S. , N ), k) return S

C. and M. ,

S. ,

. A. Algo, A. E. Last, H. , A. , and M. ,

?. , A, ? ), k)

C. and M. , AD.init

S. , N ), k) return S

M. , C. , and M. =?-return-?-s-?-h, k) return (M, S)

, Algo. AD.last AD

?. , A, ? ), k)

M. and C. ,

. E. Abd-+-13, A. Andreeva, Y. Bogdanov, B. Dodis, J. P. Mennink et al., On the indifferentiability of key-alternating ciphers, CRYPTO 2013, Part I, vol.8042, pp.531-550, 2013.

. E. Abl-+-14, A. Andreeva, A. Bogdanov, B. Luykx, N. Mennink et al., How to securely release unverified plaintext in authenticated encryption, Palash Sarkar and Tetsu Iwata, vol.8873, pp.105-125, 2014.

. Abm-+-13.-martín, D. Abadi, I. Boneh, A. Mironov, G. Raghunathan et al., Message-locked encryption for lock-dependent messages, CRYPTO 2013, Part I, vol.8042, pp.374-391, 2013.

T. Ashur, O. Dunkelman, and A. Luykx, Boosting authenticated encryption robustness with minimal modifications, Part III, vol.10403, pp.3-33, 2017.

. Afl-+-16.-farzaneh, C. Abed, E. Forler, S. List, J. Lucks et al., RIV for robust authenticated encryption, LNCS, vol.9783, pp.23-42, 2016.

M. R. Albrecht, P. Farshim, K. G. Paterson, and G. J. Watson, On cipher-dependent related-key attacks in the ideal-cipher model, LNCS, vol.6733, pp.128-145, 2011.
URL : https://hal.archives-ouvertes.fr/hal-01287992

M. Bellare, D. J. Bernstein, and S. Tessaro, Hash-function based PRFs: AMAC and its multiuser security, EUROCRYPT 2016, Part I, vol.9665, pp.566-595, 2016.

J. Black, M. Cochran, and T. Shrimpton, On the impossibility of highly-efficient blockcipherbased hash functions, LNCS, vol.3494, pp.526-541, 2005.

G. Bertoni, J. Daemen, M. Peeters, and G. Van-assche, On the indifferentiability of the sponge construction, LNCS, vol.4965, pp.181-197, 2008.

J. Daniel and . Bernstein, Cryptographic competitions, 2014.

M. Bellare and T. Kohno, A theoretical treatment of related-key attacks: RKA-PRPs, RKAPRFs, and applications, LNCS, vol.2656, pp.491-506, 2003.

M. Bellare and S. Keelveedhi, Authenticated and misuse-resistant encryption of key-dependent data, LNCS, vol.6841, pp.610-629, 2011.

M. Bellare, S. Keelveedhi, and T. Ristenpart, Message-locked encryption and secure deduplication, LNCS, vol.7881, pp.296-312, 2013.

. Bmm-+-15.-christian, C. Badertscher, U. Matt, P. Maurer, B. Rogaway et al., Robust authenticated encryption and the limits of symmetric cryptography, 15th IMA International Conference on Cryptography and Coding, vol.9496, pp.112-129, 2015.

G. Barwell, D. P. Martin, E. Oswald, and M. Stam, Authenticated encryption in the face of protocol and side channel leakage, Part I, vol.10624, pp.693-723, 2017.

M. Bellare and C. Namprempre, Authenticated encryption: Relations among notions and analysis of the generic composition paradigm, LNCS, vol.1976, pp.531-545, 2000.

M. Bellare and P. Rogaway, Encode-then-encipher encryption: How to exploit nonces or redundancy in plaintexts for efficient cryptography, LNCS, vol.1976, pp.317-330, 2000.

M. Bellare and P. Rogaway, The security of triple encryption and a framework for code-based game-playing proofs, LNCS, vol.4004, pp.409-426, 2006.

J. Black, P. Rogaway, and T. Shrimpton, Encryption-scheme security in the presence of key-dependent messages, LNCS, vol.2595, pp.62-75, 2002.

M. Bellare, P. Rogaway, and D. Wagner, The EAX mode of operation, LNCS, vol.3017, pp.389-407, 2004.

M. Bellare and B. Tackmann, Can01. Ran Canetti. Universally composable security: A new paradigm for cryptographic protocols, CRYPTO 2016, Part I, vol.9814, pp.136-145, 2001.

