{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.1}Introduction}{\reset@font\mtcSfont 115}{section.6.1}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Our Contributions.}{\reset@font\mtcPfont 115}{section*.99}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.2}General Related Concepts}{\reset@font\mtcSfont 117}{section.6.2}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.2.1}Mirror Theory}{\reset@font\mtcSSfont 117}{subsection.6.2.1}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Tighter Version.}{\reset@font\mtcPfont 118}{section*.100}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.2.2}H-Coefficient Technique}{\reset@font\mtcSSfont 119}{subsection.6.2.2}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Extended Transcripts.}{\reset@font\mtcPfont 119}{section*.101}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Good Transcripts.}{\reset@font\mtcPfont 119}{section*.102}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Interpolation Probabilities.}{\reset@font\mtcPfont 119}{section*.103}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Ratio of Good Probabilities.}{\reset@font\mtcPfont 120}{section*.104}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.3}Applying Simon's Algorithm to Functions Restricted on a Subset}{\reset@font\mtcSfont 120}{section.6.3}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.4}Constructions Based on Encrypt-Mix-Encrypt Paradigm: First Attempt and Attack}{\reset@font\mtcSfont 121}{section.6.4}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.4.1}New Superposition Attack on the EME Construction}{\reset@font\mtcSSfont 122}{subsection.6.4.1}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Description of the Attack.}{\reset@font\mtcPfont 123}{section*.106}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Similar Mixing Layers.}{\reset@font\mtcPfont 124}{section*.107}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.5}New Construction and Classical Security Proofs}{\reset@font\mtcSfont 125}{section.6.5}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.5.1}Proof of Classical Security}{\reset@font\mtcSSfont 126}{subsection.6.5.1}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Settings of the Game.}{\reset@font\mtcPfont 126}{section*.109}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Transcript Graphs.}{\reset@font\mtcPfont 126}{section*.110}}
{\reset@font\mtcSSSfont\mtc@string\contentsline{subsubsection}{\noexpand \leavevmode \numberline {6.5.1.1}Classical Security Claim.}{\reset@font\mtcSSSfont 127}{subsubsection.6.5.1.1}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Four Proofs.}{\reset@font\mtcPfont 127}{section*.111}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.5.2}IND-CPA Security Proof of $n$-bit Security using Mirror Theory}{\reset@font\mtcSSfont 128}{subsection.6.5.2}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Sampler of Internal Transcripts.}{\reset@font\mtcPfont 128}{section*.112}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Bad Events.}{\reset@font\mtcPfont 128}{section*.113}}
{\reset@font\mtcSSSfont\mtc@string\contentsline{subsubsection}{\noexpand \leavevmode \numberline {6.5.2.1}Bad Probabilities.}{\reset@font\mtcSSSfont 129}{subsubsection.6.5.2.1}}
{\reset@font\mtcSSSfont\mtc@string\contentsline{subsubsection}{\noexpand \leavevmode \numberline {6.5.2.2}Ratio of Good Probabilities.}{\reset@font\mtcSSSfont 130}{subsubsection.6.5.2.2}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Real World.}{\reset@font\mtcPfont 130}{section*.114}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Ideal World.}{\reset@font\mtcPfont 130}{section*.115}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Using Mirror Theory as a Black-box.}{\reset@font\mtcPfont 130}{section*.116}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.5.3}IND-CCA Security Proof of $n$-bit Security using Mirror Theory}{\reset@font\mtcSSfont 131}{subsection.6.5.3}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.5.4}IND-CPA Security Proof of $(2n/3)$-bit Security}{\reset@font\mtcSSfont 133}{subsection.6.5.4}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Good probability in ideal world.}{\reset@font\mtcPfont 134}{section*.117}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.5.5}IND-CCA Security Proof of $(2n/3)$-bit Security}{\reset@font\mtcSSfont 135}{subsection.6.5.5}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Sampler of Internal Transcripts.}{\reset@font\mtcPfont 136}{section*.118}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Bad Events.}{\reset@font\mtcPfont 136}{section*.119}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Bad Probabilities.}{\reset@font\mtcPfont 136}{section*.120}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Ratio of Good Probabilities.