Jump to content

T-function: Difference between revisions

From Wikipedia, the free encyclopedia
Content deleted Content added
Fix problems with cite conference / cite journal templates (e.g. adding data for missing fields)
Add: s2cid, isbn, doi, volume, series, chapter, title, authors 1-4. Upgrade ISBN10 to 13. | Use this tool. Report bugs. | #UCB_Gadget
Line 11: Line 11:
== References ==
== References ==


* {{cite journal
* {{cite book
|author1=A. Klimov |author2=A. Shamir | title = A New Class of Invertible Mappings
|author1=A. Klimov |author2=A. Shamir
| journal = Cryptographic Hardware and Embedded Systems - CHES 2002
|title=Cryptographic Hardware and Embedded Systems - CHES 2002
|chapter=A New Class of Invertible Mappings
| pages = 470–483
|series=Lecture Notes in Computer Science
| volume = LNCS 2523
| pages = 470–483
| publisher = [[Springer-Verlag]]
| publisher = [[Springer-Verlag]]
| year = 2002
| year = 2002
|volume=2523
| url = http://citeseer.ist.psu.edu/klimov02new.html
|doi=10.1007/3-540-36400-5_34
| format = [[PDF]]/[[PostScript]] }}
|isbn=978-3-540-00409-7
* {{cite conference
|s2cid=29129205
|author1=A. Klimov |author2=A. Shamir | title = Cryptographic Applications of T-functions
| url = https://link.springer.com/content/pdf/10.1007/3-540-36400-5_34.pdf
| conference = [[Selected Areas in Cryptography]], SAC 2003, LNCS 3006
}}
| pages = 248–261
* {{cite book
|author1=A. Klimov |author2=A. Shamir
|title=Selected Areas in Cryptography
|chapter=Cryptographic Applications of T-Functions
|series=Lecture Notes in Computer Science
| pages = 248–261
| publisher = Springer-Verlag
| publisher = Springer-Verlag
| date = 2003
| date = 2003
|volume=3006
| url = http://citeseer.ist.psu.edu/klimov03cryptographic.html
|doi=10.1007/978-3-540-24654-1_18
| format = PDF/PostScript }}
|isbn=978-3-540-21370-3
* {{cite conference
|s2cid=30281166
|author1=A. Klimov |author2=A. Shamir | title = New Cryptographic Primitives Based on Multiword T-functions
| url = 10.1007/978-3-540-24654-1_18
| conference = [[Fast Software Encryption]], FSE 2004, LNCS 3017
}}
| pages = 1–15
* {{cite book
|author1=A. Klimov |author2=A. Shamir
|title=Fast Software Encryption
|chapter=New Cryptographic Primitives Based on Multiword T-Functions
|series=Lecture Notes in Computer Science
| pages = 1–15
| publisher = Springer-Verlag
| publisher = Springer-Verlag
| date = 2004 }}
| date = 2004
|volume=3017
* {{cite journal
| doi=10.1007/978-3-540-25937-4_1
| author = Magnus Daum
|isbn=978-3-540-22171-5
| title = Narrow T-functions
}}
| journal = Fast Software Encryption
* {{cite book
| publisher = Springer-Verlag
| publisher = Springer-Verlag
| pages = 50–67
| pages = 50–67
| volume = LNCS 3557
| year = 2005
| year = 2005
| doi = 10.1007/11502760_4
| url = http://citeseer.ist.psu.edu/daum05narrow.html
| url = 10.1007/11502760_4
| format = PDF/PostScript }}
| chapter = Narrow T-Functions
* {{cite conference
| title = Fast Software Encryption
|author1=J. Hong |author2=D. Lee |author3=Y. Yeom |author4=D. Han |name-list-style=amp | title = A New Class of Single Cycle T-functions
| series = Lecture Notes in Computer Science
| conference = Fast Software Encryption, FSE 2005, LNCS 3557
| last1 = Daum
| first1 = Magnus
| volume = 3557
| isbn = 978-3-540-26541-2
}}
* {{cite book
| pages = 68–82
| pages = 68–82
| publisher = Springer-Verlag
| publisher = Springer-Verlag
| date = 2005 }}
| date = 2005
| doi=10.1007/11502760_5
* {{cite conference
| chapter = A New Class of Single Cycle T-Functions
|author1 = A. Klimov
| title = Fast Software Encryption
|author2 = A. Shamir
| series = Lecture Notes in Computer Science
|name-list-style = amp
| last1 = Hong
|title = New Applications of T-functions in Block Ciphers and Hash Functions
| first1 = Jin
|conference = Fast Software Encryption, FSE 2005, LNCS 3557
| last2 = Lee
| first2 = Dong Hoon
| last3 = Yeom
| first3 = Yongjin
| last4 = Han
| first4 = Daewan
| volume = 3557
| isbn = 978-3-540-26541-2
}}
* {{cite book
|pages = 18–31
|pages = 18–31
|publisher = Springer-Verlag
|publisher = Springer-Verlag
Line 64: Line 93:
|archiveurl = https://web.archive.org/web/20070926234950/http://www.wisdom.weizmann.ac.il/~ask/t3.ps.gz
|archiveurl = https://web.archive.org/web/20070926234950/http://www.wisdom.weizmann.ac.il/~ask/t3.ps.gz
|archivedate = 2007-09-26
|archivedate = 2007-09-26
|doi=10.1007/11502760_2
}}
|chapter = New Applications of T-Functions in Block Ciphers and Hash Functions
|title = Fast Software Encryption
|series = Lecture Notes in Computer Science
|last1 = Klimov
|first1 = Alexander
|last2 = Shamir
|first2 = Adi
|volume = 3557
|isbn = 978-3-540-26541-2
}}


