Luby-Racko. Ciphers: Why XOR Is Not So Exclusive
Sarvar Patel6
, Zulfikar Ramzan7
and Ganpathy S. Sundaram6 
| (6) |
Bell Labs, Lucent Technologies, USA |
| (7) |
IP Dynamics, Inc, USA |
Abstract
This work initiates a study of Luby-Racko. ciphers when the bitwise exclusive-or (XOR) operation in the underlying Feistel
network is replaced by a binary operation in an arbitrary finite group. We obtain various interesting results in this context:
- First, we analyze the security of three-round Feistel ladders over arbitrary groups. We examine various Luby-Racko. ciphers
known to be insecure when XOR is used. In some cases, we can break these ciphers over arbitrary Abelian groups and in other
cases, however, the security remains an open problem. - Next, we construct a four round Luby-Racko. cipher, operating over
finite groups of characteristic greater than 2, that is not only completely secure against adaptive chosen plaintext and ciphertext
attacks, but has better time / space complexity and uses fewer random bits than all previously considered Luby-Racko. ciphers
of equivalent security in the literature. Surprisingly, when the group is of characteristic 2 (i.e., the underlying operation
on strings is bitwise exclusive-or), the cipher can be completely broken in a constant number of queries. Notably, for the
former set of results dealing with three rounds (where we report no difference) we need new techniques. However for the latter
set of results dealing with four rounds (where we prove a new theorem) we rely on a generalization of known techniques albeit
requires a new type of hash function family, called a monosymmetric hash function family, which we introduce in this work.
We also discuss the existence (and construction) of this function family over various groups, and argue the necessity of this
family in our construction. Moreover, these functions can be very easily and efficiently implemented on most current microprocessors
thereby rendering the four round construction very practical.
Work done while this author was at Lucent Technologies and the Massachusetts Institute of Technology. This author would like
to acknowledge DARPA grant DABT63- 96-C-0018 and an NSF graduate fellowship.
References secured to subscribers.