Tag Info

Hot answers tagged

16

Actually the article you link to does not says that a balanced Feistel cipher is less secure than an unbalanced one; it says that the security of an unbalanced Feistel cipher is more easily proven, given enough rounds. Luby and Rackoff have shown in 1988 that a balanced Feistel scheme with only 4 rounds is "perfectly" secure as long as the round functions ...


11

First of all, the avalanche effect is a desirable effect: it means that a very small change in the input will lead to a very big change in the output. A security algorithm that doesn't provide this avalanche effect can lead to an easy statistical analysis: if the change of one bit from the input leads to the change of only one bit of the output, then it's ...


9

DES actually demonstrated that a Feistel structure was not a guarantee against attacks. In "academic" terms, DES is broken by both differential and linear cryptanalysis, because they require, respectively, $2^{47}$ chosen plaintexts and $2^{43}$ known plaintexts, whereas the DES key is (effectively) 56 bits. Of course, for practical attacks, we would brute ...


9

Enigma is not a Feistel cipher. A "Feistel cipher" is a block cipher with a specific structure, namely the whole business with the two halves, the combination of one half with a (one-way) function of the other half and a reversible operation (e.g. XOR), and the swap. See the Wikipedia page which has nice schematics. So considering Enigma as a kind of ...


7

Well, AES is not a Feistel cipher because it's a substitution-permutation network instead. If I were taking a test that asked me why AES was not a Feistel cipher, this would be my argument: namely, that the structure of substitution-permutation networks is fundamentally different from that of Feistel networks. (Here one could elaborate on invertibility and ...


7

If such a network had only a single round, then you might have a valid concern. This is why there needs to be least three rounds, so that every bit from L can potentially affect every other bit from L (via R from the second round). It isn't a structural flaw, because multiple rounds are assumed. Changing this round structure would mean that it was no longer ...


7

No, this is not a structural weakness of Feistel networks. For instance, we know it can't hurt diffusion properties. Actually, we know that it's not a structural weakness. How do we know that? Because we have a proof of security for Feistel networks (under certain conditions and assumptions). Those proofs imply that there is not a structural weakness in ...


7

Luby and Rackoff published a famous article on that subject (SIAM Journal on Computing, 1988, Vol. 17, No. 2 : pp. 373-386 ). Namely, they showed that if the $F$ functions are pseudorandom, then four rounds are sufficient to achieve security. There are subtle details, though: Each round has its own $F$ function. We usually say that there is a single $F$ ...


6

No, it's not flawed. You're just running into a fact of life; differential cryptanalysis generally doesn't just give you the entire key (or even subkey) in one shot. It generally gives you partial information about the key, and if you want the entire key, well, you need to work at it more. In this phase of the attack, you know that the last round subkey ...


6

The question has morphed over time. I am answering the following. So to be sure, with DES, only when you encrypt something twice with a weak key. You get the back the original plaintext? That is correct as that is the definition of a DES weak key, a key for which encryption and decryption have the same effect. So when using DES in OFB mode with a ...


6

This will probably be OK. It does have some non-trivial side effects/caveats: The effective key length is reduced to 86 bits. Only the low 22 bits of each of the 4 key words will matter, so only 88 bits of the key material are relevant. Then, there are known equivalent-key properties of TEA that further reduce the effective key length to 86 bits. A ...


5

Usually, more rounds increase security as long as subkeys are independent of each other. That's a critical point. Consider AES-128 as currently defined, with its ten rounds; that's eleven 128-bit subkeys. Adding six rounds means adding six extra 128-bit subkeys. The original AES-128 is still there. If the six extra subkeys are generated independently of the ...


4

The simple way to build authenticated encryption using a Feistel Network is to build a Feistel based block cipher, then use one of the many modes of operation that turn a block cipher into an authenticated encryption scheme (eg CCM,OCB,GCM). For a good survey on the subject of modes-of-operation I would recommend this paper by Rogaway. It does not cover the ...


4

No, it's a rotor machine and more importantly, a stream cipher that operates on a character-by-character basis. Block ciphers operate on a chunk at a time. Feistel ciphers are a way to construct block ciphers. We could talk more about Feistel ciphers or more basically block ciphers, but that's not your question. At its most basic, Enigma is a stream cipher ...


4

A family of functions F is a pairwise independent permutation if: Each member of the family is itself a permutation, and For any fixed $A$, $B$ (with $A \ne B$, and both from the input set of the permutation), and $f$ is a random member from the family $F$, then the pair $f(A), f(B)$ is equidistributed over all distinct pairs from the output range of the ...