{{Cryptography navbox | block | hash | stream}}
{{Cryptography navbox | block | hash | stream}}

Revision as of 13:42, 23 September 2023

VEST-4 T-function followed by a transposition layer

In cryptography, a T-function is a bijective mapping that updates every bit of the state in a way that can be described as , or in simple words an update function in which each bit of the state is updated by a linear combination of the same bit and a function of a subset of its less significant bits. If every single less significant bit is included in the update of every bit in the state, such a T-function is called triangular. Thanks to their bijectivity (no collisions, therefore no entropy loss) regardless of the used Boolean functions and regardless of the selection of inputs (as long as they all come from one side of the output bit), T-functions are now widely used in cryptography to construct block ciphers, stream ciphers, PRNGs and hash functions. T-functions were first proposed in 2002 by A. Klimov and A. Shamir in their paper "A New Class of Invertible Mappings". Ciphers such as TSC-1, TSC-3, TSC-4, ABC, Mir-1 and VEST are built with different types of T-functions.

Because arithmetic operations such as addition, subtraction and multiplication are also T-functions (triangular T-functions), software-efficient word-based T-functions can be constructed by combining bitwise logic with arithmetic operations. Another important property of T-functions based on arithmetic operations is predictability of their period, which is highly attractive to cryptographers. Although triangular T-functions are naturally vulnerable to guess-and-determine attacks, well chosen bitwise transpositions between rounds can neutralize that imbalance. In software-efficient ciphers, it can be done by interleaving arithmetic operations with byte-swapping operations and to a small degree with bitwise rotation operations. However, triangular T-functions remain highly inefficient in hardware.

T-functions do not have any restrictions on the types and the widths of the update functions used for each bit. Subsequent transposition of the output bits and iteration of the T-function also do not affect bijectivity. This freedom allows the designer to choose the update functions or S-boxes that satisfy all other cryptographic criteria and even choose arbitrary or key-dependent update functions (see family keying).

Hardware-efficient lightweight T-functions with identical widths of all the update functions for each bit of the state can thus be easily constructed. The core accumulators of VEST ciphers are a good example of such reasonably light-weight T-functions that are balanced out after 2 rounds by the transposition layer making all the 2-round feedback functions of roughly the same width and losing the "T-function" bias of depending only on the less significant bits of the state.

References

  • A. Klimov; A. Shamir (2002). "A New Class of Invertible Mappings". Cryptographic Hardware and Embedded Systems - CHES 2002 (PDF). Lecture Notes in Computer Science. Vol. 2523. Springer-Verlag. pp. 470–483. doi:10.1007/3-540-36400-5_34. ISBN 978-3-540-00409-7. S2CID 29129205.
  • A. Klimov; A. Shamir (2003). "Cryptographic Applications of T-Functions". [10.1007/978-3-540-24654-1_18 Selected Areas in Cryptography]. Lecture Notes in Computer Science. Vol. 3006. Springer-Verlag. pp. 248–261. doi:10.1007/978-3-540-24654-1_18. ISBN 978-3-540-21370-3. S2CID 30281166. {{cite book}}: Check |url= value (help)
  • A. Klimov; A. Shamir (2004). "New Cryptographic Primitives Based on Multiword T-Functions". Fast Software Encryption. Lecture Notes in Computer Science. Vol. 3017. Springer-Verlag. pp. 1–15. doi:10.1007/978-3-540-25937-4_1. ISBN 978-3-540-22171-5.
  • Daum, Magnus (2005). "Narrow T-Functions". [10.1007/11502760_4 Fast Software Encryption]. Lecture Notes in Computer Science. Vol. 3557. Springer-Verlag. pp. 50–67. doi:10.1007/11502760_4. ISBN 978-3-540-26541-2. {{cite book}}: Check |url= value (help)
  • Hong, Jin; Lee, Dong Hoon; Yeom, Yongjin; Han, Daewan (2005). "A New Class of Single Cycle T-Functions". Fast Software Encryption. Lecture Notes in Computer Science. Vol. 3557. Springer-Verlag. pp. 68–82. doi:10.1007/11502760_5. ISBN 978-3-540-26541-2.
  • Klimov, Alexander; Shamir, Adi (2005). "New Applications of T-Functions in Block Ciphers and Hash Functions". Fast Software Encryption. Lecture Notes in Computer Science. Vol. 3557. Springer-Verlag. pp. 18–31. doi:10.1007/11502760_2. ISBN 978-3-540-26541-2. Archived from the original (gzipped PostScript) on 2007-09-26.