}{\reset@font\mtcPfont 137}{section*.121}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.6}Simulation of the Mirror Theory}{\reset@font\mtcSfont 138}{section.6.6}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode First Step: Getting the Sets of Connected Components.}{\reset@font\mtcPfont 138}{section*.122}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Naive Approach.}{\reset@font\mtcPfont 139}{section*.123}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Approximation.}{\reset@font\mtcPfont 139}{section*.124}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Conclusion.}{\reset@font\mtcPfont 140}{section*.125}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.7}An $O(2^n)$-Distinguisher on our Scheme}{\reset@font\mtcSfont 141}{section.6.7}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Quantising the distinguisher.}{\reset@font\mtcPfont 143}{section*.127}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.8}Quantum Security}{\reset@font\mtcSfont 143}{section.6.8}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.8.1}Hardness of Distinguishing a Random Permutation from a Random Function with Small Range}{\reset@font\mtcSSfont 144}{subsection.6.8.1}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.8.2}Quantum Security Statement}{\reset@font\mtcSSfont 144}{subsection.6.8.2}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Game1 $\rightarrow $ Game2.}{\reset@font\mtcPfont 145}{section*.128}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Game2 $\rightarrow $ Game3.}{\reset@font\mtcPfont 145}{section*.129}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Game3 $\rightarrow $ Game4.}{\reset@font\mtcPfont 146}{section*.130}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Game4: Classical Emulation.}{\reset@font\mtcPfont 146}{section*.131}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.8.3}Discussion}{\reset@font\mtcSSfont 147}{subsection.6.8.3}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.9}Proposing a Concrete Instance: Double-AES}{\reset@font\mtcSfont 148}{section.6.9}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.9.1}How to Extend the Keys?}{\reset@font\mtcSSfont 148}{subsection.6.9.1}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Property :}{\reset@font\mtcPfont 149}{section*.132}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.9.2}Introducing a Domain in AES for Defining $E_j$}{\reset@font\mtcSSfont 149}{subsection.6.9.2}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.9.3}Double-AES Concrete Proposals}{\reset@font\mtcSSfont 149}{subsection.6.9.3}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Double-AES-10. }{\reset@font\mtcPfont 149}{section*.133}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Conjecture: the 7-round attacks cannot be exploited when using AES in our construction. }{\reset@font\mtcPfont 149}{section*.134}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Variants Including Last MC: Double-AES-6-MC. }{\reset@font\mtcPfont 150}{section*.135}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Best Attacks. }{\reset@font\mtcPfont 150}{section*.136}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.9.4}Security Claims}{\reset@font\mtcSSfont 150}{subsection.6.9.4}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.9.5}Discussion}{\reset@font\mtcSSfont 150}{subsection.6.9.5}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.10}Best Attacks Found of Double-AES }{\reset@font\mtcSfont 151}{section.6.10}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode First Middle Round Canceled. }{\reset@font\mtcPfont 151}{section*.137}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.10.1}Attack on X-3-3 Without Last $MC$ in Blocks $E_1$, $E_2$ and $E$. }{\reset@font\mtcSSfont 151}{subsection.6.10.1}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.10.2}Attack on X-2-X Without Last $MC$ in Blocks $E_1$, $E_2$ and $E$. }{\reset@font\mtcSSfont 153}{subsection.6.10.2}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Guessing $k_3$. }{\reset@font\mtcPfont 153}{section*.140}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Guessing $k_1$ and Some Middle Subkeys. }{\reset@font\mtcPfont 153}{section*.141}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode More Pairs. }{\reset@font\mtcPfont 153}{section*.142}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode Complexity. }{\reset@font\mtcPfont 154}{section*.143}}
{\reset@font\mtcSSfont\mtc@string\contentsline{subsection}{\noexpand \leavevmode \numberline {6.10.3}Best known attacks on AES}{\reset@font\mtcSSfont 154}{subsection.6.10.3}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode List of Round-reduced Attacks}{\reset@font\mtcPfont 154}{section*.144}}
{\reset@font\mtcSfont\mtc@string\contentsline{section}{\noexpand \leavevmode \numberline {6.11}Conclusion}{\reset@font\mtcSfont 154}{section.6.11}}
{\reset@font\mtcPfont\mtc@string\contentsline{paragraph}{\noexpand \leavevmode On concrete instances and cryptanalysis.}{\reset@font\mtcPfont 154}{section*.147}}
