Permutation Generators Based on Unbalanced Feistel Network: Analysis of the Conditions of Pseudorandomness

TL;DR

This paper analyzes the minimal rounds needed for unbalanced Feistel network-based permutation generators to achieve pseudorandomness and proposes a new unbalanced Feistel structure to extend block cipher sizes.

Contribution

It provides a theoretical analysis of round requirements for unbalanced Feistel networks and introduces a new structure for large input-output size block ciphers.

Findings

Minimal rounds for source-heavy structures determined

Minimal rounds for target-heavy structures determined

Proposed new unbalanced Feistel network extends small to large block sizes

Abstract

A block cipher is a bijective function that transforms a plaintext to a ciphertext. A block cipher is a principle component in a cryptosystem because the security of a cryptosystem depends on the security of a block cipher. A Feistel network is the most widely used method to construct a block cipher. This structure has a property such that it can transform a function to a bijective function. But the previous Feistel network is unsuitable to construct block ciphers that have large input-output size. One way to construct block ciphers with large input-output size is to use an unbalanced Feistel network that is the generalization of a previous Feistel network. There have been little research on unbalanced Feistel networks and previous work was about some particular structures of unbalanced Feistel networks. So previous work didn't provide a theoretical base to construct block ciphers that are secure and efficient using unbalanced Feistel networks. In this thesis, we analyze the minimal number of rounds of pseudo-random permutation generators that use unbalanced Feistel networks. That is, after categorizing unbalanced Feistel networks as source-heavy structures and target-heavy structures, we analyze the minimal number of rounds of pseudo-random permutation generators that use each structure. Therefore, in order to construct a block cipher that is secure and efficient using unbalanced Feistel networks, we should follow the results of this thesis. Additionally, we propose a new unbalanced Feistel network that has some advantages such that it can extend a previous block cipher with small input-output size to a new block cipher with large input-output size. We also analyze the minimum number of rounds of a pseudo-random permutation generator that uses this structure.

Figures

Tables

Table 1. Table 5.1: Comparison of PRPs using memory and pseudo-random bit generators

	Balanced	Unbalanced Feistel network		Proposed structure
	Feistel network	$kn$:$n$-UFN	$n$:$kn$-UFN	$n$:$kn$-UFN2
Number of rounds	3	$k+2$	$k+2$	$2k+1$
Memory size	$2^{\left(k+1\right)n/2}kn$	$2^{kn}kn$	$2^n{k}^{2}n$	$2^{n}kn$
Relative ratio	$2^{\left(k-1\right)n/2}$	$2^{\left(k-1\right)n}$	$k$	$1$
Running time	$1.5kn$	$kn$	$k^{2}n$	$2kn$
Relative ratio	$1.5$	$1$	$k$	$2$

Table 2. Table 5.2: Comparison of PRPs using the GGM pseudo-random function generator

	Balanced	Unbalanced Feistel network		Proposed structure
	Feistel network	$kn$:$n$-UFN	$n$:$kn$-UFN	$n$:$kn$-UFN2
Number of rounds	3	$k+2$	$k+2$	$2k+1$
Memory size	-	-	-	-
Relative ratio	-	-	-	-
Running time	$kn\ell$	$2kn\ell$	$2n\ell$	$2n\ell$
Relative ratio	$k$	$2k$	$2$	$2$

Equations

$$D_{K_i}(L^{i-1}\Vert R^{i-1})\stackrel{def}{=}(R^{i-1}\Vert L^{i-1}\oplus P(S(E(R)\oplus K_i)))$$

$$D_{K_i}(L_1^{i-1}\Vert L_2^{i-1}\Vert L_3^{i-1}\Vert R^{i-1})\stackrel{def}{=}(R^{i-1}\Vert L_1^{i-1}⊞f_1^i(R^{i-1})\Vert L_2^{i-1}⊞f_2^i(R^{i-1})\Vert L_3^{i-1}⊞f_3^i(R^{i-1}))$$

$$|\mathrm{Pr}(D(X,1^n)=1)-\mathrm{Pr}(D(Y,1^n)=1)|<1/p(n)$$

$$|\mathrm{Pr}(M^F(1^n)=1)-\mathrm{Pr}(M^H(1^n)=1)|<1/p(n)$$

$$f_x(y)\stackrel{def}{=}{G}_y(x)$$

$$F_x(y)\stackrel{def}{=}{G}^{\prime }(G_y(x))$$

$$|\mathrm{Pr}(M^P(1^n)=1)-\mathrm{Pr}(M^H(1^n)=1)|<1/p(n)$$

$$D_{f_3}\circ D_{f_2}\circ D_{f_1}(L\Vert R)\stackrel{def}{=}{D}_{f_3}(D_{f_2}(D_{f_1}(L\Vert R)))$$

$$|\mathrm{Pr}(M^{P,P^{-1}}(1^n)=1)-\mathrm{Pr}(M^{H,H^{-1}}(1^n)=1)|<1/p(n)|$$

$$D_{f_4}\circ D_{f_3}\circ D_{f_2}\circ D_{f_1}(L\Vert R)\stackrel{def}{=}{D}_{f_4}(D_{f_3}(D_{f_2}(D_{f_1}(L\Vert R))))$$

$$D_f(L\Vert R_1\Vert \cdots \Vert R_k)\stackrel{def}{=}(R_1\Vert \cdots \Vert R_k\Vert L\oplus f(R_1\Vert \cdots R_k)).$$

$$D_{f_r}\circ \cdots \circ D_{f_2}\circ D_{f_1}(L^0\Vert R_1^0\Vert \cdots \Vert R_k^0)\stackrel{def}{=}{D}_{f_r}\circ \cdots \circ D_{f_2}(D_{f_1}(L^0\Vert R_1^0\Vert \cdots \Vert R_k^0)).$$

$$D_f(L_1\Vert \cdots \Vert L_k\Vert R)\stackrel{def}{=}(R\Vert (L_1\Vert \cdots \Vert L_k)\oplus f(R))=(R\Vert L_1\oplus C_1(f(R))\Vert \cdots \Vert C_k(f(R))).$$

$$D_{f_r}\circ \cdots \circ D_{f_2}\circ D_{f_1}(L_1^0\Vert \cdots \Vert L_k^0\Vert R^0)\stackrel{def}{=}{D}_{f_r}\circ \cdots \circ D_{f_2}(D_{f_1}(L_1^0\Vert \cdots \Vert L_k^0\Vert R^0)).$$

$$L^{k+1}=R_1^k=R_2^{k-1}=\cdots =R_k^1=L^0\oplus f(R_1\Vert \cdots \Vert R_k).$$

$$L_p^{k+1}\oplus L_q^{k+1}=L_p^0\oplus L_q^0$$

$$\big{|}\Pr(M^{P}(1^{(k+1)n})=1)-\Pr(M^{K}(1^{(k+1)n}=1)\big{|}=1-1/2^{n}>1/p(n)$$

$$\mathrm{Pr}({\wedge }_{i=1}^m(y_i={\sigma }_i)|\neg \xi )=1/2^{(k+1)nm}$$

$$y_p$$

$$=(L_p^1\oplus h_2(\cdot )\Vert L_p^2\oplus h_3(\cdot )\Vert \cdots \Vert L_p^{k+1}\oplus h_{k+2}(\cdot ))$$

$$\neg \xi ={\wedge }_{i=1}^{k+1}\neg {\xi }^i={\wedge }_{i=1}^{k+1}(R_{p,1}^i\Vert \cdots \Vert R_{p,k}^i\ne R_{q,1}^i\Vert \cdots \Vert R_{q,k}^i)$$

$$\mathrm{Pr}(\xi )\le (k+1)m^2/2^{n+1}.$$

$$R_1^i\Vert \cdots \Vert R_{k-i}^i\Vert R_{k-i+1}^i\Vert \cdots \Vert R_k^i$$

$$=R_{i+1}^0\Vert \cdots \Vert R_k^0\Vert L^0\oplus h_1(\cdot )\Vert \cdots \Vert L^{i-1}\oplus h_i(\cdot )$$

$$\displaystyle\big{|}\Pr(M^{P}(1^{(k+1)n})=1)-\Pr(M^{K}(1^{(k+1)n})=1)\big{|}$$

$$\displaystyle=\big{|}\Pr(M^{P}(1^{(k+1)n})=1|\xi)-\Pr(M^{K}(1^{(k+1)n})=1)\big{|}\cdot\Pr(\xi)+$$

$$\displaystyle\quad~{}\big{|}\Pr(M^{P}(1^{(k+1)n})=1|\neg\xi)-\Pr(M^{K}(1^{(k+1)n})=1)\big{|}\cdot\Pr(\neg\xi)$$

$$\le \mathrm{Pr}(\xi )\le (k+1)m^2/2^{n+1}.$$

$$p_i^D=\mathrm{Pr}(M^{D_{f_{k+2}}\circ \cdots \circ D_{f_{i+1}}\circ D_{h_i}\circ \cdots \circ D_{h_1}}(1^{(k+1)n})=1)$$

$$1/n^c$$

$$\le |p^K-p_{k+2}^D|+|p_{k+2}^D-p_{k+1}^D|+\cdots +|p_{i+1}^D-p_i^D|+\cdots +|p_1^D-p_0^D|.$$

$$L_1^{k+1}$$

$$=L_{k-1}^{k-2}\oplus C_{k-1}(f_{k-1}(R^{k-2}))\oplus C_k(f_k(R^{k-1}))$$

$$⋮$$

Full text

Permutation Generators Based on Unbalanced Feistel Network: Analysis of the Conditions of Pseudorandomness111 Advisor: Kwang-Hyung Lee. This is an English translation of the MS Thesis written in Korean.

Kwangsu Lee

A Thesis for the Degree of Master of Science

Division of Computer Science,

Department of Electrical Engineering and Computer Science,

Korea Advanced Institute of Science and Technology

February 2000

Abstract

A block cipher is a bijective function that transforms a plaintext to a ciphertext. A block cipher is a principle component in a cryptosystem because the security of a cryptosystem depends on the security of a block cipher. A Feistel network is the most widely used method to construct a block cipher. This structure has a property such that it can transform a function to a bijective function. But the previous Feistel network is unsuitable to construct block ciphers that have large input-output size. One way to construct block ciphers with large input-output size is to use an unbalanced Feistel network that is the generalization of a previous Feistel network. There have been little research on unbalanced Feistel networks and previous work was about some particular structures of unbalanced Feistel networks. So previous work didn’t provide a theoretical base to construct block ciphers that are secure and efficient using unbalanced Feistel networks.

In this thesis, we analyze the minimal number of rounds of pseudo-random permutation generators that use unbalanced Feistel networks. That is, after categorizing unbalanced Feistel networks as source-heavy structures and target-heavy structures, we analyze the minimal number of rounds of pseudo-random permutation generators that use each structure. Therefore, in order to construct a block cipher that is secure and efficient using unbalanced Feistel networks, we should follow the results of this thesis. Additionally, we propose a new unbalanced Feistel network that has some advantages such that it can extend a previous block cipher with small input-output size to a new block cipher with large input-output size. We also analyze the minimum number of rounds of a pseudo-random permutation generator that uses this structure.

Contents

1. 1 Introduction

2. 2 Preliminaries

3. 2.1 Notation

4. 2.2 Block Cipher

5. 2.3 Feistel Network

6. 2.4 Pseudo-Randomness

7. 2.5 Pseudo-Random Permutation Generator

8. 3 Analysis of Unbalanced Feistel Networks

9. 3.1 Definition and Category

10. 3.2 Overview of the Pseudo-Random Proof

11. 3.3 The Pseudo-Random Proof of $kn$:$n$-UFN

12. 3.4 The Pseudo-Random Proof of $n$:$kn$-UFN

13. 4 Analysis of Modified Unbalanced Feistel Networks

14. 4.1 Definition and Property

15. 4.2 The Pseudo-Random Proof of $n$:$kn$-UFN2

16. 5 Comparison of Unbalanced Feistel Networks

17. 5.1 Using Memory and Pseudo-Random Bit Generator

18. 5.2 Using the GGM Pseudo-Random Function

19. 6 Conclusion

Chapter 1 Introduction

A block cipher is a symmetric key cryptosystem that encrypts a plaintext into a ciphertext block by block [20]. The block cipher should have the one-to-one correspondence between plaintexts and ciphertexts. The block cipher is the most important element in most cryptographic systems. In particular, it is the essential element used in the implementation of other cryptographic primitives such as pseudo-random number generators, stream ciphers, and hash functions [20, 33]. Since the security of most cryptographic systems depends on the security of block ciphers, a secure block cipher must be implemented to build a secure cryptosystem. A secure block cipher is a block cipher where the output value of the block cipher becomes a random value. That is, when the output value of the block cipher is random, the block cipher becomes a secure one since it is very hard for an attacker to guess the plaintext or the secret key of the cipher from the ciphertext. Mathematically, a block cipher is a secure block cipher if it is a pseudo-random permutation (PRP) generator [16].

