7

There are quite a few block cipher modes of operation that require 128 bits. There are also modes of operation where a higher block size than 128, e.g. a block size of 256 bit would even be practical.

Is there a generic method of combining two blocks together in such a way that two 64 bit blocks can be seen as one 128 block? Is there an efficient method that could be used for CTR mode of operation (the underlying primitive for most popular AEAD ciphers)?

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323

2 Answers2

6

There are two well-known Encryption modes, that can construct a $mn$-bit tweakable blockciphers from a $n$-bit blockcipher ($n=64$ for DES) with $1\le m\le n$.

The older one is CMC, being not parallelizable.
It was superseeded by Encrypt-Mix-Encrypt (EME), which is parallelizable.
The basic idea of the two algorithms is to encrypt each block of input data once, then perform a nonlinear transformation on the resulting bits and feed those into the second round of blockcipher calls. This is neccessary as otherwise attacks on the schemes would be possible. For the stong linking of the two input and output blocks, double encryption can't be avoided.

As EME requires $2m+1$ blockcipher calls, in your case $m=2$, $5$ calls to DES are neccessary for each block of data.

As DES is slow compared to AES, using AES for 128-bit modes and Threefish for larger modes is preferrable.

Besides the performance issues with EME ($>2$ times the work) there also seem to be patent issues with EME.

SEJPM
  • 46,697
  • 9
  • 103
  • 214
4

In addition to the tweakable enciphering schemes in the comments, I'll leave this reference here: https://eprint.iacr.org/2009/356.pdf

It essentially shows (in the ideal cipher model) that using an n-bit block cipher in a three-round Feistel construction gives you a 2n-bit block cipher.

gtp
  • 106
  • 3