Generalized Feistel Structure Research Articles

LPHD: A low power and high diffusion lightweight block cipher

AbstractSmart door locks pose a large number of threats such as network attacks. Its storage area and power of cipher are severely limited because the wireless nodes of smart door locks are mostly battery‐powered. Therefore, effective security solutions are urgently needed. In this paper, a new lightweight block cipher with low power named LPHD is proposed to ensure the security of the master control chip of the smart door lock terminal. We design a scheme of low power S‐box and construct the two‐stage permutation layer (TP structure) suitable for LPHD by filtering the sets of 8‐bit permutations. LPHD proposes a variant of the 8‐branch generalized Feistel structure (GFS) to realize that the bits of all branches are affected in one encryption round. The problem of slow diffusion in the standard Feistel structure is solved. The key schedule adopts the nonlinear design and reuses the encryption process of LPHD. It improves the security of the cipher and reduces hardware overhead. Moreover, we evaluate the hardware implementation and security of LPHD. The results show that LPHD for the unified encryption and decryption circuits requires only 1276 Gate Equivalents (GEs) and 1.914 W on UMC 0.18 m, which is better than other lightweight block ciphers such as SKINNY, PRESENT, and IVLBC. In summary, LPHD provides sufficient security for the master control chip of the smart door lock terminal.

Multiple impossible differential cryptanalysis of reduced-round NBC

NBC is a class of Type-II generalized Feistel structure algorithms with excellent software and hardware implementation performance. In this paper, we evaluate the security of NBC from the view point of multiple impossible differential. More precisely, using the idea of combining the matrix method and “meet-in-the-middle,” we first obtain 4 types of 11-round impossible differentials for NBC-128 and 32 types of 14-round impossible differentials for NBC-256, respectively. Then, according to the characteristics of Feistel structure and the distinguisher, we perform 17-round, 19-round, and 22-round multiple impossible differential cryptanalysis on NBC-128-128, NBC-128-256, and NBC-256-256, respectively. Results indicate that NBC has sufficient security to resist an impossible differential attack, and the data and time complexity of our attack has been significantly reduced compared to previous ones.

MILP-based differential cryptanalysis on full-round shadow

Shadow (Guo et al., 2021) is a lightweight block cipher based on a new logical combination method of AND-RX operation and the generalized Feistel structure with high diffusion and excellent performance in hardware implementation. In this paper, the components and structure of Shadow cipher are researched, and based on MILP automatic search algorithms for differential trails the 2-round iterative differential characteristics are obtained, then the full-round differential characteristics of both Shadow-32 and Shadow-64 are given. Moreover, targeting Shadow-32, we conduct 32-bit round-key recovery attack by using four 13.5-round differential trails, and the experimental verification shows that the time complexity is 226.02 and space complexity is 214.1. Recovering the 64 master key bits need to solve a system of multivariate equations over F2 with the time complexity more than 250.69. For Shadow-64, the process of recovering the master key is similar. Finally, we analyze the reasons for the insecurity of the Shadow cipher that may help to improve the cryptographic performance of the Shadow or provide help for a new block cipher design.

Full-round impossible differential attack on shadow block cipher

Lightweight block ciphers are the essential encryption algorithm for devices with limited resources. Its goal is to ensure the security of data transmission through resource-constrained devices. Impossible differential cryptanalysis is one of the most effective cryptanalysis on block ciphers, and assessing the ability of resisting this attack is a basic design criterion. Shadow is a lightweight block cipher proposed by Guo et al. (IEEE Internet Things J 8(16):13014–13023, 2021). It utilizes a combination of ARX operations and generalized Feistel structure to overcome the weakness of the traditional Feistel structure that only diffuses half in one round. In this paper, we focus on the differential property of Shadow and its security against impossible differential cryptanalysis. First, we use the SAT method to automatically search for a full-round impossible differential distinguisher of Shadow-32. Then, based on the experimental results, we prove that Shadow has a differential property with probability 1 based on the propagation of the state. Further, we can obtain an impossible differential distinguisher for an arbitrary number of rounds of Shadow. Finally, we perform a full key recovery attack on the full-round Shadow-32 and Shadow-64. Both experimentally and theoretically, our results indicate that Shadow is critically flawed, and regardless of the security strength of the internal components and the number of rounds applied, the overall cipher remains vulnerable to impossible differential cryptanalysis.