The biggest problem of implementing a block cipher is that it is difficult to implement a function that has the one-to-one correspondence property and the output randomness property at the same time. The way to solve this problem is to use a Feistel network structure. A Feistel network structure is a method that converts an arbitrary function into a one-to-one correspondence function. This structure was designed by H. Feistel in designing the Lucifer cipher [8, 9]. That is, if a block cipher is implemented using a Feistel network, a secure block cipher can be easily implemented by simply implementing an arbitrary function whose output value is random. This is because if the output value of an arbitrary function is random, the Feistel network structure automatically converts it to a one-to-one correspondence function.

Therefore, most block ciphers are constructed by using a Feistel network structure or a slightly modified structure of the Feistel network structure [23, 38, 33, 29]. In addition, some research has been done on the security of block ciphers using the Feistel network structure [3, 20, 18, 32]. In particular, there have been numerous studies on pseudo-random permutation generators after the work of Luby and Rackoff [16, 36, 40, 28, 31, 32, 26, 25, 1, 7, 27]. However, the problem of the previous (balanced) Feistel network is that it is difficult to construct a block cipher with a large input/output size. That is, when a block cipher that can process a large size of data at one time is implemented, the input size of a round function used in the Feistel network structure also increases as the input/output size of the block cipher increases. In practice, however, the cost of implementing a round function is proportional to the input size of the round function. Therefore, the previous (balanced) Feistel network structure is inappropriate when constructing a block cipher with large input/output size.

One of the ways to solve this problem is to use an unbalanced Feistel network structure which is a modification of the previous balanced Feistel network. An unbalanced Feistel network is a Feistel network structure in which the size of a target-block combined with the output of a round function and the size of a source-block which is the input of the round function are different [2, 17, 35]. Therefore, the round function in an unbalanced Feistel network structure can be implemented at a lower cost than a balanced Feistel network since it is possible to control the input size of the round function in the unbalanced Feistel network structure. Especially, as the information processing capability of the computer increases, a block cipher with a large input-output size that is capable of processing a large amount of information will be needed. Therefore, much research is needed on unbalanced Feistel networks suitable for implementing block ciphers with large input-output size. However, there are not many studies on unbalanced Feistel networks.

There are some studies to implement a pseudo-random permutation generator, which is a secure block cipher using an unbalanced Feistel network [14, 21]. However, these studies failed to show the minimum number of rounds for a block cipher using an unbalanced Feistel network to become a secure and efficient block cipher. In fact, the minimum number of rounds is important when constructing a block cipher because the number of rounds greatly affects the speed and cost of the block cipher. That is, when constructing a block cipher, a small number of rounds must be used to implement a fast block cipher at low cost. It is therefore very important to determine the minimum number of rounds to be a secure block cipher.

Therefore, in this thesis, we first find the minimum number of rounds for a pseudo-random permutation generator, which is a secure block cipher using a Feistel network. Next, we propose a scalable new unbalanced Feistel network structure and find the minimum number of rounds for this structure to become a secure block cipher. The advantage of a newly proposed structure is that it can easily construct a block cipher with a large input-output size using a previously designed secure block cipher with fixed input-output size. In other words, there is a lot of analysis and research on a new block cipher in order to newly design a block cipher with a large input-output size. However, by using this newly proposed structure, a new block cipher with a large input-output size can be implemented using the previously analyzed secure block cipher. So we do not have to do another analysis and research.

The structure of this thesis is as follows. In Chapter 2, we first define a block cipher, a Feistel network, and a pseudo-random number generator. Then we summarize the existing studies on pseudo-random permutation generators. In Chapter 3, we investigate the condition of the number of rounds for a block cipher using an unbalanced Feistel network to be a pseudo-random permutation generator. In Chapter 4, we propose a scalable unbalanced Feistel network structure, and analyze the conditions for a secure block cipher using this new structure to be a pseudo-random permutation generator. In Chapter 5, we compare a balanced Feistel network structure, an unbalanced Feistel network structure, and the newly proposed structure. Finally, in Chapter 6, we conclude the thesis and present the direction of future research.

Chapter 2 Preliminaries

In this chapter, we define the terms used in the thesis and summarize the studies related to a pseudo-random permutation generator. A block cipher is a secret-key cryptosystem that processes messages using the same key when encrypting and decrypting messages. A block cipher is the basis of cryptographic systems for message authentication, data integrity verification, and digital signature. Mathematically, a block cipher is a one-to-one function (permutation) since it must be able to encrypt and decrypt messages using a secret key. A Feistel network structure is most commonly used to build block ciphers because it has the advantage of converting arbitrary functions to permutations. In order for a block cipher to be a secure block cipher, the output value of the block cipher must be a random value. That is, when a block cipher becomes a pseudo-random permutation generator, it becomes a secure block cipher. In this case, the permutation generator $P$ is pseudo-random, meaning that any efficient algorithm can not distinguish between an ideal permutation generator and $P$.

This chapter is organized as follows. In Section 2.1, we first define symbols used in this paper. In Section 2.2, we define a block cipher, which is a secret-key cryptosystem, and investigate the characteristics of the block cipher and attack methods for block ciphers. In Section 2.3, we define the most commonly used Feistel networks for building block ciphers and discuss the advantages and disadvantages of them. In Section 2.4, we define the pseudorandomness. In Section 2.5, we finally summarize existing studies on pseudo-random permutation generators

2.1 Notation

The symbols used in this paper are defined as follows.

• •

$I_{n}$ represents a set of all $n$-bit strings. That is, $\{0,1\}^{n}$.

• •

$F:I_{s}\rightarrow I_{t}$ is a set of all functions whose inputs are $s$-bits and whose outputs are $t$-bits.

• •

$F_{n}$ is a set of functions whose input and output are both $n$-bits in size. That is, $F_{n}$ is $F:I_{n}\rightarrow I_{n}$.

• •

$P_{n}$ is a set of permutations (one-to-one functions) whose input and output sizes are both $n$-bits. That is, $P_{n}\subset F_{n}$

• •

$|x|$ is the length of a bit string $x$. That is, $|x|$ is $n$ if the bit size of $x$ is $n$-bits.

• •

$x\oplus y$ is an exclusive OR (XOR) per bit unit when the bit size of $x$ and $y$ is equal.

• •

$x\|y$ is a concatenation of two bit strings $x$ and $y$. In this case, we have $|x\|y|=|x|+|y|$.

• •

$f\circ g$ is the composition of two functions $f$ and $g$ when $f$ and $g$ are elements of the set $F_{n}$. That is, $f\circ g(x)=f(g(x))$.

2.2 Block Cipher

A block cipher can usually be a private-key cryptosystem or a public-key cryptosystem. However, in this paper, the secret-key cryptosystem is called a block cipher. The structure of a block cipher is given in Figure 2.1.

A block cipher is a function that sends an $n$-bit plaintext to an $n$-bit ciphertext [20, 37]. The function of the block cipher is specified by an $\ell$-bit secret key. If a plaintext is encrypted and decrypted again, the original plaintext must be obtained. Therefore, the block cipher must be a one-to-one function (bijection) for $n$-bit plaintexts and $n$-bit ciphertexts when a secret key is specified. That is, each secret key defines a different permutation. The definition of the block cipher is as follows.

Definition 2.2.1** (Block Cipher).**

Let $K$ be the set of $\ell$-bit secret keys. The $n$-bit block cipher is defined as a function $E:I_{n}\times K\rightarrow I_{n}$. We have that $E^{-1}(E(p,k),k)=p$ holds for an arbitrary plaintext $p$ and a random key $k$ ($k\in K$).

A true random block cipher is a block cipher that generates all permutations between the domain and the range [20]. In the $n$-bit block cipher, the domain corresponds to the set of plaintexts and the number of plaintexts is $2^{n}$, so the size of the domain is $2^{n}$. The range corresponds to the set of ciphertexts and the number of ciphertexts is $2^{n}$, so the size of the range is also $2^{n}$. Therefore, the number of all permutations is $2^{n}!$. In the $n$-bit block cipher, one key specifies one permutation, so we need $2^{n}!$ number of secret keys to enumerate all permutations. That is, the size of a secret key of the ideal block cipher must be $\log(2^{n}!)\approx(n-1.44)2^{n}$ bits.

Definition 2.2.2** (Ideal Block Cipher).**

An ideal block cipher is a block cipher that implements all $2^{n}!$ number of one-to-one functions that exist between $2^{n}$ number of elements. In this case, each secret key specifies each one-to-one function.

It is impossible to actually build an ideal block cipher because it requires $(n-1.44)2^{n}$ bits for a secret key. Thus, in order for a block cipher using an $\ell$-bit secret key to be secure, the permutations that are specified by $\ell$-bit secret keys must appear randomly chosen from all $2^{n}!$ permutations.

The security of a block cipher is measured by the security against the various attack methods of attackers. The attack on the block cipher is divided into four categories according to the information that the attacker can access:

Ciphertext-only attack: The attacker uses only ciphertexts to get the secret key of the block cipher. 2. 2.

Known-plaintext attack: The attacker uses known plaintexts and ciphertexts pairs to find the secret key of the block cipher. 3. 3.

Chosen-plaintext attack: The attacker finds the secret key of the block cipher by using the pairs of plaintexts and corresponding ciphertexts chosen by the attacker. 4. 4.

Chosen-ciphertext attack: The attacker finds the secret key using the chosen ciphertexts and its corresponding plaintexts.

Differential cryptanalysis and linear cryptanalysis are the most powerful methods of attacking block ciphers. Differential cryptanalysis is a chosen-plaintext attack developed by Biham and Shamir [3]. This attack method exploits the fact that the probability distribution of the difference between the input/output pair of a nonlinear function is not uniform. Linear cryptanalysis is a known-plaintext attack developed by Matsui [18]. This attack method extracts the information of a related key by using a linear approximation of a nonlinear function.

2.3 Feistel Network

A Feistel network is the most commonly used structure for designing a block cipher. This structure was first used when designing a Lucifer cipher by H. Feistel [8, 9]. After that, this was used to design block ciphers such as DES, FEAL, Blowfish, and RC5 [23, 38, 33, 29].

A Feistel network is a method that converts an arbitrary function to a permutation that is a one-to-one correspondence function. The definition of a Feistel network is as follows.

Definition 2.3.1** (Feistel Network).**

For any function $f$ belonging to $F:I_{s}\rightarrow I_{t}$, one round Feistel network is defined as a function $D_{f}(L\|R)=(R\|L\oplus f(R))$. Similarly, for the functions $f_{1},f_{2},\ldots,f_{r}$, which belong to the set $F:I_{s}\rightarrow I_{t}$, an $r$ rounds Feistel network is defined as a function $D_{f_{r}}\circ\cdots\circ D_{f_{2}}\circ D_{f_{1}}(L\|R)\stackrel{{\scriptstyle def}}{{=}}D_{f_{r}}\circ\cdots\circ D_{f_{2}}(D_{f_{1}}(L\|R))$, where $|L|=t$, $|R|=s$, $|L|+|R|=n$, and $D_{f}\in P_{n}$.

The above Feistel network can be seen as a permutation. To show that a function is a one-to-one correspondence function (bijection), we should show that it is a one-to-one function and an onto function. However, we only need to show that it is a one-to-one function since the input and output bits of the Feistel network are the same.

