13 views

Uploaded by Andrada Astefanoaie

Unbalanced feistel newtworks & Code Block design

- White Box Cryptography-ppt
- advantages and disadvantages.docx
- p189-naor
- Detailed Design Format
- cryptography-Hardeep
- A CLOUD SECURITY APPROACH FOR DATA AT REST USING FPE
- Location Based Encryption-Decryption Approach for Data Security
- Good Story
- Differential Chapter
- 400687B8d01
- An Efficient VLSI Architecture for AES and It's FPGA Implementation
- digi
- Trust and reputation in mobile environments
- Trust and reputation in mobile environments
- prez0
- Chapter06 Print
- How to Talk to Absolutely Anyone: Confident Communication in Every Situation by Mark Rhodes
- Nanua Singh, Divakar Rajamani (auth.) Cellular Manufacturing Systems- Design, planning and control 1996 (1).pdf
- Publications.pdf
- User Manual GL -Cash Journal-FBCJ

You are on page 1of 40

andrada.astefanoaie@info.uaic.ro

Code Block Design

&

Feistel Networks

Contents

F-Functions

Rounds

Balanced Feistel Networks

Unbalanced Feistel Networks

Homogenous & Heterogenous UFNs

Incomplete & Inconsistent UFNs

Generalized UFNs

Cycles & Rotations

Rate of Confusion

Rate of Diffusion

Examples

Differential Cryptanalysis

Linear Cryptanalysis

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

F-Functions

A Feistel network is a general method of transforming any function, usually called

F-Function, into a permutation. It was invented by Horst Feistel, a scientist from

IBM, in his design of Lucifer in the early 1970s and has been used in many block

cipher designs: DES, FEAL, Khufu and Khafre, Blowfish and RC5.

F : {0,1}n / 2 {0,1}k

{0,1}n / 2

Where n is the size of the block, F is a function taking n/2 bits and k bits of a key as input, and producing an output of length n/2 bits.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rounds

Def2. One round of a conventional (balanced) Feistel network is:

Xi

Here, Xi is the input to the round, Xi+1 is the output of the round, ki is the key, n is the block length, lsbn/2(x) and

msbn/2(x) select the least significant and most significant u bits of X,

concatenation.

lsbn/2 (X). This is often referred to as the left half operating on the right half.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Def3. A Balanced Feistel Network consists of j rounds:

Xi

(Fk i (msbn/2 (X i ))

The keys ki are the round keys, which typically are output from a key schedule algorithm on input a key K.

iteration of the F-function. The number of rounds

required for resistance to a given attack depends

of the properties of the function.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

An Unbalanced Feistel Network (UFN) is a Feistel network where the left half and

the right half are not of equal size.

Xi

(F(msbs (Xi ), k i )

The msbn/2(Xi) called the source block. The lsbn/2(Xi) is called the target block. UFNs

where s > t are called source heavy, and UFNs where s < t are called target heavy. A

sub-block, b, is gcd( s, t, n). The F-function is a collection of 2k mappings of the s-bit

numbers onto the t-bit numbers, or s/b sub-blocks onto t/b sub-blocks.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Def5. A UFN is homogenous when the F-function function is identical in each

round, except for the round keys. A UFN is heterogeneous when the F-function for

different rounds is not always identical except for the round keys.

The advantage of a heterogenous UFN is that, since its internal properties change

from round to round, it may be much more difficult to find any kind of characteristic

that propogates well through all of the different kinds of round that appear in the

cipher.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Def6. A UFN is complete when s+t = n, that is, when in each round every bit in the

block is either part of the source block or part of the target block. A UFN is

incomplete when s+t < n. In an incomplete UFN, the n-s-t = z bits that are not part

of the source block or part ofthe target block are called the null block.

Def7. UFN is consistent when s, t, z, and n remain constant for the entire cipher. A

UFN in which the sizes of the source and target block change during encryption is

called inconsistent.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Generalized UFNs

The most general case of a Feistel Network simply requires that one part of the

block being encrypted controls the encryption of another part of the block. For

example, given some n-bit keyed reversible function, Ek (X), we can define a block

cipher whose rounds look like:

Xi

Eki

msbs ( X i )

(lsbt ( X i )) msb s ( X i )

Further, we need not leave the source block alone in each round-we may perform

some unkeyed reversible function on it, as well. Additionally, we can apply some

nonreversible function on the source block to derive the key for the keyed

reversible function.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Generalized UFNs

Def7. One round of a s:t n-bit Generalized Unbalanced Feistel Network (GUFN) is

defined as:

Xi

where R is some reversible function, and G is some reversible function in the sense

that there is a function H such that for all K, Y, Z:

H (K,Y,G(K,Y,Z)) = Z

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

A cycle is the number of rounds necessary for each bit in the block to have been

part of both the source and target blocks at least once. A rotation is the number of

rounds needed for each bit in the block to return to its starting position.

