General Diffusion Analysis: How to Find Optimal Permutations for - - PowerPoint PPT Presentation

▶
general diffusion analysis how to find optimal
SMART_READER_LITE
LIVE PREVIEW

General Diffusion Analysis: How to Find Optimal Permutations for - - PowerPoint PPT Presentation

Aug 30, 2022 114 likes •814 views

General Diffusion Analysis: How to Find Optimal Permutations for Generalized Type-II Feistel Schemes Victor Cauchois 1 , 2 , Clment Gomez 1 , Gal Thomas 1 1 DGA Maitrise de lInformation, Bruz, France 2 IRMAR, Universit de Rennes 1,

slide-1
SLIDE 1

General Diffusion Analysis: How to Find Optimal Permutations for Generalized Type-II Feistel Schemes

Victor Cauchois1,2, Clément Gomez1, Gaël Thomas1

1DGA Maitrise de l’Information, Bruz, France 2IRMAR, Université de Rennes 1, Rennes, France

Fast Software Encryption — 2019-03-26 — Paris, France

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 1/20

slide-2
SLIDE 2

The Feistel Network

F F F

How to construct a permutation? Challenging task Split the problem in half and iterate DES, Camellia, Simon, . . .

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 2/20

slide-3
SLIDE 3

Type-II Generalized Feistel Structure (GFS)

F F F F

Split into k blocks k/2 parallel mini-Feistel functions

F

(easier to design) Then a block-wise permutation π ∈ Sk: CLEFIA (k = 4), Simpara (k = 4, 6, 8), TWINE (k = 16) Problem: Diffusion needs more rounds

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 3/20

slide-4
SLIDE 4

Maximum Diffusion Round (DR)

5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-5
SLIDE 5

Maximum Diffusion Round (DR)

5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-6
SLIDE 6

Maximum Diffusion Round (DR)

5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-7
SLIDE 7

Maximum Diffusion Round (DR)

5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-8
SLIDE 8

Maximum Diffusion Round (DR)

5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-9
SLIDE 9

Maximum Diffusion Round (DR)

5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-10
SLIDE 10

Maximum Diffusion Round (DR)

5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-11
SLIDE 11

Maximum Diffusion Round (DR)

5 6

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-12
SLIDE 12

Maximum Diffusion Round (DR)

5 6 5

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-13
SLIDE 13

Maximum Diffusion Round (DR)

5 6 5 6

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-14
SLIDE 14

Maximum Diffusion Round (DR)

5 6 5 6 5 6 5 6

F F F F F F F F F F F F F F F F F F F F F F F F

6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-15
SLIDE 15

Maximum Diffusion Round (DR)

5 6 5 6 5 6 5 6

F F F F F F F F F F F F F F F F F F F F F F F F

6

Simple criterion Depends only on the permutation π Link with impossible differential and saturation attacks Encryption

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-16
SLIDE 16

Maximum Diffusion Round (DR)

5 6 5 6 5 6 5 6

F F F F F F F F F F F F F F F F F F F F F F F F

6

Simple criterion Depends only on the permutation π Link with impossible differential and saturation attacks Encryption AND Decryption

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-17
SLIDE 17

Maximum Diffusion Round (DR)

5 6 5 6 5 6 5 6

F F F F F F F F F F F F F F F F F F F F F F F F

6 5 6 5 6 5 6 5

Simple criterion Depends only on the permutation π Link with impossible differential and saturation attacks Encryption AND Decryption here DR(π) = 6

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 4/20

slide-18
SLIDE 18

Previous Works

F F F F

Suzaki and Minematsu, FSE 2010 Focus on even-odd GFS (Seo

k )

Exhaustive search for k ≤ 16 blocks Power of two case : generic construction in DR(π) = 2 log2 k k DR(rot) min DR(π) 4 4 4 6 6 5 8 8 6 10 10 7 12 12 8 14 14 8 16 16 8

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 5/20

slide-19
SLIDE 19

Our Contributions

Constructive upper-bound on the number of even-odd GFS up to equivalence Exhaustive search for k ≤ 24 New criterion to reduce search space: Collision-free depth Power of two case: new permutations based on graph coloring Case of non even-odd permutations k [SM10] this paper 4 4 4 6 5 5 8 6 6 10 7 7 12 8 8 14 8 8 16 8 8 18 8 20 9 22 8 24 9 26 9 32 10 10 64 12 11 128 14 13

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 6/20

slide-20
SLIDE 20

Equivalence of GFS

F F F F

Equivalence up to block reindexing

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

slide-21
SLIDE 21

Equivalence of GFS

F F F F

Equivalence up to block reindexing Permutations of pairs: swap blocks in a pair-wise manner