Theorem 2.3.1**.**

The function $D_{f}(L\|R)=(R\|L\oplus f(R))$ is a one-to-one function.

Proof.

If the function $D_{f}$ is a one-to-one function, then $D_{f}(x)\neq D_{f}(y)$ for $x$ and $y$ such that $x\neq y$. If $x=(L_{1}\|R_{1})$ and $y=(L_{2}\|R_{2})$, then $D_{f}(x)=(R_{1}\|L_{1}\oplus f(R_{1}))$ and $D_{f}(y)=(R_{2}\|L_{2}\oplus f(R_{2}))$. Because of $x\neq y$, we consider two cases.

• •

Case $R_{1}\neq R_{2}$: $D_{f}(x)\neq D_{f}(y)$ by the definition of $D_{f}$.

• •

Case $L_{1}\neq L_{2}$ and $R_{1}=R_{2}$: $L_{1}\oplus f(R_{1})\neq L_{2}\oplus f(R_{2})$ since $f(R_{1})=f(R_{2})$.

So the function is a one-to-one function. ∎

A Feistel network is divided into a balanced Feistel network and an unbalanced Feistel network [35]. A balanced Feistel network is a Feistel network in Definition 2.3.1 with the same $L$ and $R$ sizes. In contrast, an unbalanced Feistel network is a Feistel network in Definition 2.3.1 with different $L$ and $R$ sizes ($|L|\neq|R|$). The balanced Feistel network and unbalanced Feistel network structures are given in Figure 2.2.

The DES algorithm that uses a Feistel network was invented in 1970s and it has been used as the standard block cipher for 20 years [23]. Many researchers have studied the security of the DES algorithm [3, 18, 34]. In addition, many other block ciphers that were invented after DES were also affected by the DES cipher.

Example 1** (DES).**

The DES algorithm is a 64-bit block cipher with a 56-bit secret key. This cipher has a 16 rounds balanced Feistel network structure. The $i$th round is defined as

[TABLE]

where $|L^{i-1}|=|R^{i-1}|=32$, $|K_{i}|=48$, $E:I_{32}\rightarrow I_{48}$ is an expansion function, $S:I_{48}\rightarrow I_{32}$ is a substitution function, and $P:I_{32}\rightarrow I_{32}$ is a permutation function.

An unbalanced Feistel network is divided into a source-heavy unbalanced Feistel network and a target-heavy unbalanced Feistel network [35]. The source-heavy unbalanced Feistel network is a Feistel network where the size of the block $R$ which is the input to the $F$ function, is greater than the size of the block $L$ which is combined with the output of the $F$ function ($|R|>|L|$). Whereas the target-heavy Feistel network is a Feistel network where the size of the block $R$ is smaller than the size of the block $L$ ($|R|<|L|$). The structures of source-heavy and target-heavy Feistel networks are given in Figure 2.3.

The MARS algorithm is a block cipher proposed for the advanced encryption standard (AES) to replace the DES block cipher [6]. This cipher uses a target-heavy unbalanced Feistel network.

Example 2** (MARS).**

The MARS algorithm is a 128-bit block cipher proposed for AES and it can have different size of secret keys. This cipher has a 32 rounds unbalanced Feistel network. The $i$th round is defined as

[TABLE]

where $\boxplus$ is the addition operator in mod $2^{32}$.

The main advantage of a block cipher using an unbalanced Feistel network is that it can select the input size of the $F$ function used in the Feistel network. In particular, as the amount of data that the computer has to process due to the development of the Internet, the amount of messages to be encrypted is also increasing. As the information throughput increases, an encryption scheme that can process large amounts of data becomes necessary. Therefore, a block cipher with a large input size is needed. The advanced encryption standard (AES) selected by National Institute of Standards and Technology (NIST) also requires a 128-bit block cipher to reflect this demand [22].

When implementing a block cipher with a large input value, it is difficult to implement the $F$ function of a Feistel network if a balanced Feistel network is used. This is because the cost of implementing the $F$ function is generally proportional to the size of the input value of the $F$ function. However, since the input size of the $F$ function can be selected in an unbalanced Feistel network, it is very effective to use an unbalanced Feistel network in implementing a large block cipher. In other words, a block cipher with a large input size using a target-heavy unbalanced Feistel network can be implemented at a lower cost than a cipher using other Feistel network structures.

2.4 Pseudo-Randomness

Before defining pseudo-randomness, we first review what two distributions are computationally equivalent. The computational equivalence of two distributions means that no effective algorithm can determine that two distributions are different. In other words, computational indistinguishability is a criterion for judging the equivalence of two distributions. Therefore, the pseudo-randomness distribution is a distribution that can not be distinguished from the truly random distribution by computation [11].

At this time, it is necessary to define an algorithm for determining whether two distributions are identical. The definition of an algorithm for determining identical distributions is defined by the following oracle machine.

Definition 2.4.1** (Oracle Machine $M$).**

An oracle machine $M$ is a Turing machine that has an oracle tape as an additional tape and has two special states called “oracle invocation” and “oracle appeared”. The oracle machine has an input value of $1^{n}$ and an output value of 1. The oracle machine that can access a function $f$ whose input value is $n$ bits in size is called $M^{f}(1^{n})$ and operates as follows: If the state of the oracle machine is not “oracle appeared”, then it operates as the same as a normal Turing machine. If the state of the oracle machine is “oracle origin”, then the oracle machine writes an oracle query $x_{1}$ which is $n$ bits string to the oracle tape. Then, the state of the oracle machine is changed to “oracle appeared”, and the content of the oracle tape is replaced by the oracle reply $y_{1}=f(x_{1})$. This process repeats $m$ times. The 1-bit output of the oracle machine is calculated from the values $<x_{1},y_{1}>,<x_{2},y_{2}>,\ldots,<x_{m},y_{m}>$.

Because the oracle machine determines the equality of the two distributions, the pseudo-randomness is determined by the computational power of the oracle machine. An effective algorithm for determining the equality of two distributions is an oracle machine that calculates the output value within a probabilistic polynomial-time. Thus, the pseudo-random distribution refer to a distribution that can not be distinguished from the true random distribution using probabilistic polynomial-time oracle machines. At this time, the indistinguishability is defined as the following.

Definition 2.4.2** (Polynomial-Time Indistinguishability).**

If two distributions $X$ and $Y$ are indistinguishable in polynomial-time, then the following equation holds for all probabilistic polynomial-time algorithms $D$, all polynomials $p(\cdot)$, and sufficiently large $n$ values ​​

[TABLE]

where the output of algorithm $D$ is 1 bit.

A cryptographically secure pseudo-random bit generator was first introduced by Blum and Micali [5]. After that, a number of pseudo-random bit generators have been proposed based on number theoretic problems [4, 15, 39]. Håstard et al. have shown that a pseudo-random bit generator can be constructed using an arbitrary one-way function [13]. A pseudo random bit generator is defined as follows. In this case, an ideal random bit generator $R$ has a uniform distribution of all possible output values.

Definition 2.4.3** (Pseudo-Random Bit Generator).**

A pseudo-random bit generator is defined by a deterministic polynomial-time algorithm $G$ and satisfies the following two conditions:

Scalability: $|G(s)|>|s|$ for all $s\in\{0,1\}^{*}$. 2. 2.

Pseudo-Randomness: The algorithm $G$ is indistinguishable from the ideal random bit generator $R$ in polynomial time.

Blum and Micali showed that it is possible to construct a pseudo-random bit generator using the difficulties of the discrete logarithm problem [5]. The pseudo-random bit generator of Blum and Micali is described in Example 3.

Example 3** (Blum-Micali Pseudo-Random Bit Generator).**

Let $p$ be a large prime, and $g$ be a generator of $\mathbb{Z}_{p}^{*}$. The set $D$ is defined as $D=\mathbb{Z}_{p}^{*}={0,1,\ldots,p-1}$. The function $f:D\rightarrow D$ is defined as $f(x)=g^{x}\mod p$. The function $B:D\rightarrow\{0,1\}$ is defined as $B(x)=1$ for $0\leq\log_{g}(x)\leq(p-1)/2$ and $B(x)=0$ for $\log_{g}(x)>(p-1)/2$. The Blum-Micali pseudo-random bit generation algorithm is described as follows.

 generate a large prime $p$ and a generator $g$ of $\mathbb{Z}_{p}^{*}$.

 select a random integer $x_{0}$ from $D=\{0,1,\ldots,p-1\}$.

 for $1\leq i\leq\ell$ do

  $x_{i}\leftarrow f(x_{i-1})$.

  $b_{i}\leftarrow B(x_{i})$.

 end for

 output $b_{1},b_{2},\ldots,b_{\ell}$.

Blum, Blum, and Shub showed that it is possible to construct a pseudo-random bit generator using the difficulties of the quadratic residuacity problem [4]. The pseudo-random bit generator of Blum, Blum, and Shub is described in Example 4.

Example 4** (Blum-Blum-Shub Pseudo-Random Bit Generator).**

Let $LSB(x)$ be a function that outputs the least significant bit of a binary string $x$. The Blum-Blum-Shub pseudo-random bit generation algorithm is described as follows.

 generate a large prime $p$ such that $p\mod 4=3$.

 generate a large prime $q$ such that $q\mod 4=3$.

 $n\leftarrow pq$.

 select a random integer $s\in\{1,\ldots,n-1\}$ such that $gcd(s,n)=1$.

 $x_{0}\leftarrow s^{2}\mod n$.

 for $1\leq i\leq\ell$ do

  $x_{i}\leftarrow x_{i-1}^{2}\mod n$.

  $b_{i}\leftarrow LSB(x_{i})$.

 end for

 output $b_{1},b_{2},\ldots,b_{\ell}$.

A pseudo-random function generator is a function generator that is indistinguishable from an ideal random function generator $H$ that generates all possible functions with a uniform probability distribution. Goldreich, Goldwasser, and Micali showed that a pseudo-random bit generator can be used to create a pseudo-random function generator [12]. A pseudo-random function generator is defined as follows.

Definition 2.4.4** (Pseudo-Random Function Generator).**

A pseudo-random function generator is defined as an algorithm $F$ that generates a set of functions. For all probabilistic polynomial-time oracle $M$, all polynomials $p(\cdot)$, and sufficiently large $n$ values, it satisfies

[TABLE]

where $H$ is an ideal random function generator that generates all possible functions as a uniform probability distribution.

Goldreich, Goldwasser and Micali proposed a pseudo-random function generator as follows.

Example 5** (GGM Pseudo-Random Function Generator).**

Let $G$ be a pseudo random bit generator whose input is $k$ bits and whose output is $2k$ bits. That is, $G(x)=b_{1}^{x}b_{2}^{x}\cdots b_{2k}^{x}$ for the initial value $x\in I_{k}$. Let $G_{0}(x)$ be the first $k$ bit string of $G(x)$ and $G_{1}(x)$ be the remaining $k$ bit string of $G(x)$. That is, $G_{0}(x)=b_{1}^{x}\cdots b_{k}^{x}$ and $G_{1}(x)=b_{k+1}^{x}\cdots b_{2k}^{x}$. For a $t$-bit binary string $\alpha=\alpha_{1}\alpha_{2}\cdots\alpha_{t}$, $G_{\alpha}(x)$ is defined as $G_{\alpha_{t}}(\cdots(G_{\alpha_{2}}(G_{\alpha_{1}}(x))))$. For a given $x\in I_{k}$, a pseudo-random function $f_{x}:I_{k}\rightarrow I_{k}$ is defined as

[TABLE]

where $y\in I_{k}$. For polynomials $P_{1}$ and $P_{2}$ and given $x\in I_{k}$, a pseudo-random function $F:I_{P_{1}(k)}\rightarrow l_{P_{2}(k)}$ is defined as

[TABLE]

where $y\in I_{P_{1}(k)}$ and $G^{\prime}$ is a pseudo-random bit generator with $k$ bits input and $P_{2}(k)$ bits output.

