This is a simple 128-bit block cipher, reversibly changing a 32-bit word of the state at each of 4 steps shown. It is very similar to an unbalanced Feistel cipher, except that the change of state is with +=
rather than the conventional ^=
. In the context that deviation has three consequences, with the first rather desirable:
- It creates alternation of
^
and +
in the diffusion pattern.
- Decryption is less similar to encryption than in a Feistel cipher (I guess the decryption code use uses
-=
).
- Hardware implementation would be slightly bigger/more power hungry, perhaps even slightly slower; but 1 more than compensates, and that's a non-issue in software.
To hope for security, there must of course be MUCH more rounds than shown. We have not even reached full diffusion (nothing in B
or C
influenced the outcome of A
). As a crude reference, AES-128 modifies its full state 10 times (discounting the initial XOR with a subkey); and Speck-128-128 modifies it 16 times. Security will depend a lot on the number of rounds, on a sensible choice of table P
, and on the key schedule (producing the array k
of subkeys from the actual key).
Note: Implementation in software is likely to suffer from data cache timing dependencies and other cache-related side channels, due to indexing in P
at data-dependent indexes.
Note: as pointed by Poncho (correcting my mistakes), this cipher generates an even permutation; but that's not a weakness, since that reveals 1 bit of information only after $2^{128}-2$ input-output pairs are collected.