4
$\begingroup$

I have seen that given blockciphers $F,G : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$, their cascade $F \circ G$ is defined to be $F \circ G : \mathcal{K}^2 \times \mathcal{M} \times \mathcal{M}$ via $(F \circ G)_{(K,K')}(M) = G_{K'}(F_K(M))$. My question is why it's done this way around, not the other order?

In "standard life" (see Wiki article), if I have two functions $f,g : X \to X$, then $(f \circ g)(x) = f(g(x))$. However above, writing $f = F_K$ and $g = G_{K'}$, we have, in essence, $(f \circ g)(m) = g(f(m))$.

I understand that it's just a formal convention, but it seems strange to pick the formal convention which is (or rather, appears to me to be) counter to the previously established convention.

Incidentally, I saw this notation in Hoang-Morris-Rogaway, twice on page 6.

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ I'm pretty sure this is not standard in cryptography, but I guess some authors define $(f \circ g)(x) = g(f(x))$ rather than $f(g(x))$. This is also mentioned in a footnote on Wikipedia. $\endgroup$
    – Aleph
    Commented Feb 27, 2017 at 17:22
  • $\begingroup$ Ok, fair enough! I did wonder if that might be the case, but I'm very new to crypto, so didn't want to assume! That said, I'm doing a maths PhD currently and I've never seen anyone actually use $(f \circ g)(x) = g(f(x))$. When I learned about these things in first year, I was told that some do, but I guess I'd just come to think that no-one really did, certainly not in the mainstream. Looks like maybe I'm wrong! (Note that Morris is a probabilist by trade, like myself, not a compsci. Obviously we can crossover though!) $\endgroup$
    – Sam OT
    Commented Feb 27, 2017 at 17:44

1 Answer 1

Reset to default
0
$\begingroup$

It's at the authors discretion. See the footnote in the book (below). Also Wikipedia makes it clear.

function composition:

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thanks for your answer, but what you said was actually already covered in the comments :) -- interesting, though, to see a group theory(?) book that uses that convention; as in the comments, in all my (not that many) years, I've never actually come across an example (until now!) $\endgroup$
    – Sam OT
    Commented Mar 2, 2017 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.