Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round).

The advantage of heterogeneous UFNs is, that its internal properties change each round, making it more difficult to find specific characteristics which propagate through the different rounds.

On the other hand, homogenous UFNs seem to be cheaper (from a “resource-friendly” point of view) to implement in hardware, and related software implementations tend to be smaller.

Questions:

  1. Is there any way to generally define how much “security” we trade in when choosing a homogenous UFN over a heterogeneous UFN, or does that strongly depend on the individual implementations?

    I’m assuming the later to be true, but it would be comforting to have a confirmation on that.

  2. Except for the “cheaper” and “smaller” arguments, are there any other reasons why one would (or maybe even should) choose to use a homogenous UFN instead of a heterogeneous UFN?

    Differently asked: Does the choice between homogenous UFN and heterogeneous UFN merely depend on the available resources, or does any situation/scenario/protocol exist, which implies that one should prefer to use a homogenous UFN due to some specific reason?

share|improve this question
1  
One advantage of simple algorithms is that analyzing them is less work. –  CodesInChaos Aug 5 at 14:57
1  
"The advantage of heterogenous UFNs is, that its internal properties change each round, making it more difficult to find specific characteristics which propagate through the different rounds" - is that correct? Or, does it make it harder to show that there is no such exploitable differential? Does the security of a heterogenous UFN depend on all (or at least, most) of the round functions? If so, why does using different ones make security better? –  poncho Aug 5 at 15:03
    
One person who could give a really good answer to this is Thomas Pornin... You could email him if you don't have a satisfactory answer in a few days. –  pg1989 Aug 6 at 18:45
    
... or you could just tag @Thomas Pornin ;) –  DrLecter Aug 6 at 21:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.