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

slide-22
SLIDE 22

Equivalence of GFS

F F F F

Equivalence up to block reindexing Permutations of pairs: swap blocks in a pair-wise manner Sp

k := {ϕ ∈ Sk|∀i ≤ k 2 −1, ϕ(2i) is even and ϕ(2i+1) = ϕ(2i)+1}

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

slide-23
SLIDE 23

Equivalence of GFS

F F F F

Equivalence up to block reindexing Permutations of pairs: swap blocks in a pair-wise manner Sp

k := {ϕ ∈ Sk|∀i ≤ k 2 −1, ϕ(2i) is even and ϕ(2i+1) = ϕ(2i)+1}

“Pair-equivalence”: Sp

k acts on Sk by conjugation

π1 ≡ π2 iff ∃ϕ ∈ Sp

k s.t. π1 = ϕ ◦ π2 ◦ ϕ−1

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 7/20

slide-24
SLIDE 24

Number of Even-odd GFS up to Pair-equivalence

F F F F

Bijection:

   Sk/2 × Sk/2 → Seo

k

(even-odd GFS)

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

slide-25
SLIDE 25

Number of Even-odd GFS up to Pair-equivalence

F F F F

Bijection:

   Sk/2 × Sk/2 → Seo

k

(even-odd GFS) (π1, π2) → π s.t.

  • π(2i) = 2π1(i) + 1

π(2i + 1) = 2π2(i)

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

slide-26
SLIDE 26

Number of Even-odd GFS up to Pair-equivalence

F F F F

Bijection:

   Sk/2 × Sk/2 → Seo

k

(even-odd GFS) (π1, π2) → π s.t.

  • π(2i) = 2π1(i) + 1

π(2i + 1) = 2π2(i)

(k/2)! ≤ number of classes ≤ (k/2)!2

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

slide-27
SLIDE 27

Number of Even-odd GFS up to Pair-equivalence

F F F F

Bijection:

   Sk/2 × Sk/2 → Seo

k

(even-odd GFS) (π1, π2) → π s.t.

  • π(2i) = 2π1(i) + 1

π(2i + 1) = 2π2(i)

Idea Only enumerate a single π1 for each conjugacy class in Sk/2 w.r.t regular conjugation (k/2)! ≤ number of classes ≤ (k/2)!2

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

slide-28
SLIDE 28

Number of Even-odd GFS up to Pair-equivalence

F F F F

Bijection:

   Sk/2 × Sk/2 → Seo

k

(even-odd GFS) (π1, π2) → π s.t.

  • π(2i) = 2π1(i) + 1

π(2i + 1) = 2π2(i)

Idea Only enumerate a single π1 for each conjugacy class in Sk/2 w.r.t regular conjugation (k/2)! ≤ number of classes ≤ Nk/2 · (k/2)!

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

slide-29
SLIDE 29

Number of Even-odd GFS up to Pair-equivalence

F F F F

Bijection:

   Sk/2 × Sk/2 → Seo

k

(even-odd GFS) (π1, π2) → π s.t.

  • π(2i) = 2π1(i) + 1

π(2i + 1) = 2π2(i)

Idea Only enumerate a single π1 for each conjugacy class in Sk/2 w.r.t regular conjugation (k/2)! ≤ number of classes ≤ Nk/2 · (k/2)! Number of conjugacy class in Sk/2: Nk/2 = O(eπ√

k/3)

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 8/20

slide-30
SLIDE 30

Exhaustive search of Optimal Even-odd GFS

k min DR(π) Number of classes 6 5 1 8 6 2 10 7 3 12 8 32 14 8 23 16 8 13 18 8 2 20 9 2133 22 8 4 24 9 56

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 9/20

slide-31
SLIDE 31

Exhaustive search of Optimal Even-odd GFS

k min DR(π) Number of classes 6 5 1 8 6 2 10 7 3 12 8 32 14 8 23 16 8 13 18 8 2 20 9 2133 22 8 4 24 9 56 What happens with k = 18, 20 and 22?

