Return to Answer

I've been thinking a little bit about it, and now I think it is possible, but you have to consider the generalization of CFB in ISO 10116, as described by Rogaway (I don't have access to the ISO 10116 standard).

The generalization of CFB from the ISO standard seems to have two main changes:

• The feedback block (FB), of size $r$, can be longer than the input block (IB), of size $n$. The IB is constructed with the left $n$ bits of the FB.
• A new parameter $k$ specifies how much the previous feedback block is shifted to the left on each step.

For each new plaintext block, the feedback block (FB) will be made of three parts:

1. The least significant $r - k$ bits of the previous (FB)
2. A sequence of one bits, of size $k - s$
3. The previous ciphertext bits, of size $s$

We are used to the case where $r = n$ and $k = s$ (e.g., the NIST 800-38A specification), so there is no sequence of one bits. However, when $r\ge n+s $, the input block for the block cipher will only take bits from the previous feedback block (FB) and one-bits, and not from the previous ciphertext bits since it only takes the left $n$ bits from the FB. This way you could partially parallelize the encryption operation.

I've been thinking a little bit about it, and now I think it is possible, but you have to consider the generalization of CFB in ISO 10116 (I don't have access to the ISO 10116 standard, so I will assume that the description by Rogaway is correct).

The generalization of CFB from the ISO standard seems to have two main changes:

• The feedback block (FB), of size $r$, can be longer than the input block (IB), of size $n$. The IB is constructed with the left $n$ bits of the FB.
• A new parameter $k$ specifies how much the previous feedback block is shifted to the left on each step.

For each new plaintext block, the feedback block (FB) will be made of three parts:

1. The least significant $r - k$ bits of the previous FB
2. A sequence of one bits, of size $k - s$
3. The previous ciphertext bits, of size $s$

We are used to the case where $r = n$ and $k = s$ (e.g., the NIST 800-38A specification), so there is no sequence of one bits. However, when $r\ge n+s $, the input block for the block cipher will only take bits from the previous FB and one-bits, and not from the previous ciphertext bits since it only takes the left $n$ bits from the FB. This way you could partially parallelize the encryption operation.

A very illustrative way to understand why this allows some parallelization is to imagine a very very long feedback block, much greater than the input block. If you append the previous ciphertext to the right of the FB, shift the FB just a little to the left and take the left part of the resulting FB as your new IB, then the ciphertext will not take part of the new IB, at least for some rounds. These rounds are then parallelizable. Adjusting parameters $k$ and $r$ allow to precisely define the parallelization factor.

I've been thinking a little bit about it, and now I think it is possible, but you have to consider the generalization of CFB in ISO 10116, as described by Rogaway.

The generalization of CFB from the ISO standard seems to have two main changes:

• The feedback block (FB), of size $r$, can be longer than the input block (IB), of size $n$. The IB is constructed with the left $n$ bits of the FB.
• A new parameter $k$ specifies how much the previous feedback block is shifted to the left on each step.

For each new plaintext block, the feedback block (FB) will be made of three parts:

1. The least significant $r - k$ bits of the previous (FB)
2. A sequence of one bits, of size $k - s$
3. The previous ciphertext bits, of size $s$

We are used to the case where $r = n$ and $k = s$ (e.g., the NIST 800-38A specification), so there is no sequence of one bits. However, when $r\ge n+s $, the input block for the block cipher will only take bits from the previous feedback block (FB) and one-bits, and not from the previous ciphertext bits since it only takes the left $n$ bits from the FB. This way you could partially parallelize the encryption operation.

I've been thinking a little bit about it, and now I think it is possible, but you have to consider the generalization of CFB in ISO 10116, as described by Rogaway (I don't have access to the ISO 10116 standard).

The generalization of CFB from the ISO standard seems to have two main changes:

• The feedback block (FB), of size $r$, can be longer than the input block (IB), of size $n$. The IB is constructed with the left $n$ bits of the FB.
• A new parameter $k$ specifies how much the previous feedback block is shifted to the left on each step.

For each new plaintext block, the feedback block (FB) will be made of three parts:

1. The least significant $r - k$ bits of the previous (FB)
2. A sequence of one bits, of size $k - s$
3. The previous ciphertext bits, of size $s$

We are used to the case where $r = n$ and $k = s$ (e.g., the NIST 800-38A specification), so there is no sequence of one bits. However, when $r\ge n+s $, the input block for the block cipher will only take bits from the previous feedback block (FB) and one-bits, and not from the previous ciphertext bits since it only takes the left $n$ bits from the FB. This way you could partially parallelize the encryption operation.

I've been thinking a little bit about it, and now I think it is possible, but you have to consider the generalization of CFB in ISO 10116, as described by Rogaway.

The generalization of CFB from the ISO standard has two main changes, as described by Rogaway:

• The feedback block (FB), of size $r$, can be longer than the input block (IB), of size $n$. The IB is constructed with the left $n$ bits of the FB.
• A new parameter $k$ specifies how much the previous feedback block is shifted to the left on each step.

For each new plaintext block, the feedback block (FB) will be made of three parts:

1. The least significant r - k bits of the previous (FB)
2. A sequence of one bits, of size k - s
3. The previous ciphertext bits, of size s

We are used to the case where k = s, so there is no sequence of one bits. However, when $r\ge n+s $, the input block for the block cipher will only take bits from the previous (FB) and one-bits, since it only takes the left $n$ bits from the FB, so you could parallelize that operation (i.e., there is no feedback).

I've been thinking a little bit about it, and now I think it is possible, but you have to consider the generalization of CFB in ISO 10116, as described by Rogaway.

The generalization of CFB from the ISO standard seems to have two main changes:

• The feedback block (FB), of size $r$, can be longer than the input block (IB), of size $n$. The IB is constructed with the left $n$ bits of the FB.
• A new parameter $k$ specifies how much the previous feedback block is shifted to the left on each step.

For each new plaintext block, the feedback block (FB) will be made of three parts:

1. The least significant $r - k$ bits of the previous (FB)
2. A sequence of one bits, of size $k - s$
3. The previous ciphertext bits, of size $s$

We are used to the case where $r = n$ and $k = s$ (e.g., the NIST 800-38A specification), so there is no sequence of one bits. However, when $r\ge n+s $, the input block for the block cipher will only take bits from the previous feedback block (FB) and one-bits, and not from the previous ciphertext bits since it only takes the left $n$ bits from the FB. This way you could partially parallelize the encryption operation.