C [

n

]

min( s, t )

G [

n

]

gcd(s, t )

when G = n.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Confusion

An observer who knows some information about Xi, but not round key ki, should

wind up knowing less about Xi+i. The process by which this observer loses

knowledge of the sequence of Xi values is called confusion.

In a Feistel Network, bit j of the block can be obscured only when bit j appears in

the target block of a given round. This means that the number of times that bit j

can be obscured per cycle can be no larger than the number of times per cycle that

bit j appears in the source block. This is called the rate of confusion, denoted as Rc.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Confusion

Def10. The rate of confusion of a consistent UFN is the minimum number of times

per cycle that any bit can occur in the target block.

t

n

Note that it can never take fewer than 1/ Rc rounds for an observer to lose all

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Confusion

The rate of confusion and linear cryptanalysis An increase in Rc tends to increase

resistance to linear cryptanalysis, when all other variables are held constant.

Def11. An active round in a linear attack is a round in which there is some linear

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Confusion

Theorem 1. If an even complete UFN has C rounds per cycle, then the fraction of

rounds per cycle that are active in a linear attack is at least Rc = t/n.

This follows from the fact that Rc measures the minimum number of times per cycle that any bit or

subset of bits may have appeared in the target block.

Theorem 2. Let p be the bias of the best possible approximation for an active round

under a linear attack. Then the output bias of any nontrivial linear characteristic

propagating through C rounds is at most (2(CRc-1)pCRc).

From our previous assertions, we can see that in each C rounds, there are at least CRc active rounds

under a linear attack. The best possible bias of a C-round approximation follows from this, and from the

rules for concatenating linear characteristics.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Confusion

Intuitively, anytime a bit string with any uncertainty at all is XORed into the bits of

an approximation, that approximation's bias decreases. Assuming that there is no

perfect approximation of any subset of the F-function's outputs, this implies that a

higher rate of confusion leads to a smaller bias for a linear approximation sent

through a full cycle. It is important to note, however, that a high rate of confusion is

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Diffusion

Any change in Xi should have some chance to change every bit of Xi+1, for some t.

The process by which one bit in the block has the chance to affect other bits in the

block is called diffusion.

In a Feistel cipher, the only time bit j can affect other bits in the block is when bit j

is in the source block. This leads naturally to the idea of the rate of diffusion.

Def12. The rate of diffusion is the smallest number of times per cycle that a given

bit can have the chance to affect other bits in the block.

s

t

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Diffusion

The rate of diffusion is the measure of how many times per cycle each bit is used to

encrypt other bits. It is upwardly bounded by the proportion of the block used as

input to the F-function.

increase resistance to differential cryptanalysis, when all other variables are held

constant.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Diffusion

Def13. An active round under a differential attack is a round in which there is a

nonzero input difference into the F-function.

Theorem 3. If an even complete UFN has C rounds per cycle, then the fraction of

rounds per cycle that are active in a differential attack is at least Rd = s/n.

This follows from the definition of an active round under differential attack, and from the definition of

the rate of diffusion.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Diffusion

Theorem 4. Let p be the greatest possible probability for a nontrivial characteristic

to propagate through a round. Then, the probability of any nontrivial characteristic

propagating through C consecutive rounds is at most p(CRd) assuming that

characteristics can be concatenated by multiplying their probabilities.

A differential characteristic has its probability computed by multiplying all of its constituent

characteristics probabilities. No C round characteristic can have fewer than CRd active one round

characteristics, and inactive round character-istics have probability of one. Since no one round active

characteristic can have probability of more than p, it's clearly impossible for any C round characteristic to

have greater than pCRi probability.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Rate of Diffusion

Intuitively, each time an input difference appears in the source block, unless the

desired output difference happens with probability 1, the differential characteristic

becomes less likely to successfully pass through a cycle. However, it is important to

note that a high rate of diffusion alone is not sufficient to ensure resistance to

differential attack-the differential properties of the cipher's F-function must also be

with realtively high rates of diffusion) are compli-cated by the fact that inputs into

successive rounds are closely related. This is discussed below.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Examples

MacGuffin is a 48:16 UFN (b = 16 and n = 64) designed to introduce the concept of

UFNs. The F-function closely mirrors DES; it consists of a permutation, an XOR of 48

key bits, an S-box substitution (using the high-order two bit output of the eight DES

S-boxes), and another permutation.

