Add the ability to increase the number of Feistel Rounds by bgrieder · Pull Request #35 · str4d/fpe

bgrieder · 2023-01-28T09:34:13Z

This is a simple PR to allow increasing the number of Feistel rounds.
It does not change the default FF1 API (that uses 10 rounds) but offers 2 additional FF1 structures

FF1fr that takes as a const generic the number of desired Fesitel rounds
FF1h that set the number of rounds to 18

The value 18, comes from this cryptanalysis paper: https://eprint.iacr.org/2020/1311.pdf, page 18, last paragraph before the acknowledgments

str4d · 2023-03-02T18:22:05Z

src/ff1.rs

+/// with an adjustable number of Feistel rounds
+pub struct FF1fr<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher> {


Per #25 (comment) I do not want to expose the ability to configure an arbitrary number of rounds, as this includes round numbers that are insecure. If/when Rust gains full const generics, I would consider reopening this, because then we could enforce e.g. FEISTEL_ROUNDS >= 10. But for now, this should not be part of the public API:

Suggested change

/// with an adjustable number of Feistel rounds

pub struct FF1fr<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher> {

/// with an adjustable number of Feistel rounds.

struct FF1Core<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher> {

Why not do this?

/// Non-standard (in general) FPE algorithm based on FF1 but with an adjustable number /// of Feistel rounds. /// /// The number of Feistel rounds will be `10 + EXTRA_ROUNDS_ABOVE_10`. Apart from that /// modification, this follows the FF1 algorithm as specified in [NIST SP 800-38G revision 1], /// with a minimum domain size of $\mathsf{radix}^\mathsf{minlen} \geq 1,000,000$. /// /// [NIST Special Publication 800-38G]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38Gr1-draft.pdf pub struct FF1WithExtraRounds<const EXTRA_ROUNDS_ABOVE_10: u8, CIPH: BlockCipher> { ... } /// A struct for performing FF1 encryption and decryption operations. /// /// This implements FF1 as specified in [NIST SP 800-38G revision 1], with 10 Feistel /// rounds and a minimum domain size of $\mathsf{radix}^\mathsf{minlen} \geq 1,000,000$. /// /// [NIST Special Publication 800-38G]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38Gr1-draft.pdf pub type FF1<CIPH> = FF1WithExtraRounds<0, CIPH>; /// Non-standard FPE algorithm that modifies FF1 to use 18 Feistel rounds. /// /// Other than the modification to the number of Feistel rounds, this follows the FF1 /// algorithm as specified in [NIST SP 800-38G revision 1], with a minimum domain size of /// $\mathsf{radix}^\mathsf{minlen} \geq 1,000,000$. /// /// [NIST Special Publication 800-38G]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38Gr1-draft.pdf pub type FF1R18<CIPH> = FF1WithExtraRounds<8, CIPH>;

(poor man's range typing!)

That's no way to raise the floor of this bound later if NIST devices to replace FF1 with a higher-round version. So for now I'd prefer to only expose explicit round versions.

str4d · 2023-03-02T18:22:10Z

src/ff1.rs

+/// using 18 Feistel rounds
+pub type FF1h<CIPH> = FF1fr<18, CIPH>;
+
 /// A struct for performing FF1 encryption and decryption operations.


Suggested change

/// A struct for performing FF1 encryption and decryption operations.

/// A struct for performing FF1 encryption and decryption operations

str4d · 2023-03-02T18:29:39Z

src/ff1.rs

+/// A struct for performing FF1 encryption and decryption operations
+/// using the default 10 Feistel rounds


Suggested change

/// A struct for performing FF1 encryption and decryption operations

/// using the default 10 Feistel rounds

/// A struct for performing FF1 encryption and decryption operations.

///

/// This implements FF1 as specified in [NIST SP 800-38G revision 1], with 10 Feistel

/// rounds and a minimum domain size of $\mathsf{radix}^\mathsf{minlen} \geq 1,000,000$.

///

/// [NIST Special Publication 800-38G]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38Gr1-draft.pdf

str4d · 2023-03-02T18:31:47Z

src/ff1.rs


+/// A struct for performing FF1 encryption and decryption operations
+/// using the default 10 Feistel rounds
+pub type FF1<CIPH> = FF1fr<10, CIPH>;


Suggested change

pub type FF1<CIPH> = FF1fr<10, CIPH>;

pub type FF1<CIPH> = FF1Core<10, CIPH>;

str4d · 2023-03-02T18:31:58Z

src/ff1.rs

 }

-impl<CIPH: BlockCipher + KeyInit> FF1<CIPH> {
+impl<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher + KeyInit> FF1fr<FEISTEL_ROUNDS, CIPH> {


Suggested change

impl<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher + KeyInit> FF1fr<FEISTEL_ROUNDS, CIPH> {

impl<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher + KeyInit> FF1Core<FEISTEL_ROUNDS, CIPH> {

str4d · 2023-03-02T18:32:07Z

src/ff1.rs

        let ciph = CIPH::new(GenericArray::from_slice(key));
        let radix = Radix::from_u32(radix)?;
-        Ok(FF1 { ciph, radix })
+        Ok(FF1fr { ciph, radix })


Suggested change

Ok(FF1fr { ciph, radix })

Ok(Self { ciph, radix })

str4d · 2023-03-02T18:32:17Z

src/ff1.rs


-impl<CIPH: BlockCipher + BlockEncrypt + Clone> FF1<CIPH> {
+impl<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher + BlockEncrypt + Clone>
+    FF1fr<FEISTEL_ROUNDS, CIPH>


Suggested change

FF1fr<FEISTEL_ROUNDS, CIPH>

FF1Core<FEISTEL_ROUNDS, CIPH>

str4d · 2023-03-02T18:42:14Z

src/ff1.rs

+/// A struct for performing hardened FF1 encryption and decryption operations
+/// using 18 Feistel rounds
+pub type FF1h<CIPH> = FF1fr<18, CIPH>;


This is technically no longer FF1, because the number of rounds is part of the FF1 specification. So I do not want to describe it as "hardened FF1", not least because any future research breakthroughs could lead to further weakening such that 18 rounds also becomes insufficient.

