2

Given $n$-bit block cipher $E$ (and its inverse $E^{-1}$), define block cipher $E^\prime_k(m) = E_k(E_{f(k)}^{-1}(m))$ where $k,f(k) \in \{0,1\}^n$ and $\forall k:f(k) \ne k$. Under the ideal block cipher model, there exists no function $f$ which would give an attacker an advantage against $E^\prime$. Are there any real block ciphers for which any $E^\prime$ would be weaker than $E$ (excluding those with equivalent keys, of course)?

forest
  • 14,683
  • 1
  • 45
  • 97
  • Would semi-weak keys in DES be an answer for you? Or do you need all keys to make the cipher weaker? – Maarten Bodewes Mar 31 '22 at 21:48
  • @MaartenBodewes Only if $E^\prime$ suffers from weak keys that $E$ does not. – forest Mar 31 '22 at 21:50
  • 1
    Hmm, another guess is to use a reverse key schedule, but I suppose that would fall under equivalent keys. After that you're probably need a specific cipher construction. – Maarten Bodewes Mar 31 '22 at 21:53

0 Answers0