Timeline for What is the inverse of this variant of the Gimli SP-box?
Current License: CC BY-SA 4.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 19, 2023 at 3:02 | vote | accept | lyrically wicked | ||
| Oct 19, 2023 at 3:01 | comment | added | lyrically wicked | @kelalaka: you asked about $(1, 0, 0)$ and $(2, 0, 0).$ The purpose of my previous comment was to show that they evaluate to two different outputs, as expected for an invertible bijective function. | |
| Oct 18, 2023 at 22:45 | answer | added | Samuel Neves | timeline score: 3 | |
| Oct 17, 2023 at 15:36 | comment | added | Samuel Neves | godbolt.org/z/rMjWfGosK | |
| Oct 17, 2023 at 10:16 | comment | added | kelalaka | Well, while we were implementing the cryptography, two people were assigned so that they independently write and compare the steps and results. Sometimes, they stuck in the same error. Do you expect me to find an error in your code or in my (weak) argument? Writing a good code requires testing... | |
| Oct 17, 2023 at 8:08 | comment | added | lyrically wicked |
@kelalaka: I have spbox([1, 0, 0]) == [0, 3, 4294967293], spbox([2, 0, 0]) == [0, 6, 4294967288] (for 32-bit words).
|
|
| Oct 17, 2023 at 7:55 | comment | added | kelalaka | $(1,0,0),(2,0,0)$? | |
| Oct 17, 2023 at 7:45 | comment | added | lyrically wicked | @LightBit: I tested various combinations of the shift distances; it seems that they do not affect the invertibility. Note that the linked paper contains the following statement: "we searched through many combinations of possible shift distances". This suggests that there is no particular combination that prevents the SP-box from being invertible (assuming that all distances are greater than zero). | |
| Oct 17, 2023 at 7:36 | comment | added | LightBit | I suspect Gimli's "invspbox" only works, if shifts are different for each word. | |
| Oct 17, 2023 at 7:36 | comment | added | lyrically wicked | @kelalaka: I still cannot find two triples of words that evaluate to the same output. | |
| Oct 17, 2023 at 7:27 | comment | added | kelalaka | Fix $z=0$ (we still need surjective), then $Z = y \oplus ((x \& y) << 1)$, now set $y=0$ then $Z = 0$ for any values of $x$ | |
| Oct 17, 2023 at 7:19 | comment | added | lyrically wicked |
@kelalaka: can you give two triples (T1, T2) of 32-bit words (or, say, 4-bit or 16-bit words) such that spbox(T1) is equal to spbox(T2)? That will prove that the modified SP-box is non-bijective.
|
|
| Oct 17, 2023 at 7:11 | comment | added | kelalaka |
No, it can't Z = z ^ y ^ ((z ^ (x & y)) << 1) the $&$ make is non-bijective. Consider that when $y=[0,\ldots,0]$ then for any value of $x$ the $(x \& y)$ Is zero. The other values are x-or and shifts that cannot make it bijective.
|
|
| Oct 17, 2023 at 6:48 | comment | added | lyrically wicked |
@kelalaka: Proving that this SP-box is invertible is maybe even a bit harder than doing this for the original SP-box, which is already non-trivial. But I computed the spbox for all possible triples of 4-bit and 6-bit words (instead of 32-bit words), and it seems that the function is bijective (which implies that it is invertible).
|
|
| Oct 17, 2023 at 6:39 | comment | added | lyrically wicked |
@LightBit: yes, I have seen that invspbox function. Based on this information, I tried to write the inverse for the modified spbox, but my algorithm did not output the correct results.
|
|
| Oct 17, 2023 at 6:23 | comment | added | LightBit | You can start with unmodified inverse Gimli spbox you can find in project.inria.fr/quasymodo/files/2020/05/… (invspbox in datatypes.cpp). | |
| Oct 17, 2023 at 4:12 | history | edited | lyrically wicked | CC BY-SA 4.0 |
added 7 characters in body
|
| Oct 17, 2023 at 3:59 | history | asked | lyrically wicked | CC BY-SA 4.0 |