Let us look at the performance of the GGM pseudo-random function generator. A pseudo-random function generator $F_{x}:I_{P_{1}(k)}\rightarrow I_{P_{2}(k)}$ must generate a pseudo-random string of approximately $P_{1}(k)\cdot 2k+P_{2}(k)$ bits. Assuming that the size $k$ of the string $x$ is properly selected and that $P_{2}(k)$ is not a value much larger than $P_{1}(k)$, then the size of pseudo-random bits that the pseudo-random function $F_{x}$ must generate is proportional to the input bit size $P_{1}(k)$. So the smaller the input bit size of the function, the faster the function can be generated.

A pseudo-random permutation generator was introduced by Luby and Rackoff [16]. The definition of pseudo-random permutation generator is given as follows.

Definition 2.4.5** (Pseudo-Random Permutation Generator).**

A pseudo-random permutation generator is defined as an algorithm $P$ which generates a set of permutations. For all probabilistic polynomial-time oracle $M$, all polynomials $p(\cdot)$, and sufficiently large $n$ values, it satisfies the following equation

[TABLE]

where $H$ is an ideal random permutation generator that produces all possible permutations with a uniform probability distribution.

Luby and Rackoff showed that a pseudo-random permutation generator could be constructed by using a pseudo-random function and a three rounds balanced Feistel network structure.

Example 6**.**

A three rounds balanced Feistel network that uses pseudo-random functions $f_{1},f_{2},f_{3}$ is a pseudo-random permutation generator and is defined as

[TABLE]

where $D_{f_{i}}(L\|R)=(R\|L\oplus f_{i}(R))$ and $|L|=|R|$.

A super pseudo-random permutation generator is a permutation generator, which can not be distinguished from an ideal random permutation generator when an oracle machine is able to access both a permutation and the inverse of the permutation. The definition is given as follows.

Definition 2.4.6** (Super Pseudo-Random Permutation Generator).**

A super pseudo-random permutation generator is defined as an algorithm $P$ that generates the set of permutations. For all probabilistic polynomial-time oracle $M$, all polynomials $p(\cdot)$, and the large $n$ value, it satisfies the following equation

[TABLE]

where $P^{-1}$ is the inverse of the permutation $P$, $H$ is an ideal random permutation generator that produces a permutation with a uniform probability distribution, and $H^{-1}$ is the inverse of $H$.

Luby and Rackoff show that it is possible to build a super pseudo-random permutation generator by using a pseudo-random function and a four rounds balanced Feistel network structure.

Example 7**.**

A four rounds balanced Feistel network that uses pseudo-random functions $f_{1},f_{2},f_{3},f_{4}$ is a super pseudo-random permutation generator and is defined as

[TABLE]

where $D_{f_{i}}(L\|R)=(R\|L\oplus f_{i}(R))$ and $|L|=|R|$.

If a block cipher is a pseudo-random permutation generator, then it becomes a secure block cipher for a chosen-plaintext attack. If a block cipher is a super pseudo-random permutation generator, then it becomes a secure block cipher for a chosen-plaintext attack and a chosen-ciphertext attack.

2.5 Pseudo-Random Permutation Generator

The research on pseudo-random permutation generators has been started by Luby and Rackoff. They have proved that a three rounds balanced Feistel network that uses pseudo-random functions is a pseudo-random permutation generator [16]. The proof of pseudo-random permutation is largely divided into two parts. First, the proof show that a three rounds Feistel network that uses ideal random functions becomes a pseudo-random permutation generator. Next, the proof show that that a three rounds Feistel network that uses pseudo-random functions is pseudo-random by using contradiction. The proof that shows the pseudo-randomness of the three rounds Feistel network that uses ideal random functions looks like this. First, we define $BAD$ as an event that a machine can distinguish a balanced Feistel permutation generator $P$ from an ideal permutation generator $K$. Next the proof show that $P$ is the same as $K$ if the $BAD$ event does not occur, and it also show that the probability of the $BAD$ event is very low. To prove that a three rounds Feistel network that uses pseudo-random functions is pseudo-random by using contradiction. In other words, if the three rounds Feistel network that uses ideal random functions is pseudo-random, but the three rounds Feistel network that uses pseudo-random functions is not pseudo-random, then it is possible to derive a contradiction on the assumption that pseudo-random functions are pseudo-random.

There have been some studies to simply prove the pseudo-randomness of permutation generators since the work of Luby and Rackoff. Maurer used a local random function instead of a pseudo-random function to show that a three rounds Feistel network is a pseudo-random permutation generator [19]. Naor and Reingold have proved that a three rounds structure that uses a pairwise independent permutation and a two rounds Feistel network is pseudo-random [21].

After the work of Luby and Rackoff, much research focused to build pseudo-random permutation generators by using balanced Feistel networks and pseudo-random functions with small number of rounds. That is, if we use pseudo-random functions with small number of rounds, then the size of keys used in the permutation can be decreased since the size of keys for pseudo-random functions is large. Let $f,g,h,e$ be pseudo-random functions, and $f^{i}$ be the composition of the function $f$ with $i$ times. The results are summarized as follows.

• •

$D_{f}\circ D_{f}\circ D_{f}$ and $D_{f}\circ D_{g}\circ D_{f}$ are not pseudo-random permutations [30].

• •

$D_{g}\circ D_{g}\circ D_{f}$ and $D_{g}\circ D_{f}\circ D_{f}$ are not pseudo-random permutations [24, 41].

• •

$D_{g}\circ D_{g}\circ D_{f}\circ D_{f}$ is not a super pseudo-random permutation [32].

• •

For all $i,j,k\geq 1$, $D_{f^{k}}\circ D_{f^{j}}\circ D_{f^{i}}$ is not a pseudo-random permutation [40].

• •

For all $i,j,k,\ell\geq 1$, $D_{f^{\ell}}\circ D_{f^{k}}\circ D_{f^{j}}\circ D_{f^{i}}$ is not a super pseudo-random permutation [32].

• •

$D_{f^{2}}\circ D_{f}\circ D_{f}\circ D_{f}$ is a pseudo-random permutation [28].

• •

If $I$ is an identity function, $D_{f^{2}}\circ D_{I}\circ D_{f}\circ D_{f^{2}}\circ D_{I}\circ D_{f}$ is a super pseudo-random permutation [32].

• •

If $\zeta$ is a simple function like a shift operation, $D_{f\circ\zeta\circ f}\circ D_{f}\circ D_{f}\circ D_{f}$ is a pseudo-random permutation and $D_{f\circ\zeta\circ f}\circ D_{f}\circ D_{f}\circ D_{f}\circ D_{f}$ is a super pseudo-random permutation [25].

Although many studies are concerned with the use of a small number of pseudo-random functions, reducing the size of the secret key using fewer pseudo-random functions is not a huge benefit. This is because it is possible to increase a small key to a large key using a pseudo random bit generator.

Research to build pseudo-random permutation generators from unbalanced Feistel network structures has only recently begun [21, 14]. Naor and Reingold showed that an unbalanced Feistel network with total $k+2$ number of rounds is a pseudo-random permutation generator if it uses a pairwise independent permutation in the first round, a source-heavy unbalanced Feistel network where the size of a source block is $k$ times larger than a target-block in the remaining rounds, and the $F$ function of the Feistel network is a pseudo-random function [21]. The pairwise independent permutation is defined as a permutation in which the distribution of the function output values ​​is uniform even if any two input values ​​are selected. The pseudo-random permutation generator of Naor and Reingold is given in Figure 2.4 where $k$ is two, $h_{1}$ is a pairwise independent of permutation, and $f_{1},f_{2}$, and $f_{3}$ are pseudo-random functions.

Jutla showed that an unbalanced Feistel network with total $2k+2$ number of rounds is a pseudo-random permutation generator if it uses a pseudo-random function for the $F$-function of the Feistel network, and a target-heavy unbalanced Feistel network where a target-block size is larger than a source block by $k$ times [14]. At this time, the probability that an oracle machine that distinguishes between an ideal random permutation generator and a $2k+2$ rounds target-heavy unbalanced Feistel network is less than $(m^{k}/2^{kn})$. The pseudo-random permutation generator of Jutla is given in Figure 2.5 where $k$ is two and total rounds is six.

Chapter 3 Analysis of Unbalanced Feistel Networks

In this chapter, we analyze the conditions for permutation generators based on Feistel networks to be pseudo-random. This chapter is summarized as follows. An unbalanced Feistel network is a Feistel network with different sizes of source and target blocks. The unbalanced Feistel network is largely divided into a source-heavy unbalanced Feistel network and a target-heavy unbalanced Feistel network. For a source-heavy unbalanced Feistel network ($kn$:$n$-UFN) where a source block is $k$ times larger than a target block, a $k+2$ rounds $kn$:$n$-UFN using pseudo-random functions is a pseudo-random permutation generator. For a target-heavy unbalanced Feistel network ($n$:$kn$-UFN) where a target-block is $k$ times larger than a source block, a $k+2$ rounds $n$:$kn$-UFN using pseudo-random functions is a pseudo-random permutation generator. Therefore, the minimum number of rounds for a unbalanced Feistel network using pseudo-random functions to be pseudo-random is $k+2$ rounds.

The structure of this chapter is as follows. In Section 3.1, we divide unbalanced Feistel networks into two categories. In Section 3.2, we overview the proof method to prove the pseudorandomness of an unbalanced Feistel network. In Section 3.3, we analyze the conditions for a source-heavy unbalanced Feistel network to be pseudo-random. In Section 3.4, we analyze the conditions for a target-heavy unbalanced Feistel network to be pseudo-random.

3.1 Definition and Category

In a Feistel network, a block that is the input of a round function is called a source block, and a block that is combined with the output of a round function is called a target block. An unbalanced Feistel network is a Feistel network with different source and target block sizes. An unbalanced Feistel network with a source-block size of $s$ bits and a target block size of $t$ bits is denoted as $s$:$t$-UFN.

An unbalanced Feistel network is largely classified as a source-heavy unbalanced Feistel network or a target-heavy unbalanced Feistel network. A source-heavy unbalanced Feistel network is an unbalanced Feistel network where the size of a source block is larger than that of a target block. The source-heavy unbalanced Feistel network is denoted by $kn$:$n$-UFN and it is defined as follows. For instance, a 3 rounds $2n$:$n$-UFN structure is described in Figure 3.1.

Definition 3.1.1** ($kn$:$n$-UFN).**

For any function $f$ belonging to the set of functions $F:I_{kn}\rightarrow I_{n}$, one round $kn$:$n$-UFN is defined by the following permutation

[TABLE]

Similarly, for any functions $f_{1},f_{2},\ldots,f_{r}$ belonging to the set of functions $F:I_{kn}\rightarrow I_{n}$, an $r$ rounds $kn$:$n$-UFN is defined by the following permutation

[TABLE]

In this case, we have $|L|=|R_{i}|=n$.

A target-heavy unbalanced Feistel network is an unbalanced Feistel network where the size of a target block is larger than that of a source block. The target-heavy unbalanced Feistel network is denoted by $n$:$kn$-UFN and it is defined as follows. For instance, a 3 rounds $n$:$2n$-UFN structure is described in Figure 3.2.

Definition 3.1.2** ($n$:$kn$-UFN).**

For any function $f$ belonging to the set of functions $F:I_{n}\rightarrow I_{kn}$, one round $n$:$kn$-UFN is defined by the following permutation

[TABLE]

In this case, the function $C(\cdot)$ satisfies $C_{1}(f(R))\|\cdots\|C_{k}(f(R))=f(R)$. Similarly, for any functions $f_{1},f_{2},\ldots,f_{r}$ belonging to the set of functions $F:I_{n}\rightarrow I_{kn}$, an $r$ rounds $n$:$kn$-UFN is defined by the following permutation

[TABLE]

In this case, we have $|L_{i}|=|R|=|C_{i}(\cdot)|=n$.

3.2 Overview of the Pseudo-Random Proof

We first overview the way to prove that an $r$ rounds unbalanced Feistel network using a pseudo-random function generator is a pseudo-random permutation generator. The overall method is similar to the method used by Luby and Rackoff [16].

