Análisis e interpretación de las fichas de observación de los grupos de control y

A SPN as described in Section 1.2 on page 25 often needs two different circuits or routines 21

to perform both encryption and decryption. Even if they can be optimised somewhat (as we 22

saw when comparing the two example designs of Figure 1.2 on page 26), the issue can still 23

adversely impact performance tradeoffs in resource constrained environments. An elegant so- 24

lution to this problem was presented in the late 60s by IBM cryptographer Horst Feistel. During 25

the development of the Lucifer family of block ciphers he invented a structure that allows iter- 26

ated ciphers to be built in a way such that encryption and decryption are essentially the same 27

operation. 28

Feistel’s idea, in its simplest form, constructs a round as follows: The state is split into two 29

halves, calledbranches; a function, called theF-function, is computed on the first half, called 30

thesourcebranch; the result of this operation is composed with the other half of the state, called 31

thetarget, in a reversible way – the source branch remains unchanged until now; finally, the 32

two branches are swapped. 33

For the composition of the transform of the source to the target, usually the XOR is used because 34

the effect of XORing with some value is reversed by XORing again with the same value, but, as 35

we mentioned in the previous section, other composition operations may be used. 36

Let the state be written as𝐿‖𝑅, as the concatenation of the two branches. The plaintext is the 37

initial state𝐿₁‖𝑅₁. A round computes state𝐿_𝑖+1‖𝑅_𝑖+1from𝐿_𝑖‖𝑅_𝑖as follows: 38

{

𝑅_𝑖+1= 𝐿_𝑖⊛ 𝐹(𝑅_𝑖, 𝑘_𝑖)

𝐿𝑖+𝑖 = 𝑅𝑖

The ciphertext is the state𝐿_𝑟+1‖𝑅_𝑟+1after𝑟rounds. The round keys𝑘₁, … , 𝑘_𝑟are derived from 39

Figure 1.3: Schema of a Feistel Cipher Plaintext Key IP 𝐿₁ 𝑅₁

∗

𝐹 𝐿₂ 𝑅₂

∗

𝐹 𝐿3 𝑅3

∗

𝐹 𝐿_𝑟 𝑅_𝑟

∗

𝐹 𝐿_𝑟+1 𝑅_𝑟+1 FP Ciphertext KS 𝑘₁ 𝑘₂ 𝑘₃ 𝑘_𝑟

the key though a key schedule. A graphical depiction of the cipher is given in Figure1.3that 1

includes an initial and final permutation (which have no influence on security) like the DES 2

(Section3.2 on page 129), and treats the key schedule as a black box. 3

Feistel networks are just a special case of SPNs: only half of the state is modified at each round, 4

but in fact the state is a function of the whole previous state, and the permutation function is 5

very simple. This also means that confusion and diffusion must be in fact applied to the source 6

branch. Since confusion and diffusion are applied only to part of the state, so a higher number 7

of rounds is necessary, in fact roughly twice as much – but these rounds are also potentially 8

less expensive (roughly a half) since they have to operate only on half of the state. Moreover, 9

the steps are easy to revert in the case the composition is the XOR, since only the round keys 10

have to be fed in the opposite order to decrypt. 11

Finally, the F-function can be a simple SPN itself, so all the theory developed for SPNs is recy- 12

cled – this is very well exemplified by the development of the Lucifer family of block ciphers 13

(Section3.1 on page 128) whose first instances were SPNs, and then the experience of the de- 14

sign of these SPNs was exploited to design the round function of the “final” Lucifer described 15

in [Sor84]. 16

In fact, the F-function itself can be an existing cipher, and therefore this construction can be 17

seen as a simple way to double the block size of a cipher: the original cipher is used as the F- 18

function, so it operates onhalfof the state of the new cipher, and the key-schedule is extended 19

to generate different round keys for the various instances of the original cipher. Ladder-DES 1

and DEAL (Subsection3.19.1 on page 179) are two ciphers that use DES as the round function 2

in this way, and MAGENTA (Subsection3.19.6 on page 181) uses a quite complex 12-layer SPN 3

as its F-function. 4

In general both confusion and diffusion are slower in a Feistel network than in a SPN, assuming 5

they are equally well designed. This is general due to the fact that confusion and diffusion 6

operations usually work only on a part of the state at each round, and will be discussed further 7

in Subsection1.8.4 on page 54. Hence, a Feistel network usually needs more rounds than a SPN 8

to achieve comparable levels of security at the same block and key sizes. This often balances 9

with the fact that the Feistel rounds are also lighter than in SPNs. 10

But there is more: the power of this construction comes from the fact that the F-function needs 11

not be bijective, with serious positive implications for performance, flexibility of design, and 12

also for cryptographic theory. Michael Luby and Charles Rackoff analyzed the Feistel cipher 13

construction [LR86], and proved that if the round function is a cryptographically secure pseu- 14

dorandom function (where the round key is interpreted as the seed) then three rounds are suf- 15

ficient to make the block cipher a pseudorandom permutation, while four rounds are sufficient 16

to make it a “strong” pseudorandom permutation (which means that it remains pseudorandom 17

even to an adversary who gets oracle access to its inverse permutation). Because of this very 18

important result, Feistel ciphers are also called Luby-Rackoff ciphers. 19

Finally, David Goldenberg et al. [GHL+07a,GHL+07b] show that the Luby-Rackoff construction 20

makes it particularly easy to construct tweakable block ciphers from conventional block ciphers: 21