ALICA: A Multi-S-Box Lightweight Cryptographic Algorithm Based on Generalized Feistel Structure

With the development of science and technology, IoT devices have already become ubiquitous in the public eye. Through the perception layer, the collected data are displayed or transmitted to the server backend for analysis. Due to the increasing integration of IoT devices into people’s daily lives, privacy issues, such as data leaks, have received more attention. Most sensor nodes, such as temperature and pressure sensors in marine environments, have low computing power, storage capacity, and significant underlying heterogeneity, making it challenging to implement a standardized data security protection solution. Data security in the nodes is seriously challenged as a result. It is of great significance to design a lightweight block cipher for the Internet of Things (IoT) environment, which can ensure the security of node information. A new lightweight block cipher algorithm called ALICA is proposed in this paper, which is well-suited for the low computing power and heterogeneous device environment at the lower layers. A generalized Feistel structure and a linear structure with XOR and shift operations are used to achieve ease of software implementation. Two different S-boxes are used to create the nonlinear structure of the password, thereby enhancing the robust security of the cipher. In addition, the cipher adopts a design approach that prioritizes software efficiency while also considering hardware implementation efficiency. This makes it more suitable for low computing power, storage capacity, and resource-limited IoT sensor nodes at the lower layers.

Exploring the optimality of byte-wise permutations of a piccolo-type block cipher

Piccolo is a lightweight block cipher based on a 16-bit word 4-line generalized Feistel structure. Piccolo adopts byte-wise round permutation (RP) instead of the typical word-based RP to improve diffusion. In this paper, we explore the optimality of byte-based RP from the viewpoint of security. We evaluate the security of differential, linear, impossible differential, and integral attacks for all byte-wise RPs using mixed integer linear programming (MILP). We show that the RP of Piccolo is optimal in terms of the number of rounds required to guarantee security against such attacks. In addition, we introduce new two classes of RPs that require 7 rounds for security against impossible differential attacks, which is one round less than required by Piccolo. These new classes require 7/9 and 8/8 rounds to guarantee security against differential/linear attacks, respectively, which is more rounds than required by Piccolo.

An image encryption algorithm based on circular rotation and generalized Feistel structure

An image encryption algorithm based on circular rotation and generalized Feistel structure

Differential analysis of the NBC algorithm based on mixed integer linear programming model

AbstractThis paper mainly studies mixed integer linear programming (MILP)‐based cryptanalysis on round‐reduced NBC algorithm with generalized Feistel structure. First, each component of the algorithm is equivalently described by linear inequality equations, and the propagation rules of differential characteristics and linear approximation are described, and an automatic search algorithm model of differential mode and linear mask mode based on MILP is established, and the minimum number of active S‐boxes and the corresponding differential mode and linear mask mode paths are obtained. Second, according to the NBC algorithm's 16‐bit block pull‐wire position permutation characteristics, the optimal full diffusion rounds of NBC‐128 algorithm and NBC‐256 algorithm are obtained by using approximate matrix multiplication theory to be six and eight respectively. Finally, based on the optimal number of full diffusion rounds of the algorithm, an automatic search algorithm model of impossible differential cryptanalysis is established, and the set of input differential patterns is traversed to obtain 11‐round impossible differential distinguishers of NBC‐128 algorithm and 14‐round impossible differential distinguishers of NBC‐256 algorithm respectively.

GFRX: A New Lightweight Block Cipher for Resource-Constrained IoT Nodes

The study of lightweight block ciphers has been a “hot topic”. As one of the main structures of block ciphers, the Feistel structure has attracted much attention. However, the traditional Feistel structure cipher changes only half of the plaintext in an iterative round, resulting in slow diffusion. Therefore, more encryption rounds are required to ensure security. To address this issue, a new algorithm, GFRX, is proposed, which combines a generalized Feistel structure and ARX (Addition or AND, Rotation, XOR). The GFRX algorithm uses an ARX structure with different non-linear components to deal with all the branches of a generalized Feistel structure so that it can achieve a better diffusion effect in fewer rounds. The results of a security analysis of the GFRX algorithm show that the effective differential attacks do not exceed 19 rounds and that the effective linear attacks do not exceed 13 rounds. Therefore, the GFRX algorithm has an adequate security level for differential and linear analysis. Avalanche test results obtained for the GFRX algorithm show that the GFRX algorithm has strong diffusion and only takes six rounds to meet the avalanche effect. In addition, the GFRX algorithm can achieve different serialization levels depending on different hardware resource requirements and can achieve full serialization, which ensures operational flexibility in resource-constrained environments.

