# How to design number of rounds in my cipher?

I have specific cipher which is built from permutations. It has or should has few rounds. If we do 2 rounds it is like 2 permutation composition. 3 rounds are like composition of 3 permutations and so on.

It is 128-bit block cipher, so every permutation has $$2^{128}$$ elements. Every unique permutation can be define by key. Keys are pairs of odd numbers from $$-2^{128}$$ to $$2^{128}$$. What's more - every permutation changes exactly 50% of input bits in average.

My problem is how to design number of rounds vs size of round keys? Let's say we want to security level equal to 128-bits. Theoretically we can use exactly $$2^{128}$$ permutations define by $$2^{128}$$ keys, but I would like to limit key sizes. For example - choose partial keys from the collection: -7,-5,-3,-1,1,3,5,7. Now make a round keys: (-7,-7), (-7,-5), ..., (7,7). We have 64 of them. Every pair is key and define specific $$2^{128}$$-element permutation in my cipher. Now we can composite rounds. Let's do 21 rounds. So we need 21 keys from our 64-element collection. In the end our main KEY is 21-element variation with repetition. $$64^{21}$$ is about $$2^{128}$$. So we have good security level.

But let's say we would like to do 5-rounds. We can make another version on this algoritm, we can choose partial keys: $$(-2^{13}-1)$$, $$(-2^{13}-3)$$, ..., $$(2^{13}-1)$$. Now we can make $$2^{13} \cdot 2^{13}$$ pairs, which gives 67108864 keys. So we can compose $$2^{26}$$ permutations. We can choose 5 different keys in 5 rounds. It gives $$(2^{26})^{5}$$ variations with repetition in 5 rounds - again about $$2^{128}$$.

How to decide how many rounds and how big keys my cipher should have? For safety reasons, is it better to use 5 rounds with larger keys or 21 rounds with smaller keys? Theoretically, you can even choose one of 3-bit to 128-bit key and make one round. I do not want to talk about possible types of attacks on this cipher (I analyze it independently) or about what is faster, beacuse there are many nuances in this cipher. I am only interested in the issue of security. Is it possible to prove that in such conditions there must be at least 3, 7, 10 rounds?

• Designing a block cipher, and even re-parametrizing an existing one, is hard. I suggest Bruce Schneier's self-study counrse, and pondering this fact: everyone can make a cipher he can't break. – fgrieu Jun 20 at 6:50
• " I do not want to talk about possible types of attacks on this cipher" - until you do, I can't see how you can make any coherent decisions about the design. – poncho Jun 20 at 12:00
• I meant that there are other independently potential weaknesses in this cipher. They can be helpful in designing the number of rounds, but I don't want to write about them here. I just wanted to know which variation with repetitions is easier to attack. If it can be decided at all. I have only such a thought that more rounds will provide better confusion and it will be more difficult to attack differential. But how many rounds make sense in that point of view? I don't know. – Tom Jun 20 at 19:57
• I realized one thing. This is a rather unusual cipher. We can freely choose the number of rounds and the size of the keys for the rounds. The only thing that limits the size of the keys is the block length. So we can easily get literally a security level of 2^128 (not 128, like AES ), and more. If we can easily do 5 round with security level 128 and also 20 round with security level 128 - let's not specify the number of rounds at all, we only have to associate them with the size of the keys. Then you can do 5,6,7 rounds and also 100 rounds, you just have to choose the right size of keys. – Tom Jun 21 at 3:00