BEAR and LION are block cipher constructions designed by Ross Anderson and Eli

out of any keyed hash function with an n-bit output, and any stream cipher with an

n-bit key.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Examples

The MD4 Family of Hash Functions The underlying structure of all these hash

functions is a block algorithm, with a Davies-Meyer feedforward function to convert

it into a one-way hash function. In SHA, for example, the block algorithm is an 80round, 128:32 even complete UFN.

There are some additional complications making SHA a GUFN: the output of the F-

function is combined with the target block using addition modulo 232 instead of

XOR, and there is an additional cyclic shift of part of the source block in each

round. Note that these hash functions' compression functions are source-heavy

heterogenous UFNs.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

If we assume a b:3b UFN, and that an input difference a produces a zero difference,

this can be used to create a 4-round characteristic with probability p

(In the following examples, a, b and 0 are all b-bit numbers. In this section, s t is used to show the

actual differential relationship which is being exploited).

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

In general, the differential can be used in a ub:vb UFN to create a (u + v)-round

iterative characteristic with probability pu.

While at first glance, this seems to imply that UFNs with a larger Rd are less likely to

have good multi-round differential characteristics, this is not always the case. As b

gets smaller, the assumptions required to produce this characteristic become more

become easier to find again. Note that this may lead to situations in which a multiround characteristic is extremely difficult to find, but relatively easy to exploit.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

Consider a different type of differential: Assume a b:3b UFN, and that an input

difference a produces an output difference (0, b, 0) with probability p1, and an

input difference b produces an output difference (0, a, 0) with probability p2. These

differentials can be used to create a 6-round characteristic with probability p1 p2

one that can be concatenated with another similar characteristic to create a 12round iterated characteristic with probability p12p22:

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

Complications

property that successive rounds have some portions of their inputs in common. This

is significantly different than the situation in a balanced Feistel Network, in which

the entire input to the F-function was XORed with the output of the previous

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

Complications

differential characteristic whose probability is partially a function of the specific

round keys chosen. In some cases, such as the attacks on RDES and Lucifer in, this

provides a generally useful attack on the cipher. In other cases, such as in the weak

keys of IDEA, a rare weak key condition (consisting of an interaction between the

cipher key, the key schedule, and the round function) can lead to relatively high

probability differential characteristics.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

Complications

When there are many possible key-dependent differential characteristics, we may

be able to the fact that some characteristics pass through the cipher, while others

do not, as a way to immediately learn quite a bit of internal key information.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

Complications

characteristics seem less likely to exist when different sub-blocks of the F-function's

input are treated differently enough that they do not have the same differential

properties.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

Conclusions

diffusion becomes higherthat is, more source-heavy UFNs tend to have more

inherent resistance to differential attacks.

2. F-functions which treat different sub-blocks of input differently are much more

likely to be resistant to differential cryptanalysis than F-functions which treat

different sub-blocks identically.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Differential Cryptanalysis

Conclusions

complex than is suggested by the first section of our discussion, above. In particular,

source heavy UFNs have related inputs going into successive rounds F-functions,

and in some circumstances, this can lead to new vul-nerabilities to differential

against some kinds of differential attack by this property.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Linear Cryptanalysis

Consider an F-function with a linear approximation of some output bits, a, based on

some linear combination of the key bits only. Note that, in the tables in this section, As At

is used to denote the actual linear approximation being exploited in a given round.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Linear Cryptanalysis

If we assume a 3b:b UFN, this linear approximation gives rise to a 4-round

characteristic with probability (1/2+ pi)

While at first glance, this seems to imply that UFNs with a larger Rc are less likely to

have good multi-round linear characteristics, this is not always the case: as t gets

larger with respect to s, it is more likely to have linear relationships.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Linear Cryptanalysis

Complications

There are some complications that need to be dealt with in linear cryptanalysis of

UFNs. First, an n-round b:3b UFN has an F-function output which has three times

as many output bits as input bits. This appears to make linear relationships

between the input and output bits, or simply between output bits, more likely to

are closely relateddepending upon the definition of the F-function, this may

further complicate linear cryptanalysis of this kind of UFN.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Linear Cryptanalysis

Conclusions

to linear cryptanalysis is tied directly to Rc: as the size of t grows with respect to s,

linear attacks become more difficult. However, the larger the target block, the

more likely it is to have some useful linear approximations. Extremely target-heavy

UFNs (such as an 8:1024 UFN) are certain to have some strong linear

approximations in the outputs of their F-functions.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Conclusions

The structure of the Feistel network affects the security of the block cipher.