Generalized Feistel Structures Based on Tweakable Block Ciphers

A generalized Feistel structure (GFS) is a classical approach to construct a block cipher from pseudorandom functions (PRFs). Coron et al. at TCC 2010 instantiated a Feistel structure with a tweakable block cipher (TBC), and presented its provable security treatment. GFSs can naturally be instantiated with TBCs, and among several types of GFSs, the provable security result of TBC-based unbalanced GFSs was presented. TBC-based counterparts of the most basic types of GFSs , namely, type-1, type-2, and type-3 GFSs, can naturally be formalized, and the provable security result of these structures is open. In this paper, we present such formalization and show their provable security treatment. We use a TBC of n-bit blocks and n-bit tweaks, and we identify the number of rounds needed to achieve birthday-bound security and beyond-birthday-bound security (with respect to n). The n-bit security can be achieved with a finite number of rounds, in contrast to the case of classical PRF-based GFSs. Our proofs use Patarin’s coefficient-H technique, and it turns out deriving a collision probability of various internal variables is nontrivial. In order to complete the proof, we introduce an approach to first compute a collision probability of one specific plaintext difference (or a ciphertext difference), and then prove that the case gives the maximum collision probability. We fully verify the correctness of our security bounds for a class of parameters by experimentally deriving upper bounds on the collision probability of internal variables. We also analyse the optimality of our results with respect to the number of rounds and the attack complexity.

Differential Attack With Constants On μ2 Block Cipher

Abstract Differential attack is one of the most important methods in cryptanalysis. When finding a high-probability differential trail, the effect of constant has long been ignored. In this paper, we focus on the effect of constants on the differential attack against $\mu ^2$. $\mu ^2$ is a newly proposed block cipher based on a Type-II generalized Feistel structure. Its 16-bit F function (denoted as F-box) is an ultra-lightweight permutation equipped with different constants. The designer applied the minimum number of active S-boxes to determine $\mu ^2$’ security margin in the design document. However, the F-boxes use different round constants in different rounds; the constants may lead to incompatibility of differential trails of F-boxes. Therefore, to provide a more precise differential attack on $\mu ^2$, we construct an model based on STP (Simple Theorem Prover) constraint solver to search for the valid differential trails with a more precise probability of $\mu ^2$ for different starting rounds. Finally, the related-key differential trail covers one more round than the existing methods. Analyzing the effect of constants on the validity and the probability of the differential trail reminds the designers and the attackers to have a more comprehensive analysis of specific ciphers.

Throwing Boomerangs into Feistel Structures

Automatic tools to search for boomerang distinguishers have seen significant advances over the past few years. However, most previous work has focused on ciphers based on a Substitution Permutation Network (SPN), while analyzing the Feistel structure is of great significance. Boukerrou et al. recently provided a theoretical framework to formulate the boomerang switch over multiple Feistel rounds, but they did not provide an automatic tool to find distinguishers. In this paper, by enhancing the recently proposed method by Hadipour et al., we provide an automatic tool to search for boomerang distinguishers and apply it to block ciphers following the Generalized Feistel Structure (GFS). Applying our tool to a wide range of GFS ciphers, we show that it significantly improves the best previous results on boomerang analysis. In particular, we improve the best previous boomerang distinguishers for 20 and 21 rounds of WARP by a factor of 238.28 and 236.56, respectively. Thanks to he effectiveness of our method, we can extend the boomerang distinguishers of WARP by two rounds and distinguish 23 rounds of this cipher from a random permutation. Applying our method to the internationally-standardized cipher CLEFIA, we achieve a 9-round boomerang distinguisher which improves the best previous boomerang distinguisher by one round. Based on this distinguisher, we build a key-recovery attack on 11 rounds of CLEFIA, which improves the best previous sandwich attack on this cipher by one round. We also apply our method to LBlock, LBlock-s, and TWINE and improve the best previous boomerang distinguisher of these ciphers.

A Novel Lightweight Block Encryption Algorithm Based on Combined Chaotic S-Box

Due to high computational cost, traditional encryption algorithms are not suitable for the environments in which resources are limited. In view of the above problem, we first propose a combined chaotic map to increase the chaotic interval and Lyapunov exponent of the existing one-dimensional chaotic maps. Then, an S-box based on the proposed combined chaotic map is constructed. The performances of the designed S-box, such as bijection, nonlinearity, strict avalanche criteria, differential uniformity, the bits independence criterion, and the linear approximation probability, are tested to show that it has better cryptographic performances. Finally, we present a lightweight block encryption algorithm by using the above S-box. The algorithm is based on the generalized Feistel structure and SPN structure. In addtion, the processes of encryption and decryption of our algorithm are almost the same, which reduces the complexity of algorithm implementation. The experimental results show that the proposed encryption algorithm meets the requirements of lightweight algorithms and has good cryptographic characteristics.