First, we show that an $r-1$ rounds unbalanced Feistel network is not a pseudo-random permutation generator. For this, we show that there exists a linear relationship between the input and output values ​​of the $r-1$ rounds unbalanced Feistel network. Then we use this linear relationship to build an oracle machine that distinguishes between an ideal random permutation generator and the $r-1$ rounds unbalanced Feistel network permutation generator.

Next, we show that if an $r$ rounds unbalanced Feistel network that uses ideal random functions is pseudo-random, then an $r$ rounds unbalanced Feistel network that uses pseudo-random functions is also pseudo-random. This is because if the $r$ rounds unbalanced Feistel network using ideal random functions is pseudo-random but the $r$ rounds unbalanced Feistel network using pseudo-random functions is not pseudo-random, then it is possible to show an contradiction that the pseudo-random function is pseudo-random.

The following is a proof strategy to showing that an $r$ rounds unbalanced Feistel network using ideal random functions is pseudo-random. We first define the case where the $r$ rounds unbalanced Feistel network is not a pseudo-random permutation generator as a BAD event. For the BAD event, we prove the following two things.

If the BAD event does not occur, the output of the $r$ rounds unbalanced Feistel network that uses ideal random functions is uniform. 2. 2.

The probability of the BAD event is very low.

By using these two things, we can prove that the $r$ rounds Feistel network using ideal random functions is a pseudo-random permutation generator.

3.3 The Pseudo-Random Proof of $kn$:$n$-UFN

The following theorem show that a $kn$:$n$-UFN is not pseudo-random if the number of rounds is less than or equal to $k+1$.

Theorem 3.3.1**.**

A $k+1$ rounds $kn$:$n$-UFN is not pseudo-random.

Proof.

For the proof, we first show that there is a linear relationship between the input and output values ​​of the $kn$:$n$-UFN, and that this linear relationship can be used to create an oracle machine that can distinguish between an ideal random permutation generator and the $kn$:$n$-UFN. From the definition of a $kn$:$n$-UFN, we first obtains the following equation

[TABLE]

We select two oracle queries $x_{p}=(L_{p}^{0}\|R_{p,1}^{0}\|\cdots\|R_{p,k}^{0})$ and $x_{q}=(L_{q}^{0}\|R_{q,1}^{0}\|\cdots\|R_{q,k}^{)})$ where $p$ and $q$ are indexes of two oracle queries with $1\leq p<q\leq m$. Then, we have $L_{p}^{k+1}=L_{p}^{0}\oplus f_{1}(R_{p,1}^{0}\|\cdots\|R_{p,k}^{0})$ and $L_{q}^{k+1}=L_{q}^{0}\oplus f_{1}(R_{q,1}^{0}\|\cdots\|R_{q,k}^{0})$. Therefore, if we choose two oracle queries $x_{p}$ and $x_{q}$ in which $L_{p}^{0}$ and $L_{q}^{0}$ are only different, then we can derive the following relation

[TABLE]

since $f_{1}(R_{p,1}^{0}\|\cdots\|R_{p,k}^{0})=f_{1}(R_{q,1}^{0}\|\cdots\|R_{q,k}^{0})$.

This linear relation can be used to build an oracle machine $M$ that distinguishes between the $kn$:$n$-UFN and an ideal random permutation generator. First, the oracle machine creates two oracle queries $x_{p}$ and $x_{q}$ that differ only in $L^{0}$ values and receives the responses $<x_{p},y_{p}>,<x_{q},y_{q}>$. If the equation $L_{p}^{k+1}\oplus L_{q}^{k+1}=L_{p}^{0}\oplus L_{q}^{0}$ is satisfied from the responses of the queries, then the oracle machine outputs $1$. Otherwise, the oracle machine outputs [math]. Thus, if the $x_{p}$ and $x_{q}$ values ​​are generated by the $kn$:$n$-UFN, then the output of the oracle machine is always $1$. However, if the $x_{p}$ and $x_{q}$ values are generated by the ideal random permutation generator, then the probability that the equation is satisfied is $1/2^{n}$. Therefore we have the following equation

[TABLE]

where $P$ is the $kn$:$n$-UFN and $K$ is the ideal random permutation generator. From this equation, the $k+1$ rounds $kn$:$n$-UFN is not pseudo-random. ∎

We now prove that a $k+2$ rounds $kn$:$n$-UFN permutation generator using pseudo-random functions is pseudo-random. First, we define an event that can be used to distinguish a $k+2$ rounds $kn$:$n$-UFN using ideal random functions from an ideal random permutation generator as the following BAD event.

Definition 3.3.1**.**

(The BAD event $\xi$ of a $k+2$ rounds $kn$:$n$-UFN) A random variable $\xi^{i}$ is defined as an event in which $R_{p,1}^{i}\|\cdots\|R_{p,k}^{i}$ and $R_{q,1}^{i}\|\cdots\|R_{q,k}^{i}$ of two oracle queries with indexes $p$ and $q$ are equal where $1\leq p<q\leq m$. The BAD event $\xi$ is a random variable defined as $\vee_{i=1}^{k+1}\xi^{i}$.

If an oracle machine is able to distinguish between a $k+2$ rounds $kn$:$n$-UFN and an ideal random permutation generator, then the BAD event must occur. This means that if the BAD event does not occur, then the $k+2$ rounds $kn$:$n$-UFN is equal to the ideal random permutation generator. In the following lemma, we prove it.

Lemma 3.3.2**.**

A $k+2$ rounds $kn$:$n$-UFN permutation generator using an ideal random function generator is equal to an ideal random permutation generator if the BAD event does not occur. That is, for all possible $\sigma_{1},\sigma_{2},\ldots,\sigma_{m}\in\{0,1\}^{(k+1)n}$, we have

[TABLE]

where $y_{i}$ is the output of the $k+2$ rounds $kn$:$n$-UFN permutation generator.

Proof.

From the definition of a $k+2$ rounds $kn$:$n$-UFN using ideal random functions, the reply $y_{p}$ of the $p$th oracle machine query $x_{p}$ is described as

[TABLE]

where $h_{1},h_{2},\ldots,h_{k+2}$ are functions generated by an ideal random function generator whose inputs are $kn$ bits and whose outputs are $n$ bits, and the input values ​​of $h_{i}(\cdot)$ are $(R_{p,1}^{i-1}\|\cdots\|R_{p,k}^{i-1})$. By the definition of the BAD event $\xi$, we obtain the following equation

[TABLE]

where $p$ and $q$ are the oracle indexes with $1\leq p<q\leq m$.

Thus the output value of $h$ becomes a value with uniform distribution since the input values ​​of $h_{2},\ldots,h_{k+2}$ are different for all oracle queries and $h$ is a function generated by the ideal random function generator. Therefore, the value of $L^{i-1}\oplus h_{i}(\cdot)$ becomes a value with uniform distribution. ∎

Lemma 3.3.3**.**

The probability of the BAD event in a $k+2$ rounds $kn$:$n$-UFN permutation generator is bounded by

[TABLE]

Proof.

By the definition of the BAD event, we have $\xi=\vee_{i=1}^{k+1}\xi^{i}$. We first calculate the probability of each event $\xi^{i}$. A random variable $\xi^{i}$ represents an event that $R_{p,1}^{i}\|\cdots\|R_{p,k}^{i}$ and $R_{q,1}^{i}\|\cdots\|R_{q,k}^{i}$ are equal for the indexes $p$ and $q$ of the oracle queries with $1\leq p<q\leq m$. By the definition of a $kn$:$n$-UFN structure, we obtain the following equation

[TABLE]

where each $h_{i}(\cdot)$ is a function generated by an ideal random function generator.

Thus, the best choice for the event $\xi^{i}$ to occur is to select an oracle query with $R_{p,j}^{0}=R_{q,j}^{0}$ for $i+1<j<k$. In this case, the probability of the event $\xi^{i}$ is $\Pr(\xi^{i})={}_{m}C_{2}\cdot 1/2^{in}$. Therefore, we have $\Pr(\xi)<(k+1)m^{2}/2^{n+1}$. ∎

In Theorem 3.3.4, we prove that a $k+2$ rounds $kn$:$n$-UFN that uses ideal random functions is pseudo-random from the above two lemmas, and we also prove that a $k+2$ rounds $kn$:$n$-UFN that uses pseudo-random functions is also pseudo-random.

Theorem 3.3.4**.**

A $k+2$ rounds $kn$:$n$-UFN permutation generator using pseudo-random functions is a pseudo-random permutation generator.

Proof.

From Lemma 3.3.2 and Lemma 3.3.3, we can show that a $kn$:$n$-UFN permutation generator $P$ using an ideal random function generator is a pseudo-random permutation generator. First, we have $|\Pr(M^{P}(1^{(k+1)n})=1|\neg\xi)-\Pr(M^{K}(1^{(k+1)n})=1)|=0$ since $P$ is the same as an ideal random permutation generator $K$ when the BAD event $\xi$ does not occur by Lemma 3.3.2. We also have $|\Pr(M^{P}(1^{(k+1)n})=1|\xi)-\Pr(M^{K}(1^{(k+1)n})=1)|\leq 1$ since the absolute value of the probability difference is less than 1. Therefore, we have the following equation

[TABLE]

We now show that a $k+2$ rounds $kn$:$n$-UFN permutation generator $P$ using a pseudo-random function generator is a pseudo-random permutation generator. For this, we use the proof by contradiction. That is, if a $k+2$ rounds $kn$:$n$-UFN using an ideal random function generator is pseudo-random but a $k+2$ rounds $kn$:$n$-UFN using a pseudo-random function generator is not pseudo-random, then we can derive a contradiction to the pseudo-randomness of the pseudo-random function generator.

Suppose that a $kn$:$n$-UFN permutation generator $P$ using a pseudo-random function generator is not pseudo-random. Then there exists an oracle machine $M$ which distinguishes an ideal random permutation generator $K$ and $P$ with a probability greater than $1/n^{c}$ for a constant $c$.

First, we let $D_{f_{k+2}}\circ\cdots\circ D_{f_{i+1}}\circ D_{h_{i}}\circ\cdots\circ D_{h_{1}}(\cdot)$ be a permutation generator in which an ideal random function generator is used from the first round to the $i$th round and a pseudo-random function generator is used from the $i+1$th round to the $k+2$th round in a $kn$:$n$-UFN permutation generator for $i$ with $0\leq i\leq k+2$. Let $p_{i}^{D}$ be the probability that an oracle machine that has access to this permutation generator will output $1$. That is,

[TABLE]

where $f_{i+1},\ldots,f_{k+2}$ are functions generated by a pseudo-random function generator and $h_{1},\ldots,h_{i}$ are functions generated by an ideal random function generator. Let $p^{K}$ be the probability that an oracle machine that has access to the ideal random permutation generator will output $1$. Since we supposed that the $k+2$ rounds $kn$:$n$-UFN using a pseudo-random function generator is not pseudo-random, we get the following equation

[TABLE]

However, since the $k+2$ rounds $kn$:$n$-UFN using an ideal random function generator has been shown to be a pseudo-random permutation generator, we have $|P^{K}-P_{k+2}^{D}|\leq(k+1)m^{2}/2^{n+1}$. Therefore, we have $|p_{i+1}^{D}-p_{i}^{D}|\geq 1/(k+3)n^{c}$ for some $i$. By using this, an oracle machine $C$ that distinguishes an ideal random function generator and a pseudo-random function generator with a probability higher than $1/(k+3)n^{c}$ can be constructed as follows.

In the oracle machine $C$, we first change the part of $C$ that calculates the oracle query reply to $D_{f_{k+2}}\circ\cdots\circ D_{f_{i+1}}\circ D_{X}\circ D_{h_{i-1}}\circ\cdots\circ D_{h_{1}}(\cdot)$. In this case, $X$ is a function whose input is $kn$ bits and whose output is $n$ bits. If $X$ in $C$ is a function generated by a pseudo-random function generator $F$, then we have $p_{i}^{D}=\Pr(C^{F}(1^{kn})=1)$. On the other hand, if $X$ in $C$ is a function generated by an ideal random function generator $H$, then we have $p_{i+1}^{D}=\Pr(C^{H}(1^{kn})=1)$. However, it is possible to distinguish the ideal random function generator and the pseudo-random function generator with a probability greater than $1/(k+3)n^{c}$ since $|p_{i+1}^{D}-p_{i}^{D}|\geq 1/(k+3)n^{c}$. But this contradicts that the pseudo-random function generator is pseudo-random. Therefore, the $k+2$ rounds $kn$:$n$-UFN using a pseudo-random function generator is a pseudo-random permutation generator. ∎

From Theorem 3.3.1 and Theorem 3.3.4, the minimum number of rounds of the $kn$:$n$-UFN permutation generator using a pseudo-random function generator to be pseudo-random is $k+2$.

