International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

How to Recover the Full Plaintext of XCB

Authors:
Peng Wang , School of Cryptology, University of Chinese Academy of Sciences
Shuping Mao , Beijing Electronic Science & Technology Institute
Ruozhou Xu , State Grid Information & Telecommunication Branch
Jiwu Jing , School of Cryptology, University of Chinese Academy of Sciences
Yuewu Wang , School of Cryptology, University of Chinese Academy of Sciences
Download:
Search ePrint
Search Google
Conference: CRYPTO 2025
Abstract: XCB, a tweakable enciphering mode, is part of IEEE Std. 1619.2 for shared storage media. We show that all versions of XCB are not secure through three plaintext recovery attacks. A key observation is that XCB behaves like an LRW1-type tweakable block cipher for single-block messages, which lacks CCA security. The first attack targets one-block XCB, using three queries to recover the plaintext. The second one requires four queries to recover the plaintext that excludes one block. The last one requires seven queries to recover the full plaintext. The first attack applies to any scheme that follows the XCB structure, whereas the latter two attacks work on all versions of XCB, exploiting the separable property of the underlying universal hash function. To address these flaws, we propose the XCB* structure, an improved version of XCB that adds only two XOR operations. We prove that XCB* is STPRP-secure when using AXU hash functions, SPRPs, and a secure random-IV-based stream cipher.
BibTeX
@inproceedings{crypto-2025-35648,
  title={How to Recover the Full Plaintext of XCB},
  publisher={Springer-Verlag},
  author={Peng Wang and Shuping Mao and Ruozhou Xu and Jiwu Jing and Yuewu Wang},
  year=2025
}