Shadow: A Lightweight Block Cipher for IoT Nodes

The advancement of the Internet of Things (IoT) has promoted the rapid development of low-power and multifunctional sensors. However, it is seriously significant to ensure the security of data transmission of these nodes. Meanwhile, sensor nodes have the characteristics of converting analog signals into digital signals for operation processing in wireless sensor networks (WSNs). Given the particularity of Addition or AND, Rotation, and XOR (ARX) operations, its round function can only be based on the Feistel structure or generalized Feistel structure, otherwise, the process of decryption cannot be completed correctly. Furthermore, the existing ARX ciphers have the problems of only changing half of the plaintext block in one round and iterating for many rounds. In this article, a new logical combination method of generalized Feistel structure and ARX operations is proposed to improve the diffusion speed of ARX ciphers, called Shadow. Shadow overcomes the shortcomings of traditional ARX ciphers that only diffuse half of the block in one round. To ensure the efficiency of the encryption hardware circuit while ensuring the security of the physical-layer signal, we studied the round-based hardware architecture and the serial hardware architecture for Shadow cipher. Particularly, we conducted a series of performance tests on Shadow, including the avalanche effect, FPGA implementation, and ASIC implementation. Also, we conducted a security analysis of the Shadow. As shown by our experiments and comparisons, Shadow is compact in IoT nodes and is of high security against cryptanalysis.

A Deep Learning Approach for Active S-Box Prediction of Lightweight Generalized Feistel Block Ciphers

One of the main security requirements for symmetric-key block ciphers is resistance against differential cryptanalysis. This is commonly assessed by counting the number of active substitution boxes (S-boxes) using search algorithms or mathematical solvers that incur high computational costs. These costs increase exponentially with respect to block cipher size and rounds, quickly becoming inhibitive. Conventional S-box enumeration methods also require niche cryptographic knowledge to perform. In this paper, we overcome these problems by proposing a data-driven approach using deep neural networks to predict the number of active S-boxes. Our approach trades off exactness for real-time efficiency as the bulk of computational work is brought over to pre-processing (training). Active S-box prediction is framed as a regression task whereby neural networks are trained using features such as input and output differences, number of rounds, and permutation pattern. We first investigate the feasibility of the proposed approach by applying it on a reduced (4-branch) generalized Feistel structure (GFS) cipher. Apart from optimizing a neural network architecture for the task, we also explore the impact of each feature and its representation on prediction error. We then extend the idea to 64-bit GFS ciphers by first training neural networks using data from five different ciphers before using them to predict the number of active S-boxes for TWINE, a lightweight block cipher. The best performing model achieved the lowest root mean square error of 1.62 and R <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> of 0.87, depicting the feasibility of the proposed approach.

Tweakable TWINE: Building a Tweakable Block Cipher on Generalized Feistel Structure

Tweakable block cipher (TBC) is an extension of conventional block cipher. We study how to build a TBC based on generalized Feistel structure (GFS), a classical block cipher construction. While known dedicated TBC proposals are based on substitution-permutation network (SPN), GFS has not been used for building TBC. In particular, we take 64-bit GFS block cipher TWINE and try to make it tweakable with a minimum change. To find a best one from a large number of candidates, we performed a comprehensive search with a help of mixed integer linear programming (MILP) solver. As a result, our proposal TWINE is quite efficient, has the same number of rounds as TWINE with extremely simple tweak schedule.