3.4 The Pseudo-Random Proof of $n$:$kn$-UFN

The following theorem show that a $n$:$kn$-UFN permutation generator is not pseudo-random if the number of rounds is less than or equal to $k+1$.

Theorem 3.4.1**.**

A $k+1$ rounds $n$:$kn$-UFN permutation generator is not pseudo-random.

Proof.

From the definition of a $n$:$kn$-UFN, we obtain the following equation

[TABLE]

If we choose two oracle queries $x_{p}$ and $x_{q}$ in which $L_{p}^{0}$ and $L_{q}^{0}$ are only different, then we have $R_{p}^{i}=R_{q}^{i}$ for all $i$ with $1\leq i\leq k-1$. Therefore, from the oracle responses $<x_{p},y_{p}>,<x_{q},y_{q}>$, we can derive the following relation

[TABLE]

By using this linear relation, we can build an oracle machine $M$ that distinguishes between an $n$:$kn$-UFN permutation generator and an ideal random permutation generator. First, the oracle machine creates two oracle queries $x_{p}$ and $x_{q}$ that differ only in $L_{1}^{0}$ values and receives oracle responses $<x_{p},y_{p}>,<x_{q},y_{q}>$. If the equation $L_{p,1}^{k+1}\oplus L_{q,1}^{k+1}=L_{p,1}^{0}\oplus L_{q,1}^{0}$ is satisfied from the responses of the queries, then the oracle machine outputs $1$. Otherwise, the oracle machine outputs [math]. Thus, if the $x_{p}$ and $x_{q}$ values ​​are generated by the $n$:$kn$-UFN, then the output of the oracle machine is always $1$. However, if the $x_{p}$ and $x_{q}$ values are generated by the ideal random permutation generator, then the probability that the relation is satisfied is $1/2^{n}$. Therefore we have the following equation

[TABLE]

where $P$ is the $n$:$kn$-UFN and $K$ is the ideal random permutation generator. Thus the $k+1$ rounds $n$:$kn$-UFN permutation generator is not pseudo-random. ∎

We now prove that a $k+2$ rounds $n$:$kn$-UFN permutation generator using pseudo-random functions is pseudo-random. First, we define an event that can be used to distinguish a $k+2$ rounds $n$:$kn$-UFN using ideal random functions from an ideal random permutation generator as the following BAD event.

Definition 3.4.1**.**

(The BAD event $\xi$ of a $k+2$ rounds $n$:$kn$-UFN) A random variable $\xi^{i}$ is defined as an event in which $R_{p}^{i}$ and $R_{q}^{i}$ of two oracle queries with indexes $p$ and $q$ are equal where $1\leq p<q\leq m$. The BAD event $\xi$ is a random variable defined as $\vee_{i=k}^{k+1}\xi^{i}$.

Lemma 3.4.2**.**

A $k+2$ rounds $n$:$kn$-UFN permutation generator using an ideal random function generator is equal to an ideal random permutation generator if the BAD event does not occur. That is, for all possible $\sigma_{1},\sigma_{2},\ldots,\sigma_{m}\in\{0,1\}^{(k+1)n}$, we have

[TABLE]

where $y_{i}$ is the output of the $k+2$ rounds $n$:$kn$-UFN permutation generator.

Proof.

From the definition of a $k+2$ rounds $n$:$kn$-UFN, the reply $y_{p}$ of the $p$th oracle machine query $x_{p}$ is described as

[TABLE]

where $h_{k+1},h_{k+2}$ are functions generated by an ideal random function generator whose inputs are $n$ bits and whose outputs are $kn$ bits.

By the definition of the BAD event $\xi$, we obtain the following equation

[TABLE]

where $q$ and $p$ are the oracle indexes with $1\leq p<q\leq m$. Thus the output values of $h_{k+1},h_{k+2}$ become values with uniform distribution since the input values ​​of $h_{k+1},h_{k+2}$ are different for all oracle queries and $h_{k+1},h_{k+2}$ are functions generated by the ideal random function generator. ∎

Lemma 3.4.3**.**

The probability of the BAD event in a $k+2$ rounds $n$:$kn$-UFN permutation generator is bounded by

[TABLE]

Proof.

For the proof, we should show that $\Pr(\xi^{k})\leq m^{2}/2^{n+1}$ and $\Pr(\xi^{k+1})\leq m^{2}/2^{n+1}$ since $Pr(\xi)=\Pr(\xi^{k})+\Pr(\xi^{k+1})$ by the definition of the BAD event $\xi$.

First, we show that $\Pr(\xi^{k})\leq m^{2}/2^{n+1}$. By the definition of $\xi^{k}$, we have $\Pr(\xi^{k})=\Pr(R_{p}^{k}=R_{q}^{k})$ for the oracle query indexes $p$ and $q$ with $1\leq p<q\leq m$. Thus we obtain the following equation

[TABLE]

Similarly, we can obtain the following equation

[TABLE]

Since each oracle query should be different, we have $\Pr(L_{p,1}^{0}\|\cdots\|L_{p,k}^{0}\|R_{p}^{0}=L_{q,1}^{0}\|\cdots\|L_{q,k}^{0}\|R_{q}^{0})=0$ for oracle query indexes $p$ and $q$ with $1\leq p<q\leq m$. Thus, we have

[TABLE]

By using similar approach, we have $\Pr(\xi^{k+1})\leq m^{2}/2^{n+1}$. Therefore, we obtain $\Pr(\xi)=\Pr(\xi^{k})+\Pr(\xi^{k+1})\leq m^{2}/2^{n}$. ∎

In Theorem 3.4.4, we prove that a $k+2$ rounds $n$:$kn$-UFN that uses ideal random functions is pseudo-random from the above two lemmas, and we also prove that a $k+2$ rounds $n$:$kn$-UFN that uses pseudo-random functions is also pseudo-random.

Theorem 3.4.4**.**

A $k+2$ rounds $n$:$kn$-UFN permutation generator using a pseudo-random function generator is a pseudo-random permutation generator.

Proof.

From Lemma 3.4.2 and Lemma 3.4.3, we can show that an $n$:$kn$-UFN permutation generator $P$ that uses an ideal random function generator is a pseudo-random permutation generator. First, we have $|\Pr(M^{P}(1^{(k+1)n})=1|\neg\xi)-\Pr(M^{K}(1^{(k+1)n})=1)|=0$ since $P$ is the same as an ideal random permutation generator $K$ when the BAD event $\xi$ does not occur by Lemma 3.4.2. We also have $|\Pr(M^{P}(1^{(k+1)n})=1|\xi)-\Pr(M^{K}(1^{(k+1)n})=1)|\leq 1$ since the absolute value of the probability difference is less than 1. Therefore, we have the following equation

[TABLE]

We now show that a $k+2$ rounds $n$:$kn$-UFN permutation generator $P$ using a pseudo-random function generator is a pseudo-random permutation generator. For this, we use the proof by contradiction. That is, if a $k+2$ rounds $n$:$kn$-UFN using an ideal random function generator is pseudo-random but a $k+2$ rounds $n$:$kn$-UFN using a pseudo-random function generator is not pseudo-random, then we can derive a contradiction to the pseudo-randomness of the pseudo-random function generator.

Suppose that an $n$:$kn$-UFN permutation generator $P$ using a pseudo-random function generator is not pseudo-random. Then there exists an oracle machine $M$ which distinguishes an ideal random permutation generator $K$ and $P$ with a probability greater than $1/n^{c}$ for a constant $c$.

First, we let $D_{f_{k+2}}\circ\cdots\circ D_{f_{i+1}}\circ D_{h_{i}}\circ\cdots\circ D_{h_{1}}(\cdot)$ be a permutation generator in which an ideal random function generator is used from the first round to the $i$th round and a pseudo-random function generator is used from the $i+1$th round to the $k+2$th round in the $n$:$kn$-UFN permutation generator for $i$ with $0\leq i\leq k+2$. Let $p_{i}^{D}$ be the probability that an oracle machine that has access to this permutation generator will output $1$. That is,

[TABLE]

where $f_{i+1},\ldots,f_{k+2}$ are functions generated by a pseudo-random function generator and $h_{1},\ldots,h_{i}$ are functions generated by an ideal random function generator. Let $p^{K}$ be the probability that an oracle machine that has access to the ideal random permutation generator will output $1$. Since we supposed that the $k+2$ rounds $n$:$kn$-UFN using a pseudo-random function generator is not pseudo-random, we get the following equation

[TABLE]

However, since the $k+2$ rounds $n$:$kn$-UFN using an ideal random function generator has been shown to be a pseudo-random permutation generator, we have $|P^{K}-P_{k+2}^{D}|\leq m^{2}/2^{n}$. Therefore, we have $|p_{i+1}^{D}-p_{i}^{D}|\geq 1/(k+3)n^{c}$ for some $i$. By using this, an oracle machine $C$ that distinguishes an ideal random function generator and a pseudo-random function generator with a probability higher than $1/(k+3)n^{c}$ can be constructed as follows.

In the oracle machine $C$, we first change the part of $C$ that calculates the oracle query reply to $D_{f_{k+2}}\circ\cdots\circ D_{f_{i+1}}\circ D_{X}\circ D_{h_{i-1}}\circ\cdots\circ D_{h_{1}}(\cdot)$. In this case, $X$ is a function whose input is $n$ bits and whose output is $kn$ bits. If $X$ in $C$ is a function generated by a pseudo-random function generator $F$, then we have $p_{i}^{D}=\Pr(C^{F}(1^{kn})=1)$. On the other hand, if $X$ in $C$ is a function generated by an ideal random function generator $H$, then we have $p_{i+1}^{D}=\Pr(C^{H}(1^{kn})=1)$. However, it is possible to distinguish the ideal random function generator and the pseudo-random function generator with a probability greater than $1/(k+3)n^{c}$ since $|p_{i+1}^{D}-p_{i}^{D}|\geq 1/(k+3)n^{c}$. But this contradicts that the pseudo-random function generator is pseudo-random. Therefore, the $k+2$ rounds $n$:$kn$-UFN using the pseudo-random function generator is a pseudo-random permutation generator. ∎

From Theorem 3.4.1 and Theorem 3.4.4, the minimum number of rounds of the $n$:$kn$-UFN permutation generator using a pseudo-random function generator to be pseudo-random is $k+2$.

Chapter 4 Analysis of Modified Unbalanced Feistel Networks

In this section, we propose an unbalanced Feistel network structure that can extend an $n$-bit block cipher to a $(k+1)n$-bit block cipher. Then we analyze the conditions for this modified Feistel structure to be pseudo-random. This chapter is summarized as follows.

An $n$:$kn$-UFN2 structure, which can extend an $n$-bit block cipher to a $(k+1)n$-bit block cipher, is a target-heavy unbalanced Feistel network where both the input and output of round functions are $n$ bits. The main advantage of the $n$:$kn$-UFN2 structure is that it allows to build a new block cipher with large input size by using an existing block cipher with proven security. In order for an $n$:$kn$-UFN2 permutation generator that uses pseudo-random functions to be pseudo-random, the round number $k$ must be odd and the total number of rounds must be at least $2k+1$.

The structure of this chapter is as follows. In Section 4.1, we define an $n$:$kn$-UFN2 structure and examines the properties of this structure. In Section 4.2, we analyze the conditions for the $n$:$kn$-UFN2 structure to be a pseudo-random permutation generator.

