Construction of Lightweight S-Boxes Using Feistel and MISTY Structures

Canteaut, Anne; Duval, Sébastien; Leurent, Gaëtan

doi:10.1007/978-3-319-31301-6_22

Cited by 30 publications

(36 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In many cases, such a structure is used to allow an efficient implementation of the S-Box in hardware or using a bit-sliced approach. In fact, a recent work by Canteaut et al [43] focused on how to build efficient 8-bit S-Boxes from 3-round Feistel and Misty-like structures. Another possible reason behind such a choice is given by the designers e.g.…”

Section: Hardware Implementationmentioning

confidence: 99%

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Biryukov

Perrin

Udovenko

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The Russian Federation's standardization agency has recently published a hash function called Streebog and a 128-bit block cipher called Kuznyechik. Both of these algorithms use the same 8-bit S-Box but its design rationale was never made public. In this paper, we reverse-engineer this S-Box and reveal its hidden structure. It is based on a sort of 2-round Feistel Network where exclusive-or is replaced by a finite field multiplication. This structure is hidden by two different linear layers applied before and after. In total, five different 4-bit S-Boxes, a multiplexer, two 8-bit linear permutations and two finite field multiplications in a field of size 2 4 are needed to compute the S-Box. The knowledge of this decomposition allows a much more efficient hardware implementation by dividing the area and the delay by 2.5 and 8 respectively. However, the small 4-bit S-Boxes do not have very good cryptographic properties. In fact, one of them has a probability 1 differential. We then generalize the method we used to partially recover the linear layers used to whiten the core of this S-Box and illustrate it with a generic decomposition attack against 4-round Feistel Networks whitened with unknown linear layers. Our attack exploits a particular pattern arising in the Linear Approximations Table of such functions.

show abstract

Section: Hardware Implementationmentioning

confidence: 99%

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Biryukov

Perrin

Udovenko

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…They can also be used to reverse-engineer the secret structure of an S-Box, allowing for example an attacker to enjoy the benefits of a lightweight implementation known a priori only by the designer of the S-Box. The use of small Feistel Networks for lightweight S-Box design is investigated in [7] and, in fact, a secret hardware efficient decomposition 3 was recently discovered for the S-Box of the last Russian standards [8] using such reverse-engineering.…”

Section: Introductionmentioning

confidence: 99%

Algebraic Insights into the Secret Feistel Network

Perrin

Udovenko

2016

Fast Software Encryption

View full text Add to dashboard Cite

Abstract. We introduce the high-degree indicator matrix (HDIM), an object closely related with both the linear approximation table and the algebraic normal form (ANF) of a permutation. We show that the HDIM of a Feistel Network contains very specific patterns depending on the degree of the Feistel functions, the number of rounds and whether the Feistel functions are 1-to-1 or not. We exploit these patterns to distinguish Feistel Networks, even if the Feistel Network is whitened using unknown affine layers. We also present a new type of structural attack exploiting monomials that cannot be present at round − 1 to recover the ANF of the last Feistel function of a -round Feistel Network. Finally, we discuss the relations between our findings, integral attacks, cube attacks, Todo's division property and the congruence modulo 4 of the Linear Approximation Table.

show abstract

“…Knowledge of the internal structure of an S‐box gives clear advantages to the designer of a cipher in terms of efficient or side‐channel resistant implementation. Conversely, hiding the S‐box's structure can also be a way to hide superior cryptanalysis techniques or trapdoors .…”

Section: Related Contributionsmentioning

confidence: 99%

“…However, a pure randomly chosen S‐box may also bring extra implementation cost. Thus, some block ciphers choose to employ structural S‐box .…”

Section: Introductionmentioning

confidence: 99%

Real‐time decomposition of three kinds of structural S‐boxes

Cui

Liu

Song

2016

Security Comm Networks

View full text Add to dashboard Cite

S‐box is one of the most important components of modern cipher. For efficient implementation and to avoid a purely algebraic construction, utilizing special cipher structure and small‐size random permutation to design S‐boxes seems to be an attractive approach. In this paper, we focus on the structure‐recovery problem on three kinds of S‐boxes, that is, specify the inner transformations from the look‐up table, which allows a much more efficient hardware implementation. For a given n‐bit bijection, with introducing equivalent structures, we decompose it into three‐layer Feistel/MISTY/Lai–Massey within time complexity O(2n/2) and 2 − n/2 part of the full codebook. Copyright © 2017 John Wiley & Sons, Ltd.

show abstract

Construction of Lightweight S-Boxes Using Feistel and MISTY Structures

Cited by 30 publications

References 30 publications

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Reverse-Engineering the S-Box of Streebog, Kuznyechik and STRIBOBr1

Algebraic Insights into the Secret Feistel Network

Real‐time decomposition of three kinds of structural S‐boxes

Contact Info

Product

Resources

About