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 9/20

slide-32
SLIDE 32

Exhaustive search of Optimal Even-odd GFS

k lower bound min DR(π) Number of classes 6 5 5 1 8 6 6 2 10 6 7 3 12 7 8 32 14 7 8 23 16 7 8 13 18 8 8 2 20 8 9 2133 22 8 8 4 24 8 9 56 What happens with k = 18, 20 and 22? − → lower bound

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 9/20

slide-33
SLIDE 33

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F F F F F F F F F F F F F F F F F F F F F

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-34
SLIDE 34

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F

1

F F F F F F F F F F F F F F F F F F F F

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-35
SLIDE 35

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F

1

F F F F

2

F F F F F F F F F F F F F F F F

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-36
SLIDE 36

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F F F F F F F F F

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-37
SLIDE 37

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F F F F F

Fibonacci Sequence

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-38
SLIDE 38

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F

7

F F F F

Fibonacci Sequence

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-39
SLIDE 39

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F

7

F F F F

Fibonacci Sequence Until Collision

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-40
SLIDE 40

Lower Bound on the Diffusion Round of Type-II GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F

7

F F F F

Fibonacci Sequence Until Collision Lower Bound: no collision happens 2 · Fib(DR(π)) ≥ k

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 10/20

slide-41
SLIDE 41

New Idea for finding good GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F

7

F F F F

k > 26 − → exhaustive search intractable

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 11/20

slide-42
SLIDE 42

New Idea for finding good GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F

7

F F F F

k > 26 − → exhaustive search intractable Restrict search space to cases where collisions happen late

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 11/20

slide-43
SLIDE 43

New Idea for finding good GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F

7

F F F F

k > 26 − → exhaustive search intractable Restrict search space to cases where collisions happen late New criterion: CD(π) Collision-free depth

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 11/20

slide-44
SLIDE 44

New Idea for finding good GFS

1

F F F F

1

F F F F

2

F F F F

3

F F F F

5

F F F F

7

F F F F

k > 26 − → exhaustive search intractable Restrict search space to cases where collisions happen late New criterion: CD(π) Collision-free depth here CD(π) = 3

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 11/20

slide-45
SLIDE 45

Collision-free Depths of Optimal Even-odd Permutations

k 16 18 20 22 24 min DR(π) 8 8 9 8 8 bound on CD 4 5 5 5 5 CD(π) 3 4 3 2 3 4 5 5 3 4 5 ♯ classes 9 4 2 165 1624 340 4 4 19 32 5

Tradeoff between search space size and number of results

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 12/20

slide-46
SLIDE 46

Interresting Case: k = 26

Exhaustive search too expensive

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 13/20

slide-47
SLIDE 47

Interresting Case: k = 26

Exhaustive search too expensive 2 · Fib(8) = 26: tight spot for the Fibonacci bound

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 13/20

slide-48
SLIDE 48

Interresting Case: k = 26

Exhaustive search too expensive 2 · Fib(8) = 26: tight spot for the Fibonacci bound DR(π) = 8 ⇒ CD(π) = 7

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 13/20

slide-49
SLIDE 49

Interresting Case: k = 26

Exhaustive search too expensive 2 · Fib(8) = 26: tight spot for the Fibonacci bound DR(π) = 8 ⇒ CD(π) = 7 Exhaustive search for CD(π) ≥ 4: best DR(π) = 10

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 13/20

slide-50
SLIDE 50

Interresting Case: k = 26

Exhaustive search too expensive 2 · Fib(8) = 26: tight spot for the Fibonacci bound DR(π) = 8 ⇒ CD(π) = 7 Exhaustive search for CD(π) ≥ 4: best DR(π) = 10 Random Search for CD(π) = 3: found DR(π) = 9

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 13/20

slide-51
SLIDE 51

Interresting Case: k = 26

Exhaustive search too expensive 2 · Fib(8) = 26: tight spot for the Fibonacci bound DR(π) = 8 ⇒ CD(π) = 7 Exhaustive search for CD(π) ≥ 4: best DR(π) = 10 Random Search for CD(π) = 3: found DR(π) = 9 ⇒ This MUST be optimal

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 13/20

slide-52
SLIDE 52

Tree and Block-Tree Representation

1 2 3 4 5 6 7

F F F F

1 2 3

F F F F F F F F F F F F

3 6 3 7 4 6 3 4 1 2 7 4 6 3 0 3

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 14/20

slide-53
SLIDE 53

Tree and Block-Tree Representation

1 2 3 4 5 6 7

F F F F

1 2 3

F F F F F F F F F F F F

3 6 3 7 4 6 3 4 1 2 7 4 6 3 1 1 2 3 1 2 3 1 2 3

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 14/20

slide-54
SLIDE 54

Tree and Block-Tree Representation

1 2 3 4 5 6 7

F F F F

1 2 3

F F F F F F F F F F F F

3 6 3 7 4 6 3 4 1 2 7 4 6 3 1 1 2 3 1 2 3 1 2 3

Grouping blocks by pair is used in [SM10]

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 14/20

slide-55
SLIDE 55

Pros and Cons of Block-Tree Representation

Pros: Balanced Binary Tree Fewer nodes Simpler structure 1 1 2 3 0 1 2 3 0 1 2 3 Cons: Does not uniquely represent a permutation π Where do even and odd nodes go within a block? − → Need to specify it as an edge-colouring

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 15/20

slide-56
SLIDE 56

Candidates yielding good GFS?