In the method we have mentioned to double the size of a block cipher, tweaking keys are added 22

before the F-function and after the mix to the target branch. 23

1.3.1 A Taxonomy of Feistel Networks

There are many types of Feistel networks and generalisations, with the treatment going back to 25

at least [ZMI89]. In Figure1.4 on the facing pagewe show some of the most important types, 26

where just one round is visualised for each variant. In place of the symbol⊕for the XOR we 27

have used a “wildcard” composition symbol⊛in the figure because different operations can 28

be used to mix the output of the F-function with the target branch. In particular, Hoang and 29

Rogaway define anarithmetic Feistel networkto be a Feistel network in which the composition 30

with the target is a modular addition. 31

The represented types are: 32

1: Classic Feistel network, also called a balanced Type 1 Feistel network, wherebalancedmeans 33

that the two branches have the same size. 34

This is the topology of several notable ciphers such as DES (Section3.2 on page 129), GOST 35

(Section3.4 on page 140), Blowfish (Section3.9 on page 157), TEA and XTEA (Section3.12 on 36

page 161) CAST-128 (Section3.7 on page 148), Twofish (Section3.13 on page 164), Camellia 37

(Section3.18 on page 172), Simon (Subsection3.36.1 on page 223) and many others. 38

2: Mitsuru Matsui’s variation as used in various components of the ciphers MISTY-1, MISTY- 39

2 and KASUMI (see Subsection 3.18.8 on page 176), is here given as the “L-network,” i.e. 40

the version where the F-function is on the target branch. There is also another version, the 41

“R-network,” studied by various authors, such as Yasuyoshi Kaneko, Fumihiko Sano, and 42

Figure 1.4: A (Partial) Taxonomy of (Generalised) Feistel Networks 1 : Classic (Type 1) in0 in1

∗

out₀ out₁ 𝐹

2 : Matsui’s L- and R-Networks

in0 in1 𝐹

∗

out₀ out₁ in0 in1 𝐹

∗

out₀ out₁ 3 : Unbalanced Type 1 𝐹

out₀ out₁ out₂ out₃ 𝐹

9 : Source-Heavy

in₀ in₁ in₂ in₃

∗

out₀ out₁ out₂ out₃

Kouichi Sakurai in [KSS97] and Henri Gilbert and Marine Minier in [GM01], where the F- 1

function is on the source branch. 2

Note that in these constructions the F-function must be invertible. 3

3: Unbalanced Feistel network. The bit length of in₁and out₀is different from the bit length of 4

in₀and out₁. The output of a round can then be repartitioned before being input to the next 5

round, but there are variants where there is no repartitioning, two different F-functions are 6

used, with one “expanding” its input to be applied to the smaller branch and the other one 7

“compressing” the input to apply the output to the larger branch, such as BEAR, LION and 8

LIONESS (cf. Subsection1.11.3 on page 69). 9

The most extreme example of repartitioning unbalanced Feistel network is the Thorp shuffle, 10

where the𝑛bit state is divided into a1bit part and a𝑛−1bit part [MRS09] (see also [NR99] for 11

an earlier realization of the usefulness of the Thorp shuffle in cryptography). The function 12

𝐹takes the𝑛 − 1bit part and outputs a single bit that is xored to the1bit part. 13

NLFSR-based ciphers such as Keeloq (Subsection3.3.3 on page 138) and KATAN (Section3.31 14

on page 209) can be described in terms of unbalanced Feistel networks. 15

Most unbalanced Feistel networks fall into the types that follow. 16

4: Generalised Feistel Network (GFN) Type 1. It is one of the many ways to describe unbalanced 17

networks: instead of having two branches of different width, we split the state into more 18

than two branches (which, in the examples that follow, always have equal widths, but can 19

of course still be unbalanced as well). The particular generalised Type 1 network depicted 20

here has four branches, but there can be more than four branches. 21

CAST-256 (Section3.7 on page 148) is a classic example of this design. 22

Note that in the subfigure maked 4 (a) there are two branches that are nor source nor target, 23

and that the target gets permuted onto the source branch. Other variants are possible, for 24

instance where the output of the F-function is combined to the in₃ branch. In this case 25

the source branch gets permuted onto the target, as represented in the subfigure maked 26

4 (b), and this variant is actually theinverseof the previous design, up to numbering of the 27

branches. 28

The reader may now ask what happens if (in a four-branch Type 1 Feistel with branch permu- 29

tation(0 1 2 3) (3 0 1 2)) the source and target branches are the first and third, respectively. 30