4.1 Definition and Property

As the information throughput increases, a block cipher with a large input is needed to process large amounts of data. In general, however, it is not easy to build a block cipher with a large input. It is also difficult to ensure the security of this new block cipher. However, if we can use a block cipher that is as secure as DES, we can trust the security of the new cipher. However, the DES cipher does not expand to a block cipher with a larger input because the input is fixed at 64 bits. Therefore, we propose an $n$:$kn$-UFN2 permutation generator that can extend an $n$-bit block cipher to a $(k+1)n$-bit block cipher. We also analyze the condition for this structure to be a pseudo-random permutation generator.

An $n$:$kn$-UFN2 structure is a target-heavy unbalanced Feistel network in which the input and output of round functions are $n$ bits. It is defined as follows. For instance, a 3 rounds $n$:$2n$-UFN2 structure is described in Figure 4.1.

Definition 4.1.1** ($n$:$kn$-UFN2).**

For any function $f$ belonging to the set of functions $F:I_{n}\rightarrow I_{n}$, one round of $n$:$kn$-UFN2 is defined by the following permutation

[TABLE]

Similarly, for any functions $f_{1},f_{2},\ldots,f_{r}$ belonging to the set of functions $F:I_{n}\rightarrow I_{n}$, an $r$ rounds $n$:$kn$-UFN2 is defined by the following permutation

[TABLE]

In this case, we have $|L_{i}|=|R|=n$.

4.2 The Pseudo-Random Proof of $n$:$kn$-UFN2

In Theorem 4.2.1, we show that an $n$:$kn$-UFN2 permutation generator is not pseudo-random if $k$ is even. In Theorem 4.2.2, we show that an $n$:$kn$-UFN2 permutation generator is not pseudo-random if $k$ is odd and the number of rounds is less than or equal to $2k$.

Theorem 4.2.1**.**

If $k$ is even, then an $n$:$kn$-UFN2 permutation generator is not pseudo-random.

Proof.

If $k$ is even, then we obtain the following equation

[TABLE]

In this equation, $(a)$ is satisfied from the definition of an $n$:$kn$-UFN2, $(b)$ is satisfied from the property of $\oplus$ and the number of $f$ is even, and $(c)$ is satisfied from the recursive application of the above equation.

We can build an oracle machine $M$ that distinguishes between an $n$:$kn$-UFN2 permutation generator and an ideal random permutation generator. First, the oracle machine queries $x=(L_{1}^{0}\|\cdots\|L_{k}^{0}\|R^{0})$ and receives a response $y=(L_{1}^{r}\|\cdots\|L_{k}^{r}\|R^{r})$. If the equation $L_{1}^{0}\oplus\cdots L_{k}^{0}\oplus R^{0}=L_{1}^{r}\oplus\cdots\oplus L_{k}^{r}\oplus R^{r}$ is satisfied, then the oracle machine outputs $1$. Otherwise, it outputs [math]. Thus, if the oracle response is generated by the $n$:$kn$-UFN2, then the output of the oracle machine is always $1$. However, if the oracle response is generated by the ideal random permutation generator, then the probability that the equation is satisfied is $1/2^{n}$. Therefore the $n$:$kn$-UFN2 permutation generator with even $k$ is not pseudo-random since the oracle machine $M$ exists. ∎

Theorem 4.2.2**.**

If $k$ is odd, then a $2k$ rounds $n$:$kn$-UFN2 permutation generator is not pseudo-random.

Proof.

To prove that a $2k$ rounds $n$:$kn$-UFN2 is not pseudo-random, we show that there is a relation between the input and output of oracle queries. Next, we build an oracle machine that can distinguish an $n$:$kn$-UFN2 permutation generator and an ideal permutation generator by using this relation.

From the definition of an $n$:$kn$-UFN2, we obtain the following equation

[TABLE]

In this case, $R^{2k}$ is represented as

[TABLE]

where $W$ is defined as

[TABLE]

Thus, we obtain the following relation between the input and output of an $n$:$kn$-UFN2 as

[TABLE]

If we choose two oracle queries with different $L_{p,1}^{0}$ and $L_{q,1}^{0}$ blocks for the indexes $p$ and $q$ with $1\leq p<q\leq m$, then we obtain the following equations

[TABLE]

By using these two equations, we have the following relation for two oracle queries and their responses as

[TABLE]

An oracle machine $M$ that distinguishes between an $n$:$kn$-UFN2 permutation generator and an ideal random permutation generator can be built as follows. First, the oracle machine queries $x_{p}$ and $x_{q}$ and receives responses $y_{p}$ and $y_{q}$. If the equation $(L_{p,1}^{2k}\oplus\cdots\oplus L_{p,k}^{2k})\oplus(L_{q,1}^{2k}\oplus\cdots\oplus L_{q,k}^{2k})\oplus(L_{p,1}^{0}\oplus L_{q,1}^{0})\oplus(W_{p}\oplus W_{q})=0$ is satisfied, then the oracle machine outputs $1$. Otherwise, it outputs [math]. Thus, if the oracle response is generated by the $n$:$kn$-UFN2, then the output of the oracle machine is always $1$. However, if the oracle response is generated by the ideal random permutation generator, then the probability that the equation is satisfied is $1/2^{n}$. Therefore the $n$:$kn$-UFN2 permutation generator is not pseudo-random since the oracle machine $M$ can distinguish two permutation generators. ∎

We now prove that a $2k+1$ rounds $n$:$kn$-UFN2 permutation generator using pseudo-random functions is pseudo-random. First, we define an event that can be used to distinguish a $2k+1$ rounds $n$:$kn$-UFN2 using ideal random functions from an ideal random permutation generator as the following BAD event.

Definition 4.2.1**.**

(The BAD event $\xi$ of $2k+1$ rounds $n$:$kn$-UFN2) A random variable $\xi^{i}$ is defined as an event in which $R_{p}^{i}$ and $R_{q}^{i}$ of two oracle query indexes $p$ and $q$ are equal where $1\leq p<q\leq m$. The BAD event $\xi$ is a random variable defined as $\vee_{i=k}^{2k}\xi^{i}$.

If an oracle machine is able to distinguish between a $2k+1$ rounds $n$:$kn$-UFN2 and an ideal random permutation generator, then the BAD event must occur. This means that if the BAD event does not occur, then the $2k+1$ rounds $n$:$kn$-UFN2 is equal to an ideal random permutation generator. In the following lemma, we prove it.

Lemma 4.2.3**.**

A $2k+1$ rounds $n$:$kn$-UFN2 permutation generator using an ideal random function generator is equal to an ideal random permutation generator if $k$ is odd and the BAD event does not occur. That is, for all possible $\sigma_{1},\sigma_{2},\ldots,\sigma_{m}\in\{0,1\}^{(k+1)n}$, we have

[TABLE]

where $y_{i}$ is the output of the $2k+1$ rounds $n$:$kn$-UFN2 permutation generator.

Proof.

If the response $y_{p}$ of the oracle query $x_{p}$ is generated by an $n$:$kn$-UFN2 permutation generator, then the oracle response is calculated by the following algorithm. In this case, $x_{p}=(L_{p,1}^{0}\|L_{p,2}^{0}\|\cdots\|L_{p,k}^{0}\|R_{p}^{0})$ and $y_{p}=(L_{p,1}^{2k+1}\|L_{p,2}^{2k+1}\|\cdots\|L_{p,k}^{2k+1}\|R_{p}^{2k+1})$.

[TABLE]

By using this algorithm, the oracle response $y_{p}$ can be represented by $h_{p}^{k},h_{p}^{k+1},\ldots,h_{p}^{2k+1}$ and the intermediate value $(L_{p,1}^{k-1}\|L_{p,2}^{k-1}\|\cdots\|L_{p,k}^{k-1}\|R_{p}^{k-1})$ that is used in the algorithm as follows.

[TABLE]

Let $y^{k-1}=(L_{p,1}^{k-1},\cdots,L_{p,k}^{k-1},R_{p}^{k-1})$, $y^{2k+1}=(L_{p,1}^{2k+1},\cdots,L_{p,k}^{2k+1},R_{p}^{2k+1})$, and $x=(h_{p}^{k},h_{p}^{k+1},\cdots,h_{p}^{2k+1})$ be column vectors. Let $A$ be a $(k+1)\times(k+1)$ matrix in which only the elements $A_{i,k+2-i}$ are [math] and the other elements are $1$. Then the above equation can be represented as a linear relation $y^{k-1}\oplus Ax=y^{2k+1}$. If we let $y=y^{k-1}\oplus y^{2k+1}$, then the linear relation can be represented as $Ax=y$. This is equal to a function $T:I_{(k+1)n}\rightarrow I_{(k+1)n}$ such that $T(x)=Ax$.

Now, we show that the output $y$ of $T(x)=Ax$ has a uniform probability distribution. The value $x$ ​​has a uniform probability distribution since the $n$:$kn$-UFN2 permutation generator uses ideal random functions. That is, the probability that $x_{i}$ is chosen in $I_{(k+1)n}$ is $1/2^{(k+1)n}$. Therefore, if the function $T$ is a one-to-one correspondence function, then the output $y_{i}$ value of the function $T$ also has a probability value $1/2^{(k+1)n}$ equal to $x_{i}$. If the function $T$ is a one-to-one function, then $T$ is a one-to-one correspondence function since the domain and region of $T$ are the same.

If the function $T(x)=y$ is a one-to-one correspondence, then the inverse of $T$ must exist. That is, the inverse matrix $A^{-1}$ of the matrix $A$ must exist since $T(x)=Ax$. If the determinant of $A$ is not zero, then there exists an inverse matrix. So we should show that $det(A)\neq 0$.

In order to show that the determinant of the square matrix $A$ is not zero, we convert $A$ to an echelon form $A^{\prime}$. At this time, only row addition and row interchange are used. If the echelon form $A^{\prime}$ contains a row of zero, then $det(A)=0$, otherwise $det(A)\neq 0$ [10]. Thus, we should show that $A^{\prime}$ does not contain a row of zero.

First, we select an element in $(1,1)$ as the first pivot element and perform row addition. Then we have the following matrix. We also select an element in $(i,k+2-i)$ as $i$th pivot element for $2\leq i\leq k$.

[TABLE]

The above matrix contains pivot elements for all columns except the $k+1$ column. Therefore, the element at position $(k+1,k+1)$ should be selected as the $k+1$th pivot. To do so, all values ​​except the $k+1$th element of the $k+1$th row vector must be set to zero. Let $r_{i}$ be the $i$th row vector of the above matrix. The $k+1$th pivotal element is obtained by performing row addition $r_{2}\oplus r_{3}\oplus\cdots\oplus r_{k}\oplus r_{k+1}$. By the property of the XOR operation, the result of row addition is $(0,0,\ldots,0,0,X)$, where $X=0$ if $k$ is even and $X=1$ if $k$ is odd depending on the property of the XOR. An echelon form $A^{\prime}$ is obtained by performing row exchange so that each pivot is located diagonally in the matrix.

Thus, when $k$ is an odd number, the echelon form matrix $A^{\prime}$ does not include a row of zero. Therefore, if $k$ is odd, the output of $2k+1$ rounds $n$:$kn$-UFN2 has a uniform probability distribution. ∎

Lemma 4.2.4**.**

The probability of the BAD event in a $2k+1$ rounds $n$:$kn$-UFN2 permutation generator is bounded by

[TABLE]

Proof.

For the proof, we should show that $\Pr(\xi^{i})\leq m^{2}/2^{n+1}$ since $\Pr(\xi)=\vee_{i=k}^{2k}\Pr(\xi^{i})$ by the definition of the BAD event $\xi$.

By the definition of $\xi^{i}$, we have $\Pr(\xi^{i})=\Pr(R_{p}^{i}=R_{q}^{i})$ for the oracle query indexes $p$ and $q$ with $1\leq p<q\leq m$. Thus we obtain the following equation

[TABLE]

Similarly, we can obtain the following equation

[TABLE]

Since each oracle query should be different, we have $\Pr(L_{p,1}^{0}\|\cdots\|L_{p,k}^{0}\|R_{p}^{0}=L_{q,1}^{0}\|\cdots\|L_{q,k}^{0}\|R_{q}^{0})=0$ for oracle query indexes $p$ and $q$ with $1\leq p<q\leq m$. Thus, we have

[TABLE]

Therefore, we have $\Pr(\xi)=\sum_{i=k}^{2k}m^{2}/2^{n+1}=(k+1)m^{2}/2^{n+1}$. ∎

In Theorem 4.2.5, we prove that a $2k+1$ rounds $n$:$kn$-UFN2 that uses ideal random functions is pseudo-random from the above two lemmas, and we also prove that a $2k+1$ rounds $n$:$kn$-UFN2 that uses pseudo-random functions is also pseudo-random.

