General Diffusion Analysis: How to Find Optimal Permutations for - PowerPoint PPT Presentation

General Diffusion Analysis: How to Find Optimal Permutations for Generalized Type-II Feistel Schemes Victor Cauchois 1 , 2 , Clément Gomez 1 , Gaël Thomas 1 1 DGA Maitrise de l’Information, Bruz, France 2 IRMAR, Université de Rennes 1, Rennes, France Fast Software Encryption — 2019-03-26 — Paris, France Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 1/20

The Feistel Network How to construct a permutation? F Challenging task F Split the problem in half and iterate F DES, Camellia, Simon, . . . Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 2/20

Type-II Generalized Feistel Structure (GFS) F F F F Split into k blocks k / 2 parallel mini-Feistel functions (easier to design) F Then a block-wise permutation π ∈ S k : CLEFIA ( k = 4), Simpara ( k = 4 , 6 , 8), TWINE ( k = 16) Problem: Diffusion needs more rounds Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 3/20

Maximum Diffusion Round (DR) 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 6 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 6 5 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 6 5 6 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 6 5 6 5 6 5 6 F F F F F F F F F F F F F F F F F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 6 5 6 5 6 5 6 Simple criterion F F F F Depends only on the F F F F permutation π Link with impossible F F F F differential and saturation attacks F F F F Encryption F F F F F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 6 5 6 5 6 5 6 Simple criterion F F F F Depends only on the F F F F permutation π Link with impossible F F F F differential and saturation attacks F F F F Encryption F F F F AND Decryption F F F F 6 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Maximum Diffusion Round (DR) 5 6 5 6 5 6 5 6 Simple criterion F F F F Depends only on the F F F F permutation π Link with impossible F F F F differential and saturation attacks F F F F Encryption F F F F AND Decryption F F F F here DR ( π ) = 6 6 5 6 5 6 5 6 5 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

Previous Works F F F F k DR ( rot ) min DR ( π ) Suzaki and Minematsu, FSE 2010 4 4 4 Focus on even-odd GFS ( S eo k ) 6 6 5 8 8 6 Exhaustive search for k ≤ 16 blocks 10 10 7 12 12 8 Power of two case : generic 14 14 8 construction in DR ( π ) = 2 log 2 k 16 16 8 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 5/20

Our Contributions k [SM10] this paper 4 4 4 Constructive upper-bound on the 6 5 5 number of even-odd GFS up to 8 6 6 equivalence 10 7 7 12 8 8 Exhaustive search for k ≤ 24 14 8 8 16 8 8 New criterion to reduce search 18 8 space: Collision-free depth 20 9 22 8 Power of two case: new 24 9 permutations based on graph 26 9 coloring 32 10 10 64 12 11 Case of non even-odd permutations 128 14 13 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 6/20

Equivalence of GFS F F F F Equivalence up to block reindexing Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

Equivalence of GFS F F F F Equivalence up to block reindexing Permutations of pairs: swap blocks in a pair-wise manner Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

Equivalence of GFS F F F F Equivalence up to block reindexing Permutations of pairs: swap blocks in a pair-wise manner S p k := { ϕ ∈ S k |∀ i ≤ k 2 − 1 , ϕ ( 2 i ) is even and ϕ ( 2 i + 1 ) = ϕ ( 2 i )+ 1 } Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

Equivalence of GFS F F F F Equivalence up to block reindexing Permutations of pairs: swap blocks in a pair-wise manner S p k := { ϕ ∈ S k |∀ i ≤ k 2 − 1 , ϕ ( 2 i ) is even and ϕ ( 2 i + 1 ) = ϕ ( 2 i )+ 1 } “Pair-equivalence”: S p k acts on S k by conjugation π 1 ≡ π 2 iff ∃ ϕ ∈ S p k s.t. π 1 = ϕ ◦ π 2 ◦ ϕ − 1 Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

Number of Even-odd GFS up to Pair-equivalence F F F F  S eo S k / 2 × S k / 2 → (even-odd GFS) k  Bijection:  Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

Number of Even-odd GFS up to Pair-equivalence F F F F  S eo S k / 2 × S k / 2 → (even-odd GFS) k  Bijection: � π ( 2 i ) = 2 π 1 ( i ) + 1 � ( π 1 , π 2 ) �→ π s.t. � π ( 2 i + 1 ) = 2 π 2 ( i )  � Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

Number of Even-odd GFS up to Pair-equivalence F F F F  S eo S k / 2 × S k / 2 → (even-odd GFS) k  Bijection: � π ( 2 i ) = 2 π 1 ( i ) + 1 � ( π 1 , π 2 ) �→ π s.t. � π ( 2 i + 1 ) = 2 π 2 ( i )  � ( k / 2 )! 2 ( k / 2 )! ≤ number of classes ≤ Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

Number of Even-odd GFS up to Pair-equivalence F F F F  S eo S k / 2 × S k / 2 → (even-odd GFS) k  Bijection: � π ( 2 i ) = 2 π 1 ( i ) + 1 � ( π 1 , π 2 ) �→ π s.t. � π ( 2 i + 1 ) = 2 π 2 ( i )  � Idea Only enumerate a single π 1 for each conjugacy class in S k / 2 w.r.t regular conjugation ( k / 2 )! 2 ( k / 2 )! ≤ number of classes ≤ Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

Number of Even-odd GFS up to Pair-equivalence F F F F  S eo S k / 2 × S k / 2 → (even-odd GFS) k  Bijection: � π ( 2 i ) = 2 π 1 ( i ) + 1 � ( π 1 , π 2 ) �→ π s.t. � π ( 2 i + 1 ) = 2 π 2 ( i )  � Idea Only enumerate a single π 1 for each conjugacy class in S k / 2 w.r.t regular conjugation ( k / 2 )! ≤ number of classes ≤ N k / 2 · ( k / 2 )! Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

Number of Even-odd GFS up to Pair-equivalence F F F F  S eo S k / 2 × S k / 2 → (even-odd GFS) k  Bijection: � π ( 2 i ) = 2 π 1 ( i ) + 1 � ( π 1 , π 2 ) �→ π s.t. � π ( 2 i + 1 ) = 2 π 2 ( i )  � Idea Only enumerate a single π 1 for each conjugacy class in S k / 2 w.r.t regular conjugation ( k / 2 )! ≤ number of classes ≤ N k / 2 · ( k / 2 )! Number of conjugacy class in S k / 2 : N k / 2 = O ( e π √ k / 3 ) Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20