11
$\begingroup$

Unbalanced Feistel networks can be homogenous (F-function identical in each round), or they can be heterogeneous (F-function not always identical in each round).

The advantage of heterogeneous UFNs is, that their internal properties change each round, making it more difficult to find specific characteristics which propagate through the different rounds.

On the other hand, homogenous UFNs seem to be cheaper (from a “resource-friendly” point of view) to implement in hardware, and related software implementations tend to be smaller.

Questions:

  1. Is there any way to generally define how much “security” we trade in when choosing a homogenous UFN over a heterogeneous UFN, or does that strongly depend on the individual implementations?

    I’m assuming the later to be true, but it would be comforting to have a confirmation on that.

  2. Except for the “cheaper” and “smaller” arguments, are there any other reasons why one would (or maybe even should) choose to use a homogenous UFN instead of a heterogeneous UFN?

    Differently asked: Does the choice between homogenous UFN and heterogeneous UFN merely depend on the available resources, or does any situation/scenario/protocol exist which would imply that one should prefer to use a homogenous UFN due to some specific reason?

Improve this question
$\endgroup$
5
  • 2
    $\begingroup$ One advantage of simple algorithms is that analyzing them is less work. $\endgroup$ – CodesInChaos Aug 5 '14 at 14:57
  • 1
    $\begingroup$ Note that using a different round function for each round is not guaranteed to make it more difficult to find characteristics which propagate through the different rounds. At least for homogenous UFN there has been done some generic analysis (see e.g. schneier.com/cryptography/paperfiles/…). $\endgroup$ – Aleph Dec 15 '15 at 8:37
  • $\begingroup$ Related: slide attack $\endgroup$ – CodesInChaos Dec 19 '15 at 15:23
  • 1
    $\begingroup$ If you model the F-functions as s-boxes (NxM bit mappings), this question appears to become similar to this question about the number of s-boxes in a cipher. Still looking forward to a proper answer to this question though... $\endgroup$ – Ella Rose Jul 31 '16 at 3:24
  • $\begingroup$ Iota in keccak is the only function to depend on round constants. Without it, a block of zeros should pass through unchanged. Iota information on slide 18. Related to slide attack as previously mentioned. $\endgroup$ – Q-Club Aug 7 '17 at 14:11
2
$\begingroup$
  1. There is no “generally definable” security trade-off, unless there’s something wrong with one of the algorithms itself… and if, that could be proven easier in the case of homogenous UFNs.
  2. Using homogenous UFNs makes security proofs easier as they are easier to analyze while heterogenous UFNs tend to make cryptanalysis (and security proofs) more problematic. This can be a valid argument to choose a homogenous over a heterogeneous UFN.
Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.