Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round).

The advantage of heterogeneous UFNs is, that its internal properties change each round, making it more difficult to find specific characteristics which propagate through the different rounds.

On the other hand, homogenous UFNs seem to be cheaper (from a “resource-friendly” point of view) to implement in hardware, and related software implementations tend to be smaller.

Questions:

  1. Is there any way to generally define how much “security” we trade in when choosing a homogenous UFN over a heterogeneous UFN, or does that strongly depend on the individual implementations?

    I’m assuming the later to be true, but it would be comforting to have a confirmation on that.

  2. Except for the “cheaper” and “smaller” arguments, are there any other reasons why one would (or maybe even should) choose to use a homogenous UFN instead of a heterogeneous UFN?

    Differently asked: Does the choice between homogenous UFN and heterogeneous UFN merely depend on the available resources, or does any situation/scenario/protocol exist – which would imply that one should prefer to use a homogenous UFN due to some specific reason?

share|improve this question
1  
One advantage of simple algorithms is that analyzing them is less work. – CodesInChaos Aug 5 '14 at 14:57
    
One person who could give a really good answer to this is Thomas Pornin... You could email him if you don't have a satisfactory answer in a few days. – pg1989 Aug 6 '14 at 18:45
    
... or you could just tag @Thomas Pornin ;) – DrLecter Aug 6 '14 at 21:19
1  
Note that using a different round function for each round is not guaranteed to make it more difficult to find characteristics which propagate through the different rounds. At least for homogenous UFN there has been done some generic analysis (see e.g. schneier.com/cryptography/paperfiles/…). – Aleph Dec 15 '15 at 8:37
    
Related: slide attack – CodesInChaos Dec 19 '15 at 15:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.