Modifying the ratio of s and t can systematically affect the security of the cipher,

when all other variables are held constant. Additionally, such issues as how the

round keys are combined into the cipher can become important in UFN design

much more so than in balanced Feistel cipher design.

UFN designs may allow us to design faster and better block ciphers than we could if

we limited ourselves to balanced Feistel structures.

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Open Problems

It seems that source-heavy UFNs have some inherent resistance to differential

attacks. Assuming some basic number of cycles, perhaps four, is there an optimal

s:t ratio for resistance to differential attacks?

differential attacks, followed by several rounds of target-heavy UFN for resistance

to linear attacks? What would differential and linear attacks against such structures

look like?

Feistel Networks Taxonomy Generic Constructions Comparison Conclusions & Open Problems

Resource

Unbalanced Feistel Networks and Block-Cipher Design

by

Thank you!

Code Block Design

&

- White Box Cryptography-pptUploaded bysonal
- advantages and disadvantages.docxUploaded byrashid sharif
- p189-naorUploaded byKajori Banerjee
- Detailed Design FormatUploaded byAnurag Patel
- cryptography-HardeepUploaded byvandana_pasricha5627
- A CLOUD SECURITY APPROACH FOR DATA AT REST USING FPEUploaded byAnonymous roqsSNZ
- Location Based Encryption-Decryption Approach for Data SecurityUploaded byATS
- Good StoryUploaded bykokan baba
- Differential ChapterUploaded byEmrah Gürcan
- 400687B8d01Uploaded byHemant Kumar
- An Efficient VLSI Architecture for AES and It's FPGA ImplementationUploaded byIRJET Journal
- digiUploaded bypanankit123

- How to Talk to Absolutely Anyone: Confident Communication in Every Situation by Mark RhodesUploaded byCapstone Publishing
- Nanua Singh, Divakar Rajamani (auth.) Cellular Manufacturing Systems- Design, planning and control 1996 (1).pdfUploaded byIvan Dario Cordero Rodriguez
- Publications.pdfUploaded byakhileshsingh28
- User Manual GL -Cash Journal-FBCJUploaded bymssarwar9
- ServiceManuals LG Washing WFT902 WF-T902 Service ManualUploaded byobi777
- Functional Management Information SystemUploaded byPrince Rana
- IPSA I Final ExamUploaded byJohnny Mills
- Bosch India -Listofrcitems2005Uploaded byWelkin Dai
- Hinrichsen_An Algorithm for the Computation of the Structured Complex Stability Radius_1989'Uploaded byTan Chun Kiat
- Customer Brand RelationshipUploaded byshahkrishma88
- IT Green Light_Case Study_englishUploaded byElisei Craciun
- Vehicle Dynamics Example ProblemsUploaded byShardool Mehta
- Technology; Theatres, Plays and PerformanceUploaded byHannah Williams Walton
- Toronto Region - Hydrogen Fuel Cells Innovation Snapshot - April 2011Uploaded byTorontoResearch
- SAP Plant MaintenanceUploaded bysaaisun
- 5939R09-DIGITAL SIGNAL PROCESSORS AND ARCHITECTURES.pdfUploaded byPaul Nathan
- AN-C240Uploaded bykymk21
- Atomically Thin P-n Junctions With Van Der Waals_NATUREUploaded byPolychronis Tsipas
- Blue Eyes1Uploaded byNidhi Sareen
- Preparing and Developing Computerized System for Summarized Monthly Running Report(R/51) in Sri Lanka Transport BoardUploaded byBuddhika Janith
- Type-driven testing in Haskell slidesUploaded byShinNoNoir
- Shell Diala Product Family Brochure Low (1)Uploaded byAvoor Khan
- nvr-2011-001Uploaded byمرتضی عزیزی
- Book Review_ Design of Steel Bins for Storage of Bulk Solids (Gaylord & Gaylord, Prentice-Hall, 1984)Uploaded bygdwvcd
- fractions multiplying estimateUploaded byapi-370541284
- Sci10-Dd Syllabus 200910s2 Rojasloable PDFUploaded byMarc Bueno
- Open ForumUploaded byjmathew_984887
- Manual de Mantenimiento de Beechcraft - Bonanza 609Uploaded byAbraham Said
- Fact Sheet - Big BirdUploaded byNick Numlk
- Registration Form Efgcp Lay Summaries Workshop 29 May ParticipantsUploaded byJovert Manadong