Hot answers tagged

8

A Feistel network is a way of constructing an invertible permutation from a (possibly non-invertible) function. If the function used is pseudorandom and has a large domain, then 3-4 rounds yields a pseudorandom permutation (3 rounds suffice if the adversary can only ask "compute" queries, and 4 rounds are needed if the adversary can ask "invert" queries). ...


5

Yes you could use a hash function as round function, but if you are using the "same key" over all rounds, you are vulnerable to slide attacks. Using a hash function is not a very good idea. Your round function should not introduce biases, should not lead to special differences (attack: differential cryptanalysis), and it should also not be writable as a ...


5

The simple answer is that fewer than 3 rounds can be easily distinguished from a random permutation. The 2-round Luby-Rackoff cipher on $2n$ bits, using random functions $f_i$ mapping $n$ bits to $n$ bits, consists of $$ F(L, R) = (A, B), $$ where $A = L \oplus f_1(R)$ and $B = R \oplus f_2(L \oplus f_1(R))$. Now consider an attacker that wants to ...


5

If a message is longer than the block length, how would changing one part of the message affect the encryption of other parts of the message? That really doesn't depend on the block cipher in use, which may be a feistel cipher like DES or a SP network like AES, but on the mode of operation. Now the answer to this really depends on the actual mode ...


3

In a Feistel networks (from the German IBM cryptographer Horst Feistel), the input is divided into two blocks ($L_0$ and $R_0$) which interact with each other. Main example is DES. basic construction: In a SPN (Substitution Permutation Network), the input is divided into multiple small blocks, applied to a S-box (substitution), then the bits positions ...


3

It's required for diffusion and achieving the avalanche effect. The concept of diffusion and the avalanche effect basically means that each input bit should influence each output bit evenly. Changing one input bit should flip, on average, half the output bits. Due to the nature of the Feistel construction, how it is split up into halves, only one side ...


3

I've been toying around with your function, and I've come to the conclusion it's not memory hard. The amount of required memory can be reduced to at maximum digestsize * 3 * rounds. The first problem is that the entropy does not avalanche throughout the state, but stays localized. For example, after 1 round the state of the 2nd block only depends on the ...


3

I know that all the subkeys $k_i$ are derived from the main key $K$, but how? However the cipher designer feel like. The Feistel design gives guidance as to how the block is processed (and in a way to make inverting the cipher easy), however it gives no guidance as to actually generate the subkeys. The designers can do anything they like, and still ...


2

why it should strictly be bijective instead of injective or surjective? Actually, it is injective and it is surjective; the term bijective just means that it satisfies both the properties of injectivity and surjectivity. Injective does not mean that there is a 'skip' (that's "not surjective"); instead, it states that no two different inputs give the ...


2

Use a Hadamard code via the fast Walsh Hadamard transform, it can correct up to $2^{n-2}$ errors for block length $2^n$ and is also locally decidable so you may not need too many code word coordinates.


1

There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as asked) a secure mini SPN or even a hash function (Sha3...) it doubles the block size, so the number of rounds can be doubled at no perf cost If you meant ...


1

About the security of your first variation, it is sort of answered here. This is your 1st variation. This is your 2nd variation (your $8 \times 8$ matrix idea is equivalent to apply a permutation). In your first variation, the application of the matrix is useless, one can consider the $S1$ (or $S2$) and the matrix as a single S-box. Hence you have no ...


1

In a Feistel network you can use ANY function and it will be invertible. Of course, in order to get security you need the function to fulfill some property. One of the main reasons to use a Feistel network is to get a pseudorandom permutation. For this to work, you need 3 or 4 rounds of Feistel with a pseudorandom function (with tweaks or independent keys at ...


1

First of all, you don't include a key; I'll assume that the sbox is the key. However, even with that assumption, it still doesn't meet the general expected requirements for a block cipher. In the decrypt direction, any one byte of the decrypted result depends only on 16 (!) bytes of the ciphertext block. This can be seen by considering the inverse of the ...


1

We really only need one plaintext-ciphertext pair, but the second can be used as a way to check candidate keys. Make a guess to the final subkey (ie guess all of them). Decrypt the final round of your ciphertext using your key. Store this result and the subkey you used. Repeat for all 2^16 candidates for the final subkey. Make a guess for the first three ...



Only top voted, non community-wiki answers of a minimum length are eligible