far as I understand it this implies the $BC$ is commutative for all keys. I'm fine with just a small amount of keys which are commutative to each other.

Also in target application the $BC$ just serves as a random number generator. The next number will be generated by applying $BC$ to the current. It should be hard to determine the 'index' of a given value or computing $i$-steps ahead.

A commutative RNG which can compute the next and previous value out of the current (+ some constants (like the key or seed) would also do the job.

Edit: The key/seed will been known.

64
0 + 2
aes
Maarten Bodewes avatar
in flag
Maarten Bodewes
Huh? The answer of Thomas explains that "In that sense, a commutative block cipher cannot be secure "as a block cipher". " The initial part of the question requests exactly that, although you do introduce a mention of *related keys*. What really surprises me though is the fact that BC just serves as a random number generator - for that you also don't need to have a decryption function, so in that case are we not limited to a PRP / block cipher anymore?
0
Reply
J. Doe avatar
at flag
J. Doe
@MaartenBodewes It don't need to be that strong as in shown link. Instead of all keys some keys would be enough. Also the keys will be known anyways (did some edit). The decryption is needed because out of a random value the next and previous number (=decryption) need to be computable. As written above it need to be hard to compute the index and no short cut for computing i-steps ahead. The cycle size need to be close to the bit-size (or equal). I already checked many PRP or RNG. They always had some problems. AES-like has best properties so far but any alternative idea would be nice as well.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.