Lai-Massey scheme

One rationale for Lai-Massey design is to achieve full diffusion in a single round compared to SPN and Feistel (hence less rounds number) due to use of multiplication-􏰅addition (MA) function. However , it is not as common as SPN and Feistel structures.

1. Are there other advantages/disadvantages of Lai-Massey over SPN and Feistel? why is it not common?
2. what role does modulo multiplication arithmetic play in securing against probability cryptanalysis such as differential, linear, integral etc? especially when sub key modulo multiplication is used?
3. In the description of IDEA cipher , the representation of 16 bit subblock is represent as radix-two representation of an integer except that the all-zero subblock is treated as representing $$2^{16}$$ , for example: $$(0,...,0)\odot(1,0,...,0) = (1,0,...,0,1)$$ $$2^{16}2^{15} \space mod \space (2^{16}+1)= 2^{15}+1$$

Why is all-zero subblock represented as $$2^{16}$$?

• Also note that more complexity isn't always better as it hinders analysis and thus us building confidence in a scheme's security. – SEJPM Feb 6 at 12:56

IDEA combines three commutative group laws on the same set $$[0,2^{16})$$ (16-bit words)

• $$\oplus$$, which is bitwise exclusive-OR
• $$\boxplus$$, which is addition modulo $$2^{16}$$
• $$\odot$$ as constructed from modular multiplication modulo $$2^{16}+1$$, but replacing $$0$$ with $$2^{16}$$ before modular multiplication, and replacing $$2^{16}$$ with $$0$$ after modular multiplication.
It follows that $$0\odot0=1$$, $$0\odot1=0$$, and $$0\odot x=2^{16}+1-x$$ when $$x\in[2,2^{16})$$.

The replacements are there to remap the multiplicative group $$\Bbb Z^*_{2^{16}+1}$$, which is the full interval $$[1,2^{16}]$$ (because $$2^{16}+1$$ is prime), onto the same interval $$[0,2^{16})$$ as the two other laws $$\oplus$$ and $$\boxplus$$.

Per comment: If we tried to apply the same technique to 32-bit words, the law $$\odot$$ would still be internal, associative, commutative, with $$1$$ the neutral element. But since $$2^{32}+1$$ is not prime, some elements would have no inverse, thus $$\odot$$ would no longer be a group law. Therefore, precautions would need to be taken to avoid using these non-invertible values (6701057 out of 4294967296, or 0.16%) as any of the subkeys $$Z_1^{(j)}$$, $$Z_4^{(j)}$$, $$Z_5^{(j)}$$, $$Z_6^{(j)}$$, in order to make decryption possible.

• Thank you very much , a trivial question , does the remap apply when modulo multiplication $2^{32}$+1 , as $2^{32}$+1 is not prime? – hardyrama Feb 6 at 12:22
• Thank your for the answer to my comment . I think this will be a disadvantage of Lai-Massey in 32 bit word – hardyrama Feb 6 at 14:00