3

The text quoted in the question: States that in any (finite commutative) field $(A,+,\cdot)$, the distribution of the permutations $f_{(a,b)}$ defined by $f_{(a,b)}(x)=a\cdot x+b$, where $(a,b)$ is uniformly distributed on $A^*\times A$, is pair-wise independent, per the definition now given in the question. Observes that because $GF(2^n)$ is such a field, ...


3

Yes. This is called format-preserving encryption. The most flexible algorithm is FFX, which uses a Feistel network with AES-based round-functions, but performs addition modulo $m$. For certain values of $m$, the range of the round function is extended in order to limit statistical biases to negligible values. When $m$ is very small, this approach isn't ...


3

By definition, a Feistel network uses a series of rounds that split the input block into two sides, uses one side to permute the other side, then swaps the sides. As always, Wikipedia has a nice diagram. AES doesn't do this. Performing a round necessarily permutes the entire state. Each round consists of the SubBytes, ShiftRows, MixColumns, and AddRoundKey ...


2

There seem to be some errors or inconsistencies in the question. If $P \oplus P' = [0000\delta 000]$, and we use the 2-round structure shown in the picture, then the corresponding ciphertext pairs should satisfy $C \oplus C' = [xyzt\delta000]$. This is different from what you wrote (did you omit the final swap shown in the picture above?). If we let ...


2

A quick follow up, there is a problem with using DES in OFB mode when you are not using the full feedback register. The generated keystream will become cyclic with on average a period of the order $2^{32}$ instead of $2^{64}$. See (R.R. Jueneman, “Analysis of certain aspects of Output Feedback Mode,” Advances in Cryptology, Proceedings Crypto’82, D. ...


2

Yes, you certainly can. If you want a variable-length authenticated encryption mode, then simply take any Feistel cipher in the OCB mode. If fixed-length is fine, then the following idea should work. Build a wide Feistel-based permutation (fixed-key blockcipher) $G$ and encrypt $$ C = G(P||N||K)\oplus K, $$ where $N$ is nonce, $P$ is plaintext, $C$ is ...


2

Your Formulas are alright, but there is some additional information from the exercise/setup: The exercise states, that $F$ should be considered as a blackbox (otherwise you could use the internal stages of $F$, as poncho already suggested). However, as I understand it you can stil evaluate $F$ on any input of your choice. At this point, you can do a couple ...


1

What happens with the output of the round function and the previous half block? Nearly every Feistel networks XOR them. What happens if you XOR any block with an all "0" block? You get the previous block. Example in binary notation with 8-bit blocks: $$ \text{0100 1100} \oplus \text{0000 0000} = \text{0100 1100}$$ So even with a million rounds the output ...


1

If each round function outputs all $0$'s then if $r$ is an even number you get back original string. If $r$ is an odd number you just swap the $(L_0, R_0)$ components of the input. XOR basically has no effect on the string. Just follow the proof given in this answer Luby-Rackoff theorem confusion


1

The standard way to make best advantage of parallelism is to use a parallelizable mode of operation. For instance, counter mode (CTR mode) is highly parallelizable. Parallelism at the level of the mode of operation is typically more effective and easier to implement than parallelism inside the block cipher. The Feistel network approach to block ciphers is ...


1

Ff1,2,3 are basically inspired by LubyRack off constructions . At the core they differ in their round functions and key scheduling FF1 supports greater range of lengths and a tweak FF2 generates subkey for each iteration to thwart any side channel attacks FF3 has tweaks is split and used in rounding function, also the reverse the sub-strings of given ...


1

Luby rackoff results are based on assuming the Round Function to be Secure Pseudo Random Functions. Where as the round functions of DES are not that secure enough which needs more rounds (Triple DES needs 48 rounds )


1

As a page at ibm.com indicates, there could have been a bit of a "contra" attitude against Feistel ciphers thanks to DES having seen the first breaks in it's security etc. Down with the Feistel structure! In most ciphers, the round transformation has the well-known Feistel structure. In this structure typically part of the bits of the intermediate ...


1

A linear transformation in a block cipher is also considered an substitution, just not a non linear one. When they talk about active s-boxes, they are talking about not specifically about the nonlinear s-box, but a level of input being substituted with a different output. Combining these across multiple rounds results in what they call 'active' s-boxes. ...



Only top voted, non community-wiki answers of a minimum length are eligible