The Wikipedia page on the subject and other descriptions that I can find of it are as clear as mud. $L$ and $R$ are combined to make a number that is then added to both. That seems like a loss of information to me.
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
9
One Lai-Massey round can be described as $$ \begin{align} L' &= \sigma(L \oplus F_k(L \oplus R)) \\ R' &= R \oplus F_k(L \oplus R)\,, \end{align} $$ where $F_k$ is some round function—not necessarily invertible—and $\sigma(\cdot)$ is an orthomorphism, an arbitrary function such that both $\sigma(x)$ and $\sigma'(x) = \sigma(x) \oplus x$ are invertible.
To invert this, $$ \begin{align} L &= \sigma^{-1}(L') \oplus F_k(\sigma^{-1}(L') \oplus R') \\ R &= R' \oplus F_k(\sigma^{-1}(L') \oplus R')\,. \end{align} $$ We can see this works because $$ \begin{align} \sigma^{-1}(L') &= L \oplus F_k(L \oplus R)\,, \end{align} $$ and $$ \begin{align} \sigma^{-1}(L') \oplus R' &= L \oplus F_k(L \oplus R) \oplus R \oplus F_k(L \oplus R) \\ &= L \oplus R\,. \end{align} $$
-
$\begingroup$ Does $\sigma(\cdot)$ have to be applied to $L$? Can be applied to both $L$ and $R$? $\endgroup$– MelabOct 11, 2017 at 0:49
-
-
-
$\begingroup$ Yes, but only one or the other, not both. $\endgroup$ Oct 11, 2017 at 22:56
-