General Diffusion Analysis: How to Find Optimal Permutations for Generalized Type-II Feistel Schemes

Abstract

Type-II Generalized Feistel Schemes are one of the most popular versions of Generalized Feistel Schemes. Their round function consists in applying a classical Feistel transformation to p sub-blocks of two consecutive words and then shifting the k = 2p words cyclically. The low implementation costs it offers are balanced by a low diffusion, limiting its efficiency. Diffusion of such structures may however be improved by replacing the cyclic shift with a different permutation without any additional implementation cost. In this paper, we study ways to determine permutations with the fastest diffusion called optimal permutations.To do so, two ideas are used. First, we study the natural equivalence classes of permutations that preserve cryptographic properties; second, we use the representation of permutations as coloured trees.For both heuristic and historical reasons, we focus first on even-odd permutations, that is, those permutations for which images of even numbers are odd. We derive from their structure an upper bound on the number of their equivalence classes together with a strategy to perform exhaustive searches on classes. We performed those exhaustive searches for sizes k ≤ 24, while previous exhaustive searches on all permutations were limited to k ≤ 16. For sizes beyond the reach of this method, we use tree representations to find permutations with good intermediate diffusion properties. This heuristic leads to an optimal even-odd permutation for k = 26 and best-known results for sizes k = 64 and k = 128.Finally, we transpose these methods to all permutations. Using a new strategy to exhaust equivalence classes, we perform exhaustive searches on classes for sizes k ≤ 20 whose results confirmed the initial heuristic: there always exist optimal permutations that are even-odd and furthermore for k = 18 all optimal permutations are even-odd permutations.

Equivalence of Generalised Feistel Networks

“…However, it is more convenient to have a property that directly links the underlying permutations. Hence [CGT19] suggested the following natural equivalence relations: Definition 2. Let P and Q be two 2k-permutations.…”

“…In [CGT19], the authors suggested an algorithm to enumerate at least one element per conjugacy-based equivalence class. We improve this algorithm for extended conjugacy-based equivalence classes.…”

“…We denote by N k the size of A k (which is exactly the number of decomposition into cycles of a permutation acting on k elements). The exhaustive search for conjugacy-based equivalence classes of even-odd permutations of [CGT19] is based on two properties:…”

“…different permutations for a 2k-branch GFN. In [CGT19], Cauchois et al consider the so-called natural equivalence classes based on conjugacy: two Feistel networks relying on 2k-permutations P and Q respectively are equivalent if and only if there exists a permutation of pairs A such that P = AQA −1 , where a permutation of pairs is a permutation A such that A(2i + 1) = A(2i) + 1 for all i between 0 and k − 1. In other words, up to re-labelling of the inputs/outputs, the two Feistel schemes are identical.…”

“…permutations that map branches with an even index to branches with an odd index and reciprocally), based on the cycle structures of the left-branches permutation. Moreover, the authors of [CGT19] also recall that, since F is involutive, the decryption through the Feistel scheme associated with P are, up to re-labelling of the inputs and outputs, identical to the encryption through the Feistel scheme associated with P −1 . Therefore, they coined the expression "extended equivalence" to describe the fact that P and Q or P and Q −1 are equivalent as we most often want the decryption function to be as resistant as the encryption function.…”