In [1] a construction of a block cipher from a single pseudorandom permutation is proposed. In a complexity theoretical setting they prove that this scheme is secure against a polynomially bounded adversary. In this paper it is shown that this constructionsufiersfromseverelimitationsthatareimmediatelyapparentifdifierential
['Joan Daemen']
Limitations of the Even-Mansour Construction