A Domain Extender for the Ideal Cipher
The authors describe the first domain extender for ideal ciphers, i.e. they show a construction that is indifferentiable from a 2n-bit ideal cipher, given a n-bit ideal cipher. Their construction is based on a 3-round Feistel, and is more efficient than first building a n-bit random oracle from a n-bit ideal cipher (as in ) and then a 2n-bit ideal cipher from a n-bit random oracle (as in , using a 6-round feistel). They also show that 2 rounds are not enough for in-differentiability by exhibiting a simple attack.