Generalized Feistel Networks with Optimal Diffusion Léo Perrin DTU, Lyngby Inria, Paris Dagstuhl 2018 (seminar-18021)
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion In this talk A new type of generalized Feistel Networks Linear layer design Wide block cipher/sponge permutation blueprint Fibonnaci numbers! 1 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Outline 1 Introduction Observations on GFNs 2 Multi-Rotating Feistel Network (MRFN) 3 Possible Applications 4 Conclusion 5 1 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion First GFN Source: Generalized Feistel networks , K. Nyberg (1996) 2 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Basic GFN Source: Generalized Feistel networks revisited , A. Bogdanov, K. Shibutani (2013) 3 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Improved GFN Source: TWINE: A Lightweight, Versatile Block Cipher , T. Suzaki, K. Minematsu, S. Morioka, and E. Kobayashi 4 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Diffusion in Generalized Feistel networks How long does it take for each input word to influence each output word? The state consists of 2 b branches. 5 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Diffusion in Generalized Feistel networks How long does it take for each input word to influence each output word? The state consists of 2 b branches. Nyberg/Type-II GFN: ≈ 2 b rounds 5 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Diffusion in Generalized Feistel networks How long does it take for each input word to influence each output word? The state consists of 2 b branches. Nyberg/Type-II GFN: TWINE-like GFN: ≈ 2 log 2 ( b ) rounds ≈ 2 b rounds 5 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion General Vue X i X i X i X i X i X i X i X i 0 1 2 3 4 5 6 7 f ⊕ f ⊕ f ⊕ f ⊕ π Optimal Diffusion The best we can achieve is for X 0 0 to influence ϕ i + 2 branches at round i , where ϕ 0 = 0 , ϕ 1 = 1 , ϕ i + 2 = ϕ i + 1 + ϕ i . 6 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Diffusion in GFNs b 8 16 32 64 128 .. 2048 Nyberg Type-II/Nyberg 16 32 64 128 256 4096 TWINE-like 6 8 10 12 14 22 Optimal 6 8 9 11 12 18 Number of rounds for full diffusion. 7 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Can we reach the Fibonacci-based bound? Can we have an easy to implement π ? 8 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Can we reach the Fibonacci-based bound? Can we have an easy to implement π ? Yes (for both) 8 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Outline 1 Introduction Observations on GFNs 2 Multi-Rotating Feistel Network (MRFN) 3 Possible Applications 4 Conclusion 5 8 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion General Structure Number of branches: 2 b Number of rounds: r w -bit permutations f i j ( i < r , j < b ) Sequence s i of rotations of b words. The round i of a MRFN with b = 4 and s i = 1 is: f i 0 f i 1 f i 2 f i 3 9 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Some Observations Both a Feistel network and a GFN π is very simple (1 word-wise rotation per round) Round function depends on the round index. Interesting case: s i = ϕ i . 10 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Some Observations Both a Feistel network and a GFN π is very simple (1 word-wise rotation per round) Round function depends on the round index. Interesting case: s i = ϕ i . Fibonacci Case A MRFN with s i = ϕ i has optimal diffusion. 10 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Fibonacci Case At round 0, X 0 0 has touched the first ϕ 1 = 1 branches of one side. ϕ i + 1 ϕ i X i X i − 1 ϕ i ϕ i + ϕ i + 1 F i ⊕ ϕ i + 2 ϕ i + 1 X i + 1 X i 11 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Example with 12 branches ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ 0 = 0 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ 1 = 1 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ 2 = 1 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ 3 = 2 ⊕ ⊕ ⊕ ϕ 4 = 3 ⊕ ⊕ ⊕ 12 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Implementation b b w VRound function operating on 2 bw bit internal state. 13 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Implementation b b w 1. copy 13 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Implementation b b w f i f i f i f i f i f i f i f i f i f i 1 2 3 4 5 6 7 8 9 10 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 2. parallel layer of f i 13 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Implementation b b w ≪ s i ≪ s i ≪ s i 3. rotations 3. rotations 3. rotations 13 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Implementation b b ⊕ w ⊕ ⊕ 4. XOR 4. XOR 4. XOR 13 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Implementation b b w 5. swap 13 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Implementation b b w 6. finished! 13 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Some Observations s i and s i + ( − ℓ ) i mod b are equivalent if gcd ( s i , b ) � 1 for all i , no full diffusion! Importance of the choice of { s i } i ≥ 0 14 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Security If s i = ϕ i , then full diffusion in ≈ Λ( n ) rounds, where Λ( x ) = i if ϕ i − 1 < x ≤ ϕ i (optimal). If s 2 i = 0 and i 2 i + 1 = 2 i , then full diffusion in ≈ 2 log 2 ( n ) rounds (like TWINE). Both are quickly safe from miss-in-the-middle based impossible differential atacks and MitM! 15 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Security If s i = ϕ i , then full diffusion in ≈ Λ( n ) rounds, where Λ( x ) = i if ϕ i − 1 < x ≤ ϕ i (optimal). If s 2 i = 0 and i 2 i + 1 = 2 i , then full diffusion in ≈ 2 log 2 ( n ) rounds (like TWINE). Both are quickly safe from miss-in-the-middle based impossible differential atacks and MitM! When s i = ϕ i , bad truncated differential with 2 active S-Boxes/round. 15 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Security If s i = ϕ i , then full diffusion in ≈ Λ( n ) rounds, where Λ( x ) = i if ϕ i − 1 < x ≤ ϕ i (optimal). If s 2 i = 0 and i 2 i + 1 = 2 i , then full diffusion in ≈ 2 log 2 ( n ) rounds (like TWINE). Both are quickly safe from miss-in-the-middle based impossible differential atacks and MitM! When s i = ϕ i , bad truncated differential with 2 active S-Boxes/round. Open Problem 1 Differential/Linear bound? Open Problem 2 Choice of { s i } i ≥ 0 ? 15 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion Outline 1 Introduction Observations on GFNs 2 Multi-Rotating Feistel Network (MRFN) 3 Possible Applications 4 Conclusion 5 15 / 20
Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion GFN-based Linear Layers Use linear { f i } i ≥ 0 ; s i = ϕ i n -bit block divided into 2 b branches of w bits uses: w 2 × b × 2 log 2 ( b ) XORs . 2 � ���� �� ���� � ���� r f i j � ����� �� ����� � f layer 16 / 20
Recommend
More recommend