Y. Jean-sébastien-coron, C. Dodis, P. Malinaud, and . Puniya, Merkle-Damgård revisited: How to construct a hash function, LNCS, vol.3621, pp.430-448, 2005.

Y. Jean-sébastien-coron, A. Dodis, Y. Mandal, and . Seurin, A domain extender for the ideal cipher, TCC 2010, vol.5978, pp.273-289, 2010.

T. Chk-+-16.-jean-sébastien-coron, R. Holenstein, J. Künzler, Y. Patarin, S. Seurin et al., How to build an ideal cipher: The indifferentiability of the Feistel construction, Journal of Cryptology, vol.29, issue.1, pp.61-114, 2016.

T. Chou and C. Orlandi, The simplest protocol for oblivious transfer, LATINCRYPT 2015, vol.9230, pp.40-58, 2015.

J. Coron, J. Patarin, and Y. Seurin, The random oracle model and the ideal cipher model are equivalent, LNCS, vol.5157, pp.1-20, 2008.
DOI : 10.1007/978-3-540-85174-5_1
URL : http://eprint.iacr.org/2008/246.pdf

G. Demay, P. Ga?i, M. Hirt, and U. Maurer, Resource-restricted indifferentiability, LNCS, vol.7881, pp.664-683, 2013.
DOI : 10.1007/978-3-642-38348-9_39
URL : http://eprint.iacr.org/2012/613.pdf

. Dks-+-17.-yevgeniy, J. Dodis, J. Katz, A. Steinberger, Z. Thiruvengadam et al., Provable security of substitution-permutation networks, Cryptology ePrint Archive, 2017.

D. Dachman-soled, J. Katz, and A. Thiruvengadam, 10-round Feistel is indifferentiable from an ideal cipher, EUROCRYPT 2016, Part II, vol.9666, pp.649-678, 2016.
DOI : 10.1007/978-3-662-49896-5_23

Y. Dodis, L. Reyzin, R. L. Rivest, and E. Shen, Indifferentiability of permutationbased compression functions and tree-based modes of operation, with applications to MD6, LNCS, vol.5665, pp.371-388, 2009.

Y. Dodis, T. Ristenpart, J. P. Steinberger, and S. Tessaro, To hash or not to hash again? (In)differentiability results for H 2 and HMAC, LNCS, vol.7417, pp.348-366, 2012.

Y. Dai and J. Steinberger, Indifferentiability of 10-round Feistel networks, Cryptology ePrint Archive, vol.874, 2015.

Y. Dai and J. P. Steinberger, Indifferentiability of 8-round Feistel networks, CRYPTO 2016, Part I, vol.9814, pp.95-120, 2016.

Y. Dodis, M. Stam, J. P. Steinberger, and T. Liu, Indifferentiability of confusiondiffusion networks, EUROCRYPT 2016, Part II, vol.9666, pp.679-704, 2016.

Y. Dai, Y. Seurin, J. P. Steinberger, and A. Thiruvengadam, Indifferentiability of iterated Even-Mansour ciphers with non-idealized key-schedules: Five rounds are necessary and sufficient, Part III, vol.10403, pp.524-555, 2017.

C. Forler, E. List, S. Lucks, and J. Wenzel, Reforgeability of authenticated encryption schemes, LNCS, vol.17, pp.19-37, 2017.

P. Farshim, C. Orlandi, and . Ro¸siero¸sie, Security of symmetric primitives under incorrect usage of keys, IACR Trans. Symm. Cryptol, vol.2017, issue.1, pp.449-473, 2017.
URL : https://hal.archives-ouvertes.fr/hal-01470885

P. Farshim and G. Procter, The related-key security of iterated Even-Mansour ciphers, LNCS, vol.9054, pp.342-363, 2015.

S. Gueron and Y. Lindell, GCM-SIV: Full nonce misuse-resistant authenticated encryption at under one cycle per byte, ACM CCS 15, pp.109-119, 2015.

P. Grubbs, J. Lu, and T. Ristenpart, Message franking via committing authenticated encryption, CRYPTO 2017, Part III, volume 10403 of LNCS, pp.66-97, 2017.

R. Gennaro and L. Trevisan, Lower bounds on the efficiency of generic cryptographic constructions, 41st FOCS, pp.305-313, 2000.

S. Halevi and H. Krawczyk, Robust authenticated-encryption AEZ and the problem that it solves, EUROCRYPT 2015, Part I, vol.9056, pp.15-44, 2007.