Theorem 4.2.5**.**

A $2k+1$ rounds $n$:$kn$-UFN2 permutation generator using a pseudo-random function generator is a pseudo-random permutation generator.

Proof.

From Lemma 4.2.3 and Lemma 4.2.4, we can show that an $n$:$kn$-UFN2 permutation generator $P$ that uses an ideal random function generator is a pseudo-random permutation generator. First, we have $|\Pr(M^{P}(1^{(k+1)n})=1|\neg\xi)-\Pr(M^{K}(1^{(k+1)n})=1)|=0$ since $P$ is the same as an ideal random permutation generator $K$ when the BAD event $\xi$ does not occur by Lemma 4.2.3. We also have $|\Pr(M^{P}(1^{(k+1)n})=1|\xi)-\Pr(M^{K}(1^{(k+1)n})=1)|\leq 1$ since the absolute value of the probability difference is less than

1. Therefore, we have the following equation

[TABLE]

We now show that a $2k+1$ rounds $n$:$kn$-UFN2 permutation generator $P$ using a pseudo-random function generator is a pseudo-random permutation generator. For this, we use the proof by contradiction. That is, if a $2k+1$ rounds $n$:$kn$-UFN2 using an ideal random function generator is pseudo-random but a $2k+1$ rounds $n$:$kn$-UFN2 using a pseudo-random function generator is not pseudo-random, then we can derive a contradiction to the pseudo-randomness of the pseudo-random function generator.

Suppose that an $n$:$kn$-UFN2 permutation generator $P$ using a pseudo-random function generator is not pseudo-random. Then there exists an oracle machine $M$ which distinguishes an ideal random permutation generator $K$ and $P$ with a probability greater than $1/n^{c}$ for a constant $c$.

First, we let $D_{f_{2k+1}}\circ\cdots\circ D_{f_{i+1}}\circ D_{h_{i}}\circ\cdots\circ D_{h_{1}}(\cdot)$ be a permutation generator in which an ideal random function generator is used from the first round to the $i$th round and a pseudo-random function generator is used from the $i+1$th round to the $2k+1$th round in an $n$:$kn$-UFN2 permutation generator for $i$ with $0\leq i\leq 2k+1$. Let $p_{i}^{D}$ be the probability that an oracle machine that has access to this permutation generator will output $1$. That is,

[TABLE]

where $f_{i+1},\ldots,f_{2k+1}$ are functions generated by a pseudo-random function generator and $h_{1},\ldots,h_{i}$ are functions generated by an ideal random function generator. Let $p^{K}$ be the probability that an oracle machine that has access to the ideal random permutation generator will output $1$. Since we supposed that the $2k+1$ rounds $n$:$kn$-UFN2 using a pseudo-random function generator is not pseudo-random, we get the following equation

[TABLE]

However, since the $2k+1$ rounds $n$:$kn$-UFN2 using an ideal random function generator has been shown to be a pseudo-random permutation generator, we have $|P^{K}-P_{2k+1}^{D}|\leq(k+1)m^{2}/2^{n+1}$. Therefore, we have $|p_{i+1}^{D}-p_{i}^{D}|\geq 1/(2k+2)n^{c}$ for some $i$. By using this, an oracle machine $C$ that distinguishes an ideal random function generator and a pseudo-random function generator with a probability higher than $1/(2k+2)n^{c}$ can be constructed as follows.

In the oracle machine $C$, we first change the part of $C$ that calculates the oracle query reply to $D_{f_{2k+1}}\circ\cdots\circ D_{f_{i+1}}\circ D_{X}\circ D_{h_{i-1}}\circ\cdots\circ D_{h_{1}}(\cdot)$. In this case, $X$ is a function whose input is $n$ bits and whose output is $n$ bits. If $X$ in $C$ is a function generated by a pseudo-random function generator $F$, then we have $p_{i}^{D}=\Pr(C^{F}(1^{kn})=1)$. On the other hand, if $X$ in $C$ is a function generated by an ideal random function generator $H$, then we have $p_{i+1}^{D}=\Pr(C^{H}(1^{kn})=1)$. However, it is possible to distinguish the ideal random function generator and the pseudo-random function generator with a probability greater than $1/(2k+2)n^{c}$ since $|p_{i+1}^{D}-p_{i}^{D}|\geq 1/(2k+2)n^{c}$. But this contradicts that the pseudo-random function generator is pseudo-random. Therefore, the $2k+1$ rounds $n$:$kn$-UFN2 using a pseudo-random function generator is a pseudo-random permutation generator. ∎

Chapter 5 Comparison of Unbalanced Feistel Networks

In this chapter, we compare the amount of memory required for implementation and the time of a pseudo-random permutation generator when implementing the pseudo-random permutation generator using a balanced Feistel network, unbalanced Feistel networks, and the newly proposed Feistel network.

To implement a pseudo-random permutation generator, we must implement a pseudo-random function used in a Feistel network. However, the implementation cost of the pseudo-random function and the speed of the pseudo-random function greatly affect the cost and speed of the Feistel network. Therefore, depending on how to implement the pseudo-random function, the comparison value can vary greatly. Therefore, in this chapter, we will compare the method that can most simply implement the pseudo-random function and the method that uses the GGM pseudo-random function generator. In other words, the cost and the execution speed of each pseudo-random permutation generator are investigated by using these two methods.

5.1 Using Memory and Pseudo-Random Bit Generator

The simplest way to implement a pseudo-random function is to use memory and a pseudo-random bit generator. That is, if the input value $x$ of a function is given, the output value $y$ is calculated by using a pseudo-random bit generator. At this time, the initial value of the pseudo-random bit generator uses an ideal random value such as coin tosses. However, a pseudo-random function must give the same output value for the same input value. Thus, the input value and the output value are stored in memory. That is, given the same input value as before, the output is obtained by referring to the memory instead of using the pseudo-random bit generator.

Before describing this algorithm, we assume that the size of the key that specifies a pseudo-random function used in the $i$th round of a Feistel network is $\ell$ bits. We also assume that the input of a pseudo-random bit generator $G$ is $\ell$ bits and the output is $P_{2}$ bit. That is, $G:I_{\ell}\rightarrow I_{P_{2}}$. An algorithm that implements a pseudo-random function $F_{k_{i}}:I_{P_{1}}\rightarrow I_{P_{2}}$ whose input is $P_{1}$ bits and output is $P_{2}$ bits is as follows.

Since the input of the pseudo-random function is $P_{1}$ bits and the output is $P_{2}$ bits, the amount of memory required to implement a pseudo-random function is $2^{P_{1}}P_{2}$ bits. Therefore, an $r$ rounds Feistel network using pseudo-random functions requires $r\cdot 2^{P_{1}}P_{2}$ bits memory. The time to calculate the output value of a pseudo-random function is proportional to the time to calculate the output of a pseudo-random bit generator. Thus, the execution time of a pseudo-random function whose output is $P_{2}$ bits is proportional to the $P_{2}$ value of the output size. Therefore, the execution time of the $r$ rounds Feistel network is proportional to $r\cdot P_{2}$ value.

In case of implementing a pseudo-random function by using the algorithm 1, the memory size required for each pseudo-random permutation generator and the execution time of each Feistel network are shown in Table 5.1. In the total memory size, the pseudo-random permutation generator using a newly proposed structure ($n$:$kn$-UFN2) requires the least memory and the pseudo-random permutation generator using a source-heavy unbalanced Feistel network ($kn$:$n$-UFN) requires the most memory. In the execution time of the whole Feistel network, the pseudo-random permutation generator using a source-heavy unbalanced Feistel network ($kn$:$n$-UFN) is the fastest and the pseudo-random permutation generator using a target-heavy unbalanced Feistel network ($n$:$kn$-UFN) is the slowest.

5.2 Using the GGM Pseudo-Random Function

Another way to implement a pseudo-random function is to use the pseudo-random function generator of Goldreich, Goldwasser, and Micali. A major advantage of the GGM pseudo-random function generator is that it can implement a pseudo-random function without storing previously generated pseudo-random bits.

Let $\ell$ be the size of the entire key of a pseudo-random permutation generator. Then the $i$th pseudo-random function of the pseudo-random permutation generator from an $r$ rounds Feistel network will use $\ell/r$ bits of the key. We first prepare two pseudo-random bit generators $G:I_{\ell/r}\rightarrow I_{2\ell/r}$ and $G^{\prime}:I_{\ell/r}\rightarrow I_{P_{2}}$. Let $G_{0}$ be the first $\ell/r$ bits of $G$, and $G_{1}$ be the next $\ell/r$ bits of $G$. A pseudo-random function $F:I_{P_{1}}\rightarrow I_{P_{2}}$ whose the key size is $\ell/r$ is defined by the following algorithm.

Since the pseudo-random bits that are previously generated by the algorithm can not be stored, the amount of memory required is fixed. By analyzing the above algorithm, the number of pseudo-random bits that the algorithm must generate to compute one pseudo-random permutation is maximum $(2P_{1}\ell/r+P_{2})r$ bits. Therefore, the memory size and the time of each Feistel network are shown in Table 5.2.

It can be seen that the pseudo-random permutation generator using a target-heavy ($n$:$kn$-UFN) and the proposed structure ($n$:$kn$-UFN2) is the fastest in the execution time of the entire Feistel network. On the other hand, it can be seen that the pseudo-random permutation generator using a source-heavy ($kn$:$n$-UFN) is the slowest.

Chapter 6 Conclusion

In this paper, we analyze the minimum number of rounds for a block cipher from unbalanced Feistel networks to be a pseudo-random permutation generator which is a safe and efficient block cipher. We also propose a new unbalanced Feistel network structure that can be extended and analyze the minimum number of rounds for this structure to be a pseudo-random permutation generator.

The minimum number of rounds for a permutation generator from unbalanced Feistel networks to be a pseudo-random permutation generator is as follows.

• •

In case of a source-heavy unbalanced Feistel network where the source block is $kn$ bits and the target block is $n$ bits: If pseudo-random functions are used in round functions and the total number of rounds is $k+2$ or more, then a source-heavy unbalanced Feistel network is a pseudo-random permutation generator.

• •

In case of a target-heavy unbalanced Feistel network where the source-block is $n$ bits and the target block is $kn$ bits: If pseudo-random functions are used in round functions and the total number of rounds is more than $k+2$, then a target-heavy unbalanced Feistel network is a pseudo-random permutation generator.

A newly proposed architecture is an unbalanced Feistel network architecture that can extend an $n$-bit block cipher to a $(k+1)n$-bit block cipher. The minimum number of rounds of a permutation generator from this structure to be pseudo-random is as follows.

• •

If $k$ is even, then a newly proposed structure is not a pseudo-random permutation generator.

• •

If $k$ is odd, pseudo-random functions are used, and the total number of rounds is $2k+1$ or more, then a newly proposed structure is a pseudo-random permutation generator.

In all three structures, the probability that an arbitrary algorithm can distinguish between an ideal random permutation generator and a pseudo-random permutation generator is less than $m^{2}/2^{n}$ after obtaining $m$ plaintext and ciphertext pairs. Therefore, when a block cipher is implemented using an unbalanced Feistel network structure, it can be a safe and efficient block cipher only if the number of rounds shown in this paper is satisfied.

In this paper, we examined only the condition of the number of rounds for an unbalanced Feistel network using pseudo-random functions to be pseudo-random. If a permutation generator from an unbalanced Feistel network is a super pseudo-random permutation, it becomes a secure block cipher for both chosen plaintext and chosen ciphertext attacks. Therefore, in the future, it is necessary to analyze the condition of the round number for a block cipher from an unbalanced Feistel network to be the super pseudo-random permutation generator.