# Do there exist cryptographic algorithms where the “core” function is 96-to-32-bit?

There exists a FOX family of block ciphers (Wikipedia article: IDEA NXT). This cipher uses a function called "f32" which operates on three 32-bit words and outputs one 32-bit word. This function exhibits very high diffusion properties and builds the core of the corresponding variant of the cipher.

Do there exist other cryptographic algorithms that make use of a 96-to-32-bit "core" function (the function is required to be non-linear and exhibit relatively good diffusion)?

• You could do that with any hash function. Just trim the output. Otherwise, you might be talking about ciphers with tweak values, where message + key + tweak value is used to create the ciphertext. – Natanael Sep 7 at 20:21
• I am asking about a function that is designed to operate on a block of 96 bits and output a single 32-bit word (or, if the function outputs 96 bits, any 32-bit subsequence is suitable). The only example I have found is the "f32" function in the FOX block cipher. The key property of such a function is that it is supposed to be used as the round function (that is, the core function on which the full algorithm is based). So this function is required to exhibit a relatively good (but maybe not ideal) level of diffusion as fast as possible. – lyrically wicked Sep 7 at 21:06
• Does it have to be exactly 96 to 32 bits? Why that specifically? It'd probably be easy to find a cryptographic function like this, but not a "core" function that exhibits non-linear properties and good diffusion by itself (e.g. you could probably find some boolean function that takes three 32-bit word inputs and has one 32-bit output, but it wouldn't be secure on its own). – forest Sep 8 at 0:38
• @forest: "Does it have to be exactly 96 to 32 bits? Why that specifically?" — because it would be very interesting for me to see such function (for educational purposes). A function that can be regarded as an alternative for the "f32" function in the FOX block cipher... Also note that the function is not expected to be secure on its own (it is expected to serve as the round function in some larger cryptographic algorithm). – lyrically wicked Sep 8 at 1:14