00 01 10 11 1 1 1 1

1 1 2 3 0 1 2 3 0 1 2 3 De Bruijn graph used by [SM10]

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 16/20

slide-57
SLIDE 57

Candidates yielding good GFS?

00 01 10 11 1 1 1 1

1 1 2 3 0 1 2 3 0 1 2 3 De Bruijn graph used by [SM10] Fill with the least possible value

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 16/20

slide-58
SLIDE 58

Candidates yielding good GFS?

00 01 10 11 1 1 1 1

1 1 2 3 0 1 2 3 0 1 2 3 De Bruijn graph used by [SM10] Fill with the least possible value Many ways to color the graph Exhaust in O(2k/4)

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 16/20

slide-59
SLIDE 59

Candidates yielding good GFS?

00 01 10 11 1 1 1 1

1 1 2 3 0 1 2 3 0 1 2 3 De Bruijn graph used by [SM10] Fill with the least possible value Many ways to color the graph Exhaust in O(2k/4) Some may yield better DR(π)

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 16/20

slide-60
SLIDE 60

Candidates yielding good GFS?

00 01 10 11 1 1 1 1

1 1 2 3 0 1 2 3 0 1 2 3 De Bruijn graph used by [SM10] Fill with the least possible value Many ways to color the graph Exhaust in O(2k/4) Some may yield better DR(π) k [SM10] this paper 8 6 6 16 8 8 32 10 10 64 12 11 128 14 13

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 16/20

slide-61
SLIDE 61

Until now...

Constructive upper-bound on the number of even-odd GFS up to equivalence Exhaustive search for k ≤ 24 New criterion to reduce search space: Collision-free depth Power of two case: new permutations based on graph coloring Case of non even-odd permutations k [SM10] this paper 4 4 4 6 5 5 8 6 6 10 7 7 12 8 8 14 8 8 16 8 8 18 8 20 9 22 8 24 9 26 9 32 10 10 64 12 11 128 14 13

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 17/20

slide-62
SLIDE 62

Number of non even-odd Permutations Classes

Even-odd case (k/2)! ≤ number of classes ≤ Nk/2 · (k/2)!

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 18/20

slide-63
SLIDE 63

Number of non even-odd Permutations Classes

Even-odd case (k/2)! ≤ number of classes ≤ Nk/2 · (k/2)! General case k! (k/2)! ≤ number of classes ≤ Nk · k! (k/2)!

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 18/20

slide-64
SLIDE 64

Number of non even-odd Permutations Classes

Even-odd case (k/2)! ≤ number of classes ≤ Nk/2 · (k/2)! General case k! (k/2)! ≤ number of classes ≤ Nk · k! (k/2)! Nk: Conjugacy class representatives

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 18/20

slide-65
SLIDE 65

Number of non even-odd Permutations Classes

Even-odd case (k/2)! ≤ number of classes ≤ Nk/2 · (k/2)! General case k! (k/2)! ≤ number of classes ≤ Nk · k! (k/2)! Nk: Conjugacy class representatives k! (k/2)!: Right-coset representatives of Sk mod Sp

k

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 18/20

slide-66
SLIDE 66

Number of non even-odd Permutations Classes

Even-odd case (k/2)! ≤ number of classes ≤ Nk/2 · (k/2)! General case k! (k/2)! ≤ number of classes ≤ Nk · k! (k/2)! Nk: Conjugacy class representatives k! (k/2)!: Right-coset representatives of Sk mod Sp

k

Exhaustive search k ≤ 20: no result better than even-odds

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 18/20

slide-67
SLIDE 67

Conclusion

Study of type-II Generalized Feistel Structures Permutations up to pair-equivalence Constructive upper-bound Exhaustive search up to k ≤ 24 (even-odd) or k ≤ 20 (general) Permutations with no collision in the early rounds Improved Results for k = 64 and 128

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 19/20

slide-68
SLIDE 68

Thank you for your attention. Do you have any questions?

Optimal Permutations for Generalized Type-II Feistel Schemes Cauchois, Gomez, Thomas FSE 2019-03-26 20/20