[PPT] - Generalized Feistel Networks with Optimal Diffusion Lo Perrin DTU, PowerPoint Presentation

SLIDE 1

Generalized Feistel Networks with Optimal Diffusion

Léo Perrin

DTU, Lyngby Inria, Paris

Dagstuhl 2018 (seminar-18021)

SLIDE 2

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

In this talk

A new type of generalized Feistel Networks Linear layer design Wide block cipher/sponge permutation blueprint Fibonnaci numbers!

1 / 20

SLIDE 3

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Outline

1 Introduction

2 Observations on GFNs

3 Multi-Rotating Feistel Network (MRFN)

4 Possible Applications

5 Conclusion

1 / 20

SLIDE 4

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

First GFN

Source: Generalized Feistel networks , K. Nyberg (1996)

2 / 20

SLIDE 5

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Basic GFN

Source: Generalized Feistel networks revisited, A. Bogdanov, K. Shibutani (2013)

3 / 20

SLIDE 6

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Improved GFN

Source: TWINE: A Lightweight, Versatile Block Cipher, T. Suzaki, K. Minematsu, S. Morioka, and E. Kobayashi

4 / 20

SLIDE 7

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Diffusion in Generalized Feistel networks

How long does it take for each input word to influence each output word? The state consists of 2b branches.

5 / 20

SLIDE 8

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Diffusion in Generalized Feistel networks

How long does it take for each input word to influence each output word? The state consists of 2b branches. Nyberg/Type-II GFN: ≈ 2b rounds

5 / 20

SLIDE 9

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Diffusion in Generalized Feistel networks

How long does it take for each input word to influence each output word? The state consists of 2b branches. Nyberg/Type-II GFN: ≈ 2b rounds TWINE-like GFN: ≈ 2 log2(b) rounds

5 / 20

SLIDE 10

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

General Vue

π X i f ⊕ X i

4 X i

1 f ⊕ X i

5 X i

2 f ⊕ X i

6 X i

3 f ⊕ X i

7

Optimal Diffusion

The best we can achieve is for X 0

0 to influence ϕi+2 branches at round i,

where ϕ0 = 0, ϕ1 = 1, ϕi+2 = ϕi+1 + ϕi .

6 / 20

SLIDE 11

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Diffusion in GFNs

b 8 16 32 64 128 .. 2048 Nyberg Type-II/Nyberg 16 32 64 128 256 4096 TWINE-like 6 8 10 12 14 22 Optimal 6 8 9 11 12 18 Number of rounds for full diffusion.

7 / 20

SLIDE 12

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Can we reach the Fibonacci-based bound? Can we have an easy to implement π?

8 / 20

SLIDE 13

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Can we reach the Fibonacci-based bound? Can we have an easy to implement π? Yes (for both)

8 / 20

SLIDE 14

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Outline

1 Introduction

2 Observations on GFNs

3 Multi-Rotating Feistel Network (MRFN)

4 Possible Applications

5 Conclusion

8 / 20

SLIDE 15

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

General Structure

Number of branches: 2b Number of rounds: r w-bit permutations f i

j (i < r, j < b)

Sequence si of rotations of b words. The round i of a MRFN with b = 4 and si = 1 is: f i f i

1 f i

2 f i

3

9 / 20

SLIDE 16

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Some Observations

Both a Feistel network and a GFN π is very simple (1 word-wise rotation per round) Round function depends on the round index. Interesting case: si = ϕi.

10 / 20

SLIDE 17

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Some Observations

Both a Feistel network and a GFN π is very simple (1 word-wise rotation per round) Round function depends on the round index. Interesting case: si = ϕi.

Fibonacci Case

A MRFN with si = ϕi has optimal diffusion.

10 / 20

SLIDE 18

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Fibonacci Case

At round 0, X 0

0 has touched the first ϕ1 = 1 branches of one side.

ϕi+1 ϕi X i X i−1 ϕi ϕi + ϕi+1 ϕi+2 ϕi+1 X i+1 X i Fi ⊕

11 / 20

SLIDE 19

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Example with 12 branches

ϕ0 = 0 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ1 = 1 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ2 = 1 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ3 = 2 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ϕ4 = 3 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕

12 / 20

SLIDE 20

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Implementation

w b b VRound function operating on 2bw bit internal state.

13 / 20

SLIDE 21

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Implementation

w b b

1. copy

13 / 20

SLIDE 22

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Implementation

w b b f i

1

2. parallel layer of f i

f i

2

2. parallel layer of f i

f i

3

2. parallel layer of f i

f i

4

2. parallel layer of f i

f i

5

2. parallel layer of f i

f i

6

2. parallel layer of f i

f i

7

2. parallel layer of f i

f i

8

2. parallel layer of f i

f i

9

2. parallel layer of f i

f i

10

2. parallel layer of f i

13 / 20

SLIDE 23

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Implementation

w b b ≪ si

3. rotations

≪ si

3. rotations

≪ si

3. rotations

13 / 20

SLIDE 24

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Implementation

w b b ⊕

4. XOR

⊕

4. XOR

⊕

4. XOR

13 / 20

SLIDE 25

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Implementation

w b b

5. swap

13 / 20

SLIDE 26

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Implementation

w b b

6. finished!

