The 128-Bit Blockcipher CLEFIA (Extended Abstract)

100

126

Abstract. The generalized Feistel structure (GFS) is a generalized form of the classical Feistel cipher. A popular version of GFS, called Type-II, divides a message into k > 2 sub blocks and applies a (classical) Feistel transformation for every two sub blocks, and then performs a cyclic shift of k sub blocks. Type-II GFS has many desirable features for implementation. A drawback, however, is its low diffusion property with a large k. This weakness can be exploited by some attacks, such as impossible differential attack. To protect from them, Type-II GFS generally needs a large number of rounds.In this paper, we improve the Type-II GFS's diffusion property by replacing the cyclic shift with a different permutation. Our proposal enables to reduce the number of rounds to attain a sufficient level of security. Thus, we improve the security-efficiency treading off of Type-II GFS. In particular, when k is a power of two, we obtain a significant improvement using a highly effective permutation based on the de Bruijn graph.

Section: Impossible Differentialmentioning

confidence: 99%

“…Recently, Type-II GFS receives a lot of attention for its simplicity and high parallelism. We have some modern Type-II-based block ciphers, e.g., CLEFIA [25] (k = 4), and HIGHT [11] (k = 8). When the length of message is fixed, the width (i.e., I/O lengths) of round function gets shorter as the partition number grows.…”

Section: Introductionmentioning

confidence: 99%

Improving the Generalized Feistel

Suzaki

Minematsu

2010

100

126

“…3 of Appendix A) that updates two words per round. A definition of the state update function is irrelevant to our analysis (see [13] for a full description) and further we focus on the key schedule only.…”

Section: Description Of Clefia-128mentioning

confidence: 99%

“…CLEFIA [13] is a block cipher designed by Sony. It is advertised as a fast encryption algorithm in both software and hardware and it is claimed to be highly secure.…”

Section: Introductionmentioning

confidence: 99%

Low Probability Differentials and the Cryptanalysis of Full-Round CLEFIA-128

Emami

Ling

Nikolić

et al. 2014

Abstract. So far, low probability differentials for the key schedule of block ciphers have been used as a straightforward proof of security against related-key differential analysis. To achieve resistance, it is believed that for cipher with k-bit key it suffices the upper bound on the probability to be 2 −k . Surprisingly, we show that this reasonable assumption is incorrect, and the probability should be (much) lower than 2 −k . Our counter example is a related-key differential analysis of the well established block cipher CLEFIA-128. We show that although the key schedule of CLEFIA-128 prevents differentials with a probability higher than 2 −128 , the linear part of the key schedule that produces the round keys, and the Feistel structure of the cipher, allow to exploit particularly chosen differentials with a probability as low as 2 −128 . CLEFIA-128 has 2 14 such differentials, which translate to 2 14 pairs of weak keys. The probability of each differential is too low, but the weak keys have a special structure which allows with a divide-and-conquer approach to gain an advantage of 2 7 over generic analysis. We exploit the advantage and give a membership test for the weak-key class and provide analysis of the hashing modes. The proposed analysis has been tested with computer experiments on small-scale variants of CLEFIA-128. Our results do not threaten the practical use of CLEFIA.

“…Among more carefully investigated ones are Clefia [20], HIGHT [21], KATAN [4], mCrypton [22], and PRESENT [3]. This turned into a very active area of research as evident by several algorithms proposed over the course of the past two years, including KLEIN [18], LED [1], Piccolo [2] and PRINCE [16].…”

Section: Introductionmentioning

confidence: 99%

Dietary Recommendations for Lightweight Block Ciphers: Power, Energy and Area Analysis of Recently Developed Architectures

Batina

Das

Ege

et al. 2013

Abstract. In this paper we perform a comprehensive area, power, and energy analysis of some of the most recently-developed lightweight block ciphers and we compare them to the standard AES algorithm. We do this for several different architectures of the considered block ciphers. Our evaluation method consists of estimating the pre-layout power consumption and the derived energy using Cadence Encounter RTL Compiler and ModelSIM simulations. We show that the area is not always correlated to the power and energy consumption, which is of importance for mobile battery-fed devices. As a result, this paper can be used to make a choice of architecture when the algorithm has already been fixed; or it can help deciding which algorithm to choose based on energy and key/block length requirements.