Skip to content

Back to the catalog

eprint.iacr.orgpaper

Revisiting Hash-ECB-Hash Enciphering: Plaintext Recovery Attacks on PEP and TET

ePrint 2026/2691 gives classical distinguishing and plaintext-recovery attacks on the Hash-ECB-Hash tweakable enciphering schemes PEP (FSE 2006) and TET (CRYPTO 2007). For PEP, a fixed public field makes the position coefficients repeat, which allows a two-query distinguisher and recovery with at most nine encryption queries and one decryption query. Two corrected TET variants fall to two-query distinguishers and deterministic recovery on messages with a partial final block.

TL;DR Breaks the PEP and TET enciphering schemes with two-query distinguishers and plaintext recovery using a handful of queries.
Open original ↗
Document

What it is

ePrint 2026/2691 (received 30 October 2026, approved 4 November 2026) is a preprint by Hailun Yan, Yuexing Yue, Yaobin Shen, Peng Wang and Siwei Sun. It attacks two tweakable enciphering schemes for storage encryption: PEP (FSE 2006) and TET (CRYPTO 2007). Both follow the Hash-ECB-Hash pattern of parallel block-cipher calls with invertible mixing.

How it works

PEP: the authors give a fixed public field that satisfies the published parameter-selection rule, yet the generated position coefficients repeat. This gives a two-query algebraic distinguisher. One encryption query recovers a secret tweak-derived value. For the same instance, target plaintexts over a specified range of complete-block lengths are recovered with at most nine encryption queries and one decryption query.

TET: the paper examines two corrections of a previously reported mismatch between encryption and decryption. Both admit two-query distinguishers on messages with a partial final block. When the tail is at least two bits, plaintext recovery is deterministic. One correction needs two decryption queries. The other needs two encryption queries and one decryption query.

The abstract attributes both failures to concrete coefficient generation and partial-block processing, and says the paper identifies requirements for repairing the constructions.

Preconditions / Affected

  • PEP: the attack depends on choosing the public field described in the paper. The result is shown for that instance, not for every PEP deployment.
  • TET: only messages with a partial final block are affected. Messages made of complete blocks are not covered by these attacks.
  • TET: the abstract says the attacks hold for every data permutation and valid parameter choice.

Caveats

  • The PEP success bounds assume a uniformly random secret permutation and target tweaks and plaintexts that are fixed independently of it.
  • The abstract does not give the exact block-length range for PEP recovery, the field, or any repair. Those details are in the full paper.
  • The attacks are classical, and the page reports no implementation or measured results.

Technologies named here

  • PEP
  • TET
  • TET (Hash-ECB-Hash tweakable enciphering scheme, CRYPTO 2007), including two corrected variants

Techniques named here

  • distinguishing attack
  • Hash-ECB-Hash
  • plaintext recovery attack

Concepts named here

  • Hash-ECB-Hash enciphering
  • Repeating position coefficients
  • Tweakable enciphering scheme

Related in other