T. Viet-tung-hoang, P. Krovetz, and . Rogaway, AEZ v5: Authenticated encryption by enciphering, 2017.

T. Holenstein, R. Künzler, and S. Tessaro, The equivalence of the random oracle model and the ideal cipher model, revisited, 43rd ACM STOC, pp.89-98, 2011.

R. Viet-tung-hoang, P. Reyhanitabar, D. Rogaway, and . Vizár, Online authenticatedencryption and its nonce-reuse misuse-resistance, CRYPTO 2015, Part I, vol.9215, pp.493-517, 2015.

T. Iwata and T. Kohno, New security proofs for the 3GPP confidentiality and integrity algorithms, LNCS, vol.3017, pp.427-445, 2004.

J. Jean, I. Nikoli´cnikoli´c, T. Peyrin, and Y. Seurin, Deoxys v1, vol.41, 2016.

E. Kiltz, K. Pietrzak, and M. Szegedy, Digital signatures with minimal overhead from indifferentiable random invertible functions, CRYPTO 2013, Part I, vol.8042, pp.571-588, 2013.

R. Küsters and M. Tuengerthal, Universally composable symmetric encryption, Proceedings of the 22nd IEEE Computer Security Foundations Symposium, pp.293-307, 2009.

S. Lucks, Faster Luby-Rackoff ciphers, LNCS, vol.1039, pp.189-203, 1996.

M. Ueli, R. Maurer, C. Renner, and . Holenstein, Indifferentiability, impossibility results on reductions, and applications to the random oracle methodology, LNCS, vol.2951, pp.21-39, 2004.

D. Micciancio and B. Warinschi, Chanathip Namprempre, Phillip Rogaway, and Thomas Shrimpton. Reconsidering generic composition, Cryptology ePrint Archive, vol.2951, pp.257-274, 2004.

T. Peyrin and Y. Seurin, Counter-in-tweak: Authenticated encryption modes for tweakable block ciphers, CRYPTO 2016, Part I, vol.9814, pp.33-63, 2016.

O. Pereira, F. Standaert, and S. Vivek, Leakage-resilient authentication and encryption from symmetric cryptographic primitives, ACM CCS 15, pp.96-108, 2015.

P. Rogaway, M. Bellare, J. Black, and T. Krovetz, OCB: A block-cipher mode of operation for efficient authenticated encryption, ACM CCS 01, pp.98-107, 2001.

P. Rogaway and T. Shrimpton, A provable-security treatment of the key-wrap problem, LNCS, vol.4004, pp.373-390, 2006.

T. Ristenpart, H. Shacham, and T. Shrimpton, Careful with composition: Limitations of the indifferentiability framework, LNCS, vol.6632, pp.487-506, 2011.

R. Reyhanitabar, S. Vaudenay, and D. Vizár, Authenticated encryption with variable stretch, ASIACRYPT 2016, Part I, volume 10031 of LNCS, pp.396-425, 2016.
DOI : 10.1007/978-3-662-53887-6_15

M. Stam, Beyond uniformity: Better security/efficiency tradeoffs for compression functions, LNCS, vol.5157, pp.397-412, 2008.
DOI : 10.1007/978-3-540-85174-5_22
URL : https://link.springer.com/content/pdf/10.1007%2F978-3-540-85174-5_22.pdf

D. Unruh, Programmable encryption and key-dependent messages, Cryptology ePrint Archive, vol.423, 2012.

S. Vaudenay, ;. Ipsec, and W. , Security flaws induced by CBC padding-applications to SSL, LNCS, vol.2332, pp.534-546, 2002.
DOI : 10.1007/3-540-46035-7_35
URL : https://link.springer.com/content/pdf/10.1007%2F3-540-46035-7_35.pdf

. Algo, N. Ae(k, A. , M. A1, and .. .. , Am) ? A (M1, Mm) ? M (?1,. .. , ?m) ? ? S0 ? AE .init(K, N ) for i = 1. .. m ? 1 (Ci, Si) ? AE .next(Si?1

?. Cm, .. .. Cm)-algo, N. Ad(k, A. , C. A1 et al., ? |C| if m = 0 or |A| = |C| then return, ?m) ? ? S0 ? AD.init(K, N ) for i = 1. .. m ? 1 if AD.next(Si?1, Ai, Ci, ?i) =? if m = 1 return [ ] return (M1

.. .. M1, Mm) a nonce. 28 The original STREAM construction includes (K, N ) in S and uses (N, i) as nonce in each invocation. As for online schemes, Mm ? AD.last(Sm?1, Am, Cm, ?m) return