It is easy to see, in this case, that the cipher splits into two non-intermixed ciphers, of two 31

branches each, and therefore this case is not interesting. 32

The Skipjack (Section3.14 on page 166) rounds combine ideas from the Type 4 and Matsui 33

networks. 34

5: Type 2, notable examples being RC6 (Section3.15 on page 168), CLEFIA encryption and key 35

schedule (Section 3.28 on page 203), and HIGHT (Section3.27 on page 202). Note that it 36

may seem at first sight that, if the branches are rotated in the opposite direction, we obtain 37

a different topology, but in fact the two variants are equivalent. 38

6: The topology studied by Kaisa Nyberg in [Nyb96]. It is a variation of Type 2 with a different 39

permutation of the branches. The subfigure marked 6 (a) follows Kaisa Nyberg’s original 40

depiction, whereas the subfigure marked 6 (b) shows how the permutation is different from 41

the usual Feistel cyclic rotation of branches. 42

The significative difference between Type 2 and Nyberg Type is that in the former source and 1

target branches are always swapped, whereas in the latter some source and target branches 2

are permuted to branches of the same type. 3

7: Type 3, according to the definition given in [ZMI89]. To distinguish it from the next type, we 4

call it also Zheng-Matsumoto-Imai Type 3 (see also Hoang and Rogaway [HR10a,HR10b]). 5

8: MARS Type 3, also called target-heavy, which is used in MARS (Section3.16 on page 169). 6

9: Source-heavy, as used in RC2 (Section3.5 on page 142), MacGuffin [BS94], SPEED [Zhe97], 7

and in the LOKI97 key schedule (Subsection3.19.5 on page 181). 8

This is a dual of the target-heavy topology. 9

The F-functions can be explicitly keyed, but for clarity we omitted arrows from the pool of round 10

keys to the F-functions. The F-functions can be unkeyed internally by still be implicitly keyed 11

by other transformations. Let us consider the classic Feistel network as an example. The cipher 12

designer may want to add a round key to in₀before the value is fed to the F-function. This value 13

can be kept as the “new” in₀(which then goes to become out₁) or be used only as an input to 14

the F-function. Despite these different design choices, all these variants can be considered a 15

classic Feistel network design. 16

The outputs of the F-functions can also be used to “tweak” other inputs (this should not be 17

confused with the concept of tweakable block ciphers). For instance, let us consider RC6 (Sec- 18

tion3.15 on page 168). It has essentially a Type 2 topology. Referring to the graphics of Fig- 19

ure 1.4 on page 31, the output of the F-functions applied to inputs in₀, resp. in₂, is not only 20

XORed to in₁, resp. in₃, but it also determines the amount of a further rotation of the already 21

XORed values of in₃, resp. in₁. 22

Henri Gilbert and Marine Minier in [GM01] develop for L- and R-networks analogue results 23

to the work of Michael Luby and Charles Rackoff about Feistel networks. They prove that if 24

the round function is a cryptographically secure pseudorandom function, then: a L-network 25

is not pseudorandom with three rounds but four, and it is strong pseudorandom with five 26

rounds (but not four); a R-network is already pseudorandom with three rounds but, similarly 27

to the L-network, it is strong pseudorandom only with five rounds. Makoto Sugita [Sug96] 28

and Kouichi Sakurai [SZ97] already proved independently that four rounds are not sufficient 29

to make L-networks strong pseudorandom. 30

Another set of variations on the Feistel design was discussed by Yasuyoshi Kaneko, Fumihiko 31

Sano and Kouichi Sakurai at SAC 1997 [KSS97]. They consider all possible variants of two- 32

branch Type 1 and Matsui L- and R-network rounds with keyed functions (or permutations) at 33

three possible places: at the bottom, i.e. on the connection from split to composition (such as 34

classic Feistel networks); on the target branch before the composition (such as in Matsui’s L- 35

network); or on the source branch before the split (as in the R-network). The bottom placement 36

is denoted by the letter B. Since there are two possibilities for each of the three places (i.e. there 37

is a keyed function or there it none), and one case is trivial, they study seven combinations: B, 38

L, R, LB, RB, LR and LRB. There are of course countless ways to combine these variants with 39

the network topologies of Figure1.4 on page 31. 40

There of course more variations on the original Feistel design, and some of the above design 41

classes are not necessarily distinct from each other. For instance, BEAR, LION and LIONESS 42

(cf. Subsection1.11.3 on page 69), introduced by Ross Anderson and Eli Biham in [AB96], can 1

be also seen as unbalanced Feistel designs that alternate source-heavy and target-heavy steps. 2

On the other hand, the Thorp Shuffle can be seen as an extreme source-heavy cipher where 3

each branch consists of just one bit of the state. 4

In document Análisis comparativo con la aplicación de un software educativo Euclides, en la resolución de sistemas de ecuaciones lineales, por la estrategia de eliminación y gráfica, en los estudiantes del décimo año de educación básica del colegio Dr Camilo Gallego (página 71-83)