# Tag Info

4

The simple way to build authenticated encryption using a Feistel Network is to build a Feistel based block cipher, then use one of the many modes of operation that turn a block cipher into an authenticated encryption scheme (eg CCM,OCB,GCM). For a good survey on the subject of modes-of-operation I would recommend this paper by Rogaway. It does not cover the ...

4

A family of functions F is a pairwise independent permutation if: Each member of the family is itself a permutation, and For any fixed $A$, $B$ (with $A \ne B$, and both from the input set of the permutation), and $f$ is a random member from the family $F$, then the pair $f(A), f(B)$ is equidistributed over all distinct pairs from the output range of the ...

3

Yes. This is called format-preserving encryption. The most flexible algorithm is FFX, which uses a Feistel network with AES-based round-functions, but performs addition modulo $m$. For certain values of $m$, the range of the round function is extended in order to limit statistical biases to negligible values. When $m$ is very small, this approach isn't ...

3

The text quoted in the question: States that in any (finite commutative) field $(A,+,\cdot)$, the distribution of the permutations $f_{(a,b)}$ defined by $f_{(a,b)}(x)=a\cdot x+b$, where $(a,b)$ is uniformly distributed on $A^*\times A$, is pair-wise independent, per the definition now given in the question. Observes that because $GF(2^n)$ is such a field, ...

2

Yes, you certainly can. If you want a variable-length authenticated encryption mode, then simply take any Feistel cipher in the OCB mode. If fixed-length is fine, then the following idea should work. Build a wide Feistel-based permutation (fixed-key blockcipher) $G$ and encrypt $$C = G(P||N||K)\oplus K,$$ where $N$ is nonce, $P$ is plaintext, $C$ is ...

2

Your Formulas are alright, but there is some additional information from the exercise/setup: The exercise states, that $F$ should be considered as a blackbox (otherwise you could use the internal stages of $F$, as poncho already suggested). However, as I understand it you can stil evaluate $F$ on any input of your choice. At this point, you can do a couple ...

1

What happens with the output of the round function and the previous half block? Nearly every Feistel networks XOR them. What happens if you XOR any block with an all "0" block? You get the previous block. Example in binary notation with 8-bit blocks: $$\text{0100 1100} \oplus \text{0000 0000} = \text{0100 1100}$$ So even with a million rounds the output ...

1

If each round function outputs all $0$'s then if $r$ is an even number you get back original string. If $r$ is an odd number you just swap the $(L_0, R_0)$ components of the input. XOR basically has no effect on the string. Just follow the proof given in this answer Luby-Rackoff theorem confusion

1

The standard way to make best advantage of parallelism is to use a parallelizable mode of operation. For instance, counter mode (CTR mode) is highly parallelizable. Parallelism at the level of the mode of operation is typically more effective and easier to implement than parallelism inside the block cipher. The Feistel network approach to block ciphers is ...

1

Ff1,2,3 are basically inspired by LubyRack off constructions . At the core they differ in their round functions and key scheduling FF1 supports greater range of lengths and a tweak FF2 generates subkey for each iteration to thwart any side channel attacks FF3 has tweaks is split and used in rounding function, also the reverse the sub-strings of given ...

1

Luby rackoff results are based on assuming the Round Function to be Secure Pseudo Random Functions. Where as the round functions of DES are not that secure enough which needs more rounds (Triple DES needs 48 rounds )

Only top voted, non community-wiki answers of a minimum length are eligible