13 / 20

SLIDE 27

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Some Observations

si and si + (−ℓ)i mod b are equivalent if gcd(si,b) 1 for all i, no full diffusion! Importance of the choice of {si}i ≥0

14 / 20

SLIDE 28

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Security

If si = ϕi, then full diffusion in ≈ Λ(n) rounds, where Λ(x) = i if ϕi−1 < x ≤ ϕi (optimal). If s2i = 0 and i2i+1 = 2i, then full diffusion in ≈ 2 log2(n) rounds (like TWINE). Both are quickly safe from miss-in-the-middle based impossible differential atacks and MitM!

15 / 20

SLIDE 29

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Security

If si = ϕi, then full diffusion in ≈ Λ(n) rounds, where Λ(x) = i if ϕi−1 < x ≤ ϕi (optimal). If s2i = 0 and i2i+1 = 2i, then full diffusion in ≈ 2 log2(n) rounds (like TWINE). Both are quickly safe from miss-in-the-middle based impossible differential atacks and MitM! When si = ϕi, bad truncated differential with 2 active S-Boxes/round.

15 / 20

SLIDE 30

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Security

If si = ϕi, then full diffusion in ≈ Λ(n) rounds, where Λ(x) = i if ϕi−1 < x ≤ ϕi (optimal). If s2i = 0 and i2i+1 = 2i, then full diffusion in ≈ 2 log2(n) rounds (like TWINE). Both are quickly safe from miss-in-the-middle based impossible differential atacks and MitM! When si = ϕi, bad truncated differential with 2 active S-Boxes/round.

Open Problem 1

Differential/Linear bound?

Open Problem 2

Choice of {si}i ≥0?

15 / 20

SLIDE 31

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Outline

1 Introduction

2 Observations on GFNs

3 Multi-Rotating Feistel Network (MRFN)

4 Possible Applications

5 Conclusion

15 / 20

SLIDE 32

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

GFN-based Linear Layers

Use linear {f i}i ≥0; si = ϕi n-bit block divided into 2b branches of w bits uses: w2 2

f i

j

×b

f layer

× 2 log2(b)

r

XORs .

16 / 20

SLIDE 33

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

GFN-based Linear Layers

Use linear {f i}i ≥0; si = ϕi n-bit block divided into 2b branches of w bits uses: w2 2

f i

j

×b

f layer

× 2 log2(b)

r

XORs . If we fix w to a small value, then the number of XORs scales with n log2(n) rather than n2.

16 / 20

SLIDE 34

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

GFN-based Linear Layers

Use linear {f i}i ≥0; si = ϕi n-bit block divided into 2b branches of w bits uses: w2 2

f i

j

×b

f layer

× 2 log2(b)

r

Sponge function?

n = 384, with b = 64 and w = 3 f i

j (x) = χ3(x ⊕ ci j)

s2i = 0,s2i+1 = 2i for 0 ≤ i < 2 log2(b) = 12, then repeat (4? times): s = {0, 1, 0, 2, 0, 4, 0, 8, 0, 16, 0, 32}

18 / 20

SLIDE 47

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Sponge function?

n = 384, with b = 64 and w = 3 f i

j (x) = χ3(x ⊕ ci j)

s2i = 0,s2i+1 = 2i for 0 ≤ i < 2 log2(b) = 12, then repeat (4? times): s = {0, 1, 0, 2, 0, 4, 0, 8, 0, 16, 0, 32}

Efficiency estimates

On 64-bit processors, for each round: 3 word copies 3 word-wise AND 3+3+3 word-wise XORs Maybe safe for 48 rounds if ≥ 8 active f functions/round on average.

18 / 20

SLIDE 48

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Other?

MiMC-like construction where f i

j (x) = (x + ci j)3 (what Arnab just

presented).

19 / 20

SLIDE 49

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Other?

MiMC-like construction where f i

j (x) = (x + ci j)3 (what Arnab just

presented). You tell me!

19 / 20

SLIDE 50

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Outline

1 Introduction

2 Observations on GFNs

3 Multi-Rotating Feistel Network (MRFN)

4 Possible Applications

5 Conclusion

19 / 20

SLIDE 51

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Conclusion

Fun stuff happens when we allow the use of different permutations in each round!

Open problems

1 What are good sequences of rotations? 2 How to bound number of active f functions? 3 What can we use it for? 4 What happens in other structures (SPN? ARX?) when the linear layers

are round-dependent?

20 / 20

SLIDE 52

Introduction Observations on GFNs Multi-Rotating Feistel Network (MRFN) Possible Applications Conclusion

Conclusion

Fun stuff happens when we allow the use of different permutations in each round!

Open problems

1 What are good sequences of rotations? 2 How to bound number of active f functions? 3 What can we use it for? 4 What happens in other structures (SPN? ARX?) when the linear layers

are round-dependent? Thank you!

20 / 20