On the diffusion of the Improved Generalized Feistel

&lt;p style='text-indent:20px;'&gt;We consider the Improved Generalized Feistel Structure (IGFS) suggested by Suzaki and Minematsu (LNCS, 2010). It is a generalization of the classical Feistel cipher. The message is divided into &lt;inline-formula&gt;&lt;tex-math id="M1"&gt;\begin{document}$ k $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt; subblocks, a Feistel transformation is applied to each pair of successive subblocks, and then a permutation of the subblocks follows. This permutation affects the diffusion property of the cipher. IGFS with relatively big &lt;inline-formula&gt;&lt;tex-math id="M2"&gt;\begin{document}$ k $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt; and good diffusion are of particular interest for light weight applications.&lt;/p&gt;&lt;p style='text-indent:20px;'&gt;Suzaki and Minematsu (LNCS, 2010) study the case when one and the same permutation is applied at each round, while we consider IGFS with possibly different permutations at the different rounds. In this case we present permutation sequences yielding IGFS with the best known by now diffusion for all even &lt;inline-formula&gt;&lt;tex-math id="M3"&gt;\begin{document}$ k\le 2048 $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt;. For &lt;inline-formula&gt;&lt;tex-math id="M4"&gt;\begin{document}$ k\le 16 $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt; they are found by a computer-aided search, while for &lt;inline-formula&gt;&lt;tex-math id="M5"&gt;\begin{document}$ 18\le k\le 2048 $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt; we first consider several recursive constructions of a permutation sequence for &lt;inline-formula&gt;&lt;tex-math id="M6"&gt;\begin{document}$ k $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt; subblocks from two permutation sequences for &lt;inline-formula&gt;&lt;tex-math id="M7"&gt;\begin{document}$ k_a&amp;lt; k $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt; and &lt;inline-formula&gt;&lt;tex-math id="M8"&gt;\begin{document}$ k_b&amp;lt; k $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt; subblocks respectively. Using computer, we apply these constructions to obtain permutation sequences with good diffusion for each even &lt;inline-formula&gt;&lt;tex-math id="M9"&gt;\begin{document}$ k\le 2048 $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt;. Finally we obtain infinite families of permutation sequences for &lt;inline-formula&gt;&lt;tex-math id="M10"&gt;\begin{document}$ k&amp;gt;2048 $\end{document}&lt;/tex-math&gt;&lt;/inline-formula&gt;.&lt;/p&gt;

Provable security against impossible differential and zero correlation linear cryptanalysis of some feistel structures

Impossible differential and zero correlation linear cryptanalysis are two important cryptanalytic methods. In this paper, we study the security of some Feistel structures against these two cryptanalytic methods. Throughout this paper, we consider the impossible differential and zero correlation linear hull that are independent of the choices of the non-linear parts. Based on that, a method is introduced to estimate the number of rounds that the longest impossible differential could cover for one kind of Feistel-SP structure. Fortunately, our method also applies to some generalized Feistel structures, such as the Type-2 generalized Feistel structure. Then we project our results to zero correlation by the links between impossible differential and zero correlation linear hull. Lastly, as an application of our method, we prove that there do not exist 15-round impossible differential and zero correlation linear hull for LBlock and TWINE.

Related-key impossible differential cryptanalysis on lightweight cipher TWINE

Lightweight block cipher is usually used in smart environment to protect confidentiality as well as to authentication. TWINE is a lightweight block cipher proposed by Japan scholar in SAC 2012 suits for kinds of platform from software to hardware. The cipher algorithm iterates a generalized Feistel structure with an improved block shuffle each sub-block includes an SP type round function. It with 64-bit block size, supports 80/128-bit key size and has 36 rounds iteration. This paper further investigates the security of TWINE, presents a new related-key impossible differential attack on reduced-round TWINE with 80-bit key (i.e. TWINE-80). By choosing the relations of keys carefully and exploring an equivalent structure of TWINE based on analysis of the encryption process, we show a 17-round related-key differential and then construct a 15-round related-key impossible differential trial. By using this trail, a 24-round related-key impossible differential attack on TWINE-80 is conducted. The result shows that the known impossible differential attack on TWINE-80 can be improved by one round.

Diffusion and Security Evaluation of Feistel‐PG

Feistel-PG structure is a new specific Generalized Feistel structure (GFS) adopted in DBlock and LHash. Its main feature is adding a sbox-size permutation before the round function. Different choices of the permutation may affect the security property of ciphers with Feistel-PG structure but how it effects is not clear. We evaluate the values of diffusion round for all possible parameters and summarize the characteristics of optimum shuffles. The results show that one special kind of Feistel-PG achieves full diffusion in less cost than the improved GFS. This advantage may attract the designers' interests and this kind of Feistel-PG ciphers are suggested to designers. We also evaluate the security of suggested ciphers against various byte-oriented attacks, including differential cryptanalysis, linear cryptanalysis, impossible differential attack and integral attack. Some permutations with optimum diffusion but relatively weaker security are filtered out and these permutations should be avoided by designers.