XCB is a tweakable enciphering scheme (TES) which was first proposed in 2004. The scheme was modified in 2007. We call these
two versions of XCB as XCBv1 and XCBv2 respectively. XCBv2 was later proposed as a standard for encryption of sector oriented
storage media in IEEE-std 1619.2 2010. There is no known proof of security for XCBv1 but the authors provided a concrete security bound for XCBv2 and
a "proof" for justifying the bound. In this paper we show that XCBv2 is not secure as a TES by showing an easy distinguishing attack on it.
For XCBv2 to be secure, the message space should contain only messages whose lengths are multiples of the block length of the block cipher.
For such restricted message spaces also the bound that the authors claim is not justified. We show this by pointing out some errors in the proof.
We provide a new security bound for XCBv2, and this bound is much worse than that has been claimed by the authors. We also for the first time
provide a concrete security bound for XCBv1. The new bounds shows that both XCBv1 and XCBv2 are worse in terms of security compared
to all TES for which a concrete security bound is known.
↧