Improved Security Bounds for Generalized Feistel Networks

Abstract

We revisit the security of various generalized Feistel networks. Concretely, for unbalanced, alternating, type-1, type-2, and type-3 Feistel networks built from random functions, we substantially improve the coupling analyzes of Hoang and Rogaway (CRYPTO 2010). For a tweakable blockcipher-based generalized Feistelnetwork proposed by Coron et al. (TCC 2010), we present a coupling analysis and for the first time show that with enough rounds, it achieves 2n-bit security, and this provides highly secure, double-length tweakable blockciphers.

Generalized Feistel Structures Based on Tweakable Block Ciphers

“…The provable security treatment of type-1, type-2, and type-3 GFSs is presented in [ZMI89], followed by refined treatments in [HR10a]. The work by Shen, Guo, and Wang covers a wide range of GFSs [SGW20], and they further improved the results in [HR10a].…”

“…• With respect to SPRP security, the number of rounds needed to achieve BBB security with TBC-based GFSs is lower than or equals the number of rounds needed to achieve birthday-bound security with PRF-based GFSs, although the results in [SGW20] are not optimized for the number of rounds (see the discussion below).…”

“…The results on PRF-based GFSs and TBC-based Feistel in [SGW20] make use of the coupling technique [MPR07], and motivated by the observation in [LL18], the result regarding TBC-based Feistel shows that it remains secure provided that q ≪ 2 2nt/(t+1) , where t ≥ 1 is a parameter that specifies the number of rounds, i.e., for TBC-based Feistel, the number of rounds is 4t + 2 (see Table 1). The value of q can be larger than 2 n , while our results do not cover the case of q beyond 2 n .…”

“…The proof technique is useful to obtain a strong security bound at the cost of non-tightness in the number of rounds. That is, TBC-based Feistel has the security bound of O(q 2 /2 2n ) with 3 rounds [CDMS10], which corresponds to the security bound of t = 1 in [SGW20], i.e., 6 = 4t + 2 rounds from Table 1. The same argument applies to the results of PRF-based GFSs in [SGW20].…”

“…That is, TBC-based Feistel has the security bound of O(q 2 /2 2n ) with 3 rounds [CDMS10], which corresponds to the security bound of t = 1 in [SGW20], i.e., 6 = 4t + 2 rounds from Table 1. The same argument applies to the results of PRF-based GFSs in [SGW20]. This paper focuses on deriving the tight bound with respect to the number of rounds, and we leave the analysis with the coupling technique as an interesting future work.…”