NIST faced a similar issue with FF3, the original version of which was broken in a way that couldn't be fixed by changing bounds. They named the updated version FF3-1, suggesting this is likely how they would also name subsequent updates. If an FF1-1 were published, I'd name it FF1_1 (underscores are allowed in struct names under Rust naming conventions when separating integers). In the interest of not colliding with this, I propose that we name this increased-round modification :

Suggested change

/// A struct for performing hardened FF1 encryption and decryption operations

/// using 18 Feistel rounds

pub type FF1h<CIPH> = FF1fr<18, CIPH>;

/// Non-standard FPE algorithm that modifies FF1 to use 18 Feistel rounds.

///

/// Other than the modification to the number of Feistel rounds, this follows the FF1

/// algorithm as specified in [NIST SP 800-38G revision 1], with a minimum domain size of

/// $\mathsf{radix}^\mathsf{minlen} \geq 1,000,000$.

///

/// [NIST Special Publication 800-38G]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38Gr1-draft.pdf

pub type FF1R18<CIPH> = FF1Core<18, CIPH>;

str4d · 2023-03-02T18:42:33Z

src/ff1/ff1_18.rs

@@ -0,0 +1,19 @@
+use aes::Aes256;
+
+use crate::ff1::{BinaryNumeralString, FF1h};


Suggested change

use crate::ff1::{BinaryNumeralString, FF1h};

use crate::ff1::{BinaryNumeralString, FF1R18};

str4d · 2023-03-02T18:42:40Z

src/ff1/ff1_18.rs

+    let radix = 2;
+    let pt = [0xab, 0xcd, 0xef];
+
+    let ff = FF1h::<Aes256>::new(&key, radix).unwrap();


Suggested change

let ff = FF1h::<Aes256>::new(&key, radix).unwrap();

let ff = FF1R18::<Aes256>::new(&key, radix).unwrap();

feat: improvement fixes

fix: cargo toml

added the ability to increase the number of Feistel Rounds

628cec3

str4d requested changes Mar 2, 2023

View reviewed changes

HatemMn added 5 commits April 8, 2026 17:19

feat: improvement fixes

569f403

feat: the rest of updates

6ebc151

Merge pull request #1 from Cosmian/feat/review_before_merge

3596de5

feat: improvement fixes

fix: cargo toml

66f50b3

Merge pull request #3 from Cosmian/fix/edits

df0a1e1

fix: cargo toml

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add the ability to increase the number of Feistel Rounds#35

Add the ability to increase the number of Feistel Rounds#35
bgrieder wants to merge 6 commits intostr4d:mainfrom
Cosmian:main

bgrieder commented Jan 28, 2023 •

edited

Loading

Uh oh!

str4d Mar 2, 2023 •

edited

Loading

Uh oh!

daira Apr 3, 2023 •

edited

Loading

Uh oh!

str4d Apr 3, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

str4d Mar 2, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		/// with an adjustable number of Feistel rounds
		pub struct FF1fr<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher> {

	/// A struct for performing FF1 encryption and decryption operations.
	/// A struct for performing FF1 encryption and decryption operations

		/// A struct for performing FF1 encryption and decryption operations
		/// using the default 10 Feistel rounds

	pub type FF1<CIPH> = FF1fr<10, CIPH>;
	pub type FF1<CIPH> = FF1Core<10, CIPH>;

	impl<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher + KeyInit> FF1fr<FEISTEL_ROUNDS, CIPH> {
	impl<const FEISTEL_ROUNDS: u8, CIPH: BlockCipher + KeyInit> FF1Core<FEISTEL_ROUNDS, CIPH> {

-/// A struct for performing hardened FF1 encryption and decryption operations
-/// using 18 Feistel rounds
-pub type FF1h<CIPH> = FF1fr<18, CIPH>;
+/// Non-standard FPE algorithm that modifies FF1 to use 18 Feistel rounds.
+///
+/// Other than the modification to the number of Feistel rounds, this follows the FF1
+/// algorithm as specified in [NIST SP 800-38G revision 1], with a minimum domain size of
+/// $\mathsf{radix}^\mathsf{minlen} \geq 1,000,000$.
+///
+/// [NIST Special Publication 800-38G]: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38Gr1-draft.pdf
+pub type FF1R18<CIPH> = FF1Core<18, CIPH>;

		@@ -0,0 +1,19 @@
		use aes::Aes256;

		use crate::ff1::{BinaryNumeralString, FF1h};

	let ff = FF1h::<Aes256>::new(&key, radix).unwrap();
	let ff = FF1R18::<Aes256>::new(&key, radix).unwrap();

Conversation

bgrieder commented Jan 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

str4d Mar 2, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

daira Apr 3, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

bgrieder commented Jan 28, 2023 •

edited

Loading

str4d Mar 2, 2023 •

edited

Loading

daira Apr 3, 2023 •

edited

Loading