Bit constants are often added to the key schedule to reduce slide attacks. I have reviewed David Wagner's work, where he showed that the increased rounds in a Feistel network do not help if you have key symmetry. I have been trying to find some work that describes if a round-based bit-constant stream could be used to reduce the rounds and not hinder the safety margin.

For instance, let's say that you had a cipher that had 36 rounds, and you can attack 32 of them, where the key schedule contained a round-based constant stream based on an LFSR. Could round-constants be used in different places to allow the same fundamental architecture to be used in 32 rounds where you can attack up to 28? I've been unsuccessful in finding something like this in literature.

My motivation behind this is that there are a lot of ciphers out there, and some of them would be better for actual hardware implementation if they were a few rounds shorter. If I have a 32-round cipher, I can easily just use a shift register to control the rounds.

The question: has anyone looked at taking a cipher that existed and decreased the round requirements without ruining the cryptographic performance by the addition of bit constants per round?

Addendum 1: I've been exploring this question a little bit as continued literature searches haven't found anything that's helpful. Slide attacks invalidate the idea that even simple round functions are strong even with many rounds. I looked at this with SIMON32/64 because it has the simplest round function that I know combined with the fact that I wrote a simulation framework for them so I could tweak the code.

enter image description here

Firstly, it makes me wonder why slide attacks weren't invented earlier, as the image above shows how wonderfully symmetric the simple key schedule just happens to be with the LFSR input. Secondly, as the strength of the cipher largely depends on the key rounds, it makes me more convinced that someone has looked at reducing rounds in already existing ciphers by modifying the key schedule a bit.

  • 1
    $\begingroup$ Would you be able to be more specific with your link to increased Feistel rounds please? He's got a shed load of papers... $\endgroup$
    – Paul Uszak
    Commented Jul 6, 2018 at 20:46
  • $\begingroup$ Sir, I do not quite understand you question, I think slide attack is not a big deal with modem block cipher with even very simple constants. In my opinion, many attacks do not even use key schedules like differential and integral. I recommend the paper of Li et al about key bridging technique which you can find relations about keys automatically. $\endgroup$
    – Felix LL
    Commented Jul 11, 2018 at 6:48
  • $\begingroup$ How much data would you need to encrypt with these ciphers? If it's only a trivial amount, you could get away with fewer rounds by using a smaller block size. Simon32/64 has only 32 rounds, for example. It would probably be safe to use Simon32/128 (even though it's not formally defined) and use 32 rounds, as long as the puny 32 bit block size is adequate (which it may be, depending on how much you are encrypting). $\endgroup$
    – forest
    Commented Feb 26, 2019 at 2:30
  • $\begingroup$ @forest It's mostly a question about simplification. In the case of Simon128/256, you have 72 rounds. It would cost many fewer circuits to only have 64 rounds due to layout and resets, combined with a power bonus. This question was mostly about if you can make a stronger round by making key relationships more difficult to discover for the advantage of power. $\endgroup$
    – b degnan
    Commented Feb 26, 2019 at 2:37
  • $\begingroup$ b, you've clearly devoted a great deal of time to this matter. And that's good. Is there though something deeper that you're exploring? $\endgroup$
    – Paul Uszak
    Commented Dec 25, 2021 at 5:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.