Extended Generalized Feistel Networks using Matrix Representation - PowerPoint PPT Presentation

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Extended Generalized Feistel Networks using Matrix Representation Thierry P. Berger 1 , Marine Minier 2 , Gaël Thomas 1 1 XLIM (UMR CNRS 7252), Université de Limoges 123 avenue Albert Thomas, 87060 Limoges Cedex thierry.berger@unilim.fr gael.thomas@unilim.fr 2 Université de Lyon, INRIA INSA-Lyon, CITI, F-69621, Villeurbanne marine.minier@insa-lyon.fr SAC 2013, August 15, 2013 This work was partially supported by the French National Agency of Research: ANR-11-INS-011. Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 1/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Generalized Feistel Networks Introduced by Zheng, Matsumoto, and Imai at CRYPTO‘89 Splits the message into k ≥ 2 n -bit-long blocks Made of two consecutive layers: round-function layer and block-permutation layer Different flavors of GFNs, according to the round-function layer x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 round-function layer F F F F permutation layer y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 Pro: fitted for small scale implementation (Block size = Sbox size) Con: "diffusion" between blocks gets poorer as k grows Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 2/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example The Generalized Feistel Flavors x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 F F F F F F y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 Type-1 (CAST-256, Lesamnta) Type-2 (HIGHT, CLEFIA) Type-3 x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 F F F F y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 Source Heavy (RC2, SHA-1) Target Heavy (MARS) Nyberg’s Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 3/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Table of Contents Full Diffusion Delay 1 Matrix of a Feistel Network 2 New Feistel Networks Proposals 3 An Efficient Example 4 Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 4/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Full Diffusion Delay F F F F Introduced by Suzaki and Minematsu at FSE‘10 F F F F Minimum number of rounds d + for F F F F every inputs to influence every outputs Depends solely on the structure of the F F F F network, not on the round-functions used F F F F d − : similarly defined when performing F F F F decryption We consider encryption and decryption F F F F important, thus we look at: d = max ( d + , d − ) . F F F F Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 5/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Graph Point of View x 6 x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 x 5 x 7 F F F F F x 4 x 0 F F F x 3 x 1 y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 x 2 Graph of a Feistel Network: obtained by folding outputs onto the corresponding inputs Represents the structure of the Network Full diffusion delay d + : smallest distance such that for all vertices couple ( u , v ) there exists a path of length d + going from u to v Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 6/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Full Diffusion Delay of Generalized Feistel Networks x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 F F F F F F y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 Type-1 (CAST-256, Lesamnta) Type-2 (HIGHT, CLEFIA) Type-3 d = ( k − 1 ) 2 + 1 d = k d = k x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 F F F F y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 Source Heavy (RC2, SHA-1) Target Heavy (MARS) Nyberg’s d = k d = k d = k Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 7/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example An Improvement of Type-2 x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 round-function layer F F F F permutation layer y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 Proposed by Suzaki and Minematsu at FSE‘10 Idea: Replace the cyclic shift of the permutation layer by any block-wise permutation Includes Nyberg’s GFNs Full diffusion delay d goes from k to 2 log 2 k for optimum permutations x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 F F F F y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 8/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Improve Type-1, Type-3, Source-Heavy and Target-Heavy? x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 x 0 x 1 x 2 x 3 F F F F F F y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 y 0 y 1 y 2 y 3 Type-1 Type-3 Source Heavy Target Heavy Studied by Yanagihara and Iwata at IEICE Trans. 2013 Same idea as Suzaki and Minematsu: allow any block permutation P Source Heavy and Target-Heavy cannot be improved Full diffusion delay of Type-1 drops from ( k − 1 ) 2 + 1 to k ( k + 2 ) / 2 − 2 No general construction for Type-3 but found permutations with d ≤ 4 for k ≤ 8 Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 9/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Matrix of a Feistel Network x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 round-function layer F F F F permutation layer y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 a GFN is made of a round-function layer and a permutation layer The permutation layer can be represented 1   1 by a permutation matrix P  1    1 P =   1     1    1  1 Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 10/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Matrix of a Feistel Network x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 round-function layer F F F F permutation layer y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 a GFN is made of a round-function layer and a permutation layer The permutation layer can be represented 1   1 by a permutation matrix P  1    1 P =   1 Idea: Represent the round-function layer     1   by a matrix F with:  1  1 an all-one diagonal 1   a parameter F at position ( i , j ) when F 1  1  y P ( i ) = F ( x j ) ⊕ x i   F 1 F =    1    F is a formal parameter merely indicating F 1    1  the presence of a round-function F 1 Matrix of the whole GFN defined as M = P × F Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 10/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Type-2 Feistel Network and its corresponding Matrix x 6 x 5 x 7 x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 F F F F F F x 4 x 0 x 3 x 1 F y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 F x 2 F 1 1 1       1 1 F 1 F 1 1 1             1 1 F 1       M = P = F =  F 1   1   1        1 1 F 1        F 1   1   1  1 1 F 1 M is the adjacency matrix of the graph associated to the GFN d + is the smallest integer such that M d + has no zero coefficient Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 11/24

Introduction Full Diffusion Delay Matrix of a Feistel Network New Feistel Networks Proposals An Efficient Example Properties we require from GFNs GFNs transforms round-functions into a permutation, hence decryption mode matrix M − 1 should not contain any “ F − 1 ” ⇒ det ( M ) = ± 1. → verified for all classical GFNs GFNs are quasi-involutive: encryption/decryption is the same process up to using direct/inverse permutation layer P . → verified for all classical GFNs except Type-3 x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 F F F F F F F y 0 y 1 y 2 y 3 y 4 y 5 y 6 y 7 Thierry P. Berger, Marine Minier, Gaël Thomas Extended Generalized Feistel Networks using Matrix Rep. 12/24