## Another look at XCB

Debrup Chakraborty, Vincente Hernandez-Jimenez and
Palash Sarkar

*Cryptography and Communications*, 7 (2015), 439-468.

Abstract:
XCB is a tweakable enciphering scheme (TES) which was first proposed in
2004. The scheme was modified in 2007. We call these two versions of XCB
as XCBv1 and XCBv2 respectively. XCBv2 was later proposed as a standard
for encryption of sector oriented storage media in IEEE-std 1619.2 2010.
There is no known proof of security for XCBv1 but the authors provided
a concrete security bound for XCBv2 and a “proof” for justifying the
bound. In this paper we show that XCBv2 is not secure as a TES by showing
an easy distinguishing attack on it. For XCBv2 to be secure, the message
space should contain only messages whose lengths are multiples of the
block length of the block cipher. For such restricted message spaces also,
the bound that the authors claim is not justified. We show this by pointing
out some errors in the proof. For XCBv2 on full block messages, we
provide a new security analysis. The resulting bound that can be proved
is much worse than what has been claimed by the authors. Further, we
provide the first concrete security bound for XCBv1, which holds for all
message lengths. In terms of known security bounds, both XCBv1 and
XCBv2 are worse compared to existing alternative TES.

Journal paper
Preprint