Tag Info

Hot answers tagged

4

A family of functions F is a pairwise independent permutation if: Each member of the family is itself a permutation, and For any fixed $A$, $B$ (with $A \ne B$, and both from the input set of the permutation), and $f$ is a random member from the family $F$, then the pair $f(A), f(B)$ is equidistributed over all distinct pairs from the output range of the ...


3

Yes. This is called format-preserving encryption. The most flexible algorithm is FFX, which uses a Feistel network with AES-based round-functions, but performs addition modulo $m$. For certain values of $m$, the range of the round function is extended in order to limit statistical biases to negligible values. When $m$ is very small, this approach isn't ...


3

The text quoted in the question: States that in any (finite commutative) field $(A,+,\cdot)$, the distribution of the permutations $f_{(a,b)}$ defined by $f_{(a,b)}(x)=a\cdot x+b$, where $(a,b)$ is uniformly distributed on $A^*\times A$, is pair-wise independent, per the definition now given in the question. Observes that because $GF(2^n)$ is such a field, ...


2

Your Formulas are alright, but there is some additional information from the exercise/setup: The exercise states, that $F$ should be considered as a blackbox (otherwise you could use the internal stages of $F$, as poncho already suggested). However, as I understand it you can stil evaluate $F$ on any input of your choice. At this point, you can do a couple ...


2

I understand that if a block cipher has $k$-bit keys and $n$-bit input/output blocks, then if $k>n$, we can expect one message-ciphertext pair to narrow us down (I think?) to $2^{k−n}$ possible keys, right? That is approximately correct (if the block cipher with the wrong key acts like a random permutation; this is generally a safe assumption); if ...


1

You're missing a component : a padding convention. Yes, if you're trying to reduce a block size, it will reduce the cipher strength. That's why the less-sized blocks are padded/filled to fit the exact size. What to do : pad or fill or both - that is a question. First you need to understand, that the more predictible the message, the less secure the ...


1

What happens with the output of the round function and the previous half block? Nearly every Feistel networks XOR them. What happens if you XOR any block with an all "0" block? You get the previous block. Example in binary notation with 8-bit blocks: $$ \text{0100 1100} \oplus \text{0000 0000} = \text{0100 1100}$$ So even with a million rounds the output ...


1

If each round function outputs all $0$'s then if $r$ is an even number you get back original string. If $r$ is an odd number you just swap the $(L_0, R_0)$ components of the input. XOR basically has no effect on the string. Just follow the proof given in this answer Luby-Rackoff theorem confusion


1

The standard way to make best advantage of parallelism is to use a parallelizable mode of operation. For instance, counter mode (CTR mode) is highly parallelizable. Parallelism at the level of the mode of operation is typically more effective and easier to implement than parallelism inside the block cipher. The Feistel network approach to block ciphers is ...



Only top voted, non community-wiki answers of a minimum length are eligible