Subject: Re: [Cfrg] Vulgarized explanations on the Russian S-box

From: Aaron Zauner <[email-masked]>
Date: Wed, 3 Apr 2019 09:51:26 +0200

Thanks Leo,

Indeed an interesting read & contribution.

Aaron

On Sun, Mar 24, 2019 at 10:54 AM Leo Perrin <[email-masked]> wrote:

> Dear members,
>
> I have written detailed and (I hope) vulgarized explanations of my results
> on the Russian S-box which is used in RFC 6986 and RFC 7801. I provide some
> more information about the claims of the designers (in particular that they
> claim to have lost their generation algorithm...) and then argue that,
> until the designers of these algorithms clarify their design process,
> neither Kuznyechik nor Streebog should be used.
>
> Here is the link: https://who.paris.inria.fr/Leo.Perrin/pi.html
>
> Best regards,
>
> /Léo
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Dmitry Belyavsky <[email-masked]>
Date: Wed, 3 Apr 2019 13:46:05 +0300

Let's look from another side.

Does a structure discovered by Leo open any chances to build more effective
implementations of Streebog/Kuznechik?

Thank you!

On Wed, Apr 3, 2019 at 10:52 AM Aaron Zauner <[email-masked]> wrote:

>> I have written detailed and (I hope) vulgarized explanations of my
>> results on the Russian S-box which is used in RFC 6986 and RFC 7801. I
>> provide some more information about the claims of the designers (in
>> particular that they claim to have lost their generation algorithm...) and
>> then argue that, until the designers of these algorithms clarify their
>> design process, neither Kuznyechik nor Streebog should be used.
>>

-- 
SY, Dmitry Belyavsky

---

From: Leo Perrin <[email-masked]>
Date: Thu, 4 Apr 2019 09:39:14 +0200 (CEST)

Hi, 

The "TU-decomposition" (i.e. the first decomposition we found) does help with the implementation in hardware. Recently, I showed that the presence of this decomposition is always implied by the use of a TKlog---the structure I recently identified. Still though: 
1. what is the point of using a structure that helps with the implementation if you don't disclose it to implementers? 
2. while this structure does help with the implementation, using e.g. a 3-round Feistel network (a well known and well studied structure) would yield better results, 
3. in discussion with ISO members, the designers claimed that the TU-decomposition was not the one they intended. 

I find the claim in this last point very plausible. In my opinion, the presence of this hardware-friendlier decomposition is indeed an unintended side-effect of the use of a TKlog. However, this also implies that this improved hardware implementation was not the original justification for the use of this S-box. 

Cheers, 

/Léo 

> De: "Dmitry Belyavsky" <[email-masked]>
> À: "Aaron Zauner" <[email-masked]>
> Cc: "Leo Perrin" <[email-masked]>, "cfrg" <[email-masked]>
> Envoyé: Mercredi 3 Avril 2019 12:46:05
> Objet: Re: [Cfrg] Vulgarized explanations on the Russian S-box

> On Wed, Apr 3, 2019 at 10:52 AM Aaron Zauner < [ mailto:[email-masked] |
> [email-masked] ] > wrote:

>> On Sun, Mar 24, 2019 at 10:54 AM Leo Perrin < [ mailto:[email-masked] |
>> [email-masked] ] > wrote:

>>> I have written detailed and (I hope) vulgarized explanations of my results on
>>> the Russian S-box which is used in RFC 6986 and RFC 7801. I provide some more
>>> information about the claims of the designers (in particular that they claim to
>>> have lost their generation algorithm...) and then argue that, until the
>>> designers of these algorithms clarify their design process, neither Kuznyechik
>>> nor Streebog should be used.

>>> Here is the link: [ https://who.paris.inria.fr/Leo.Perrin/pi.html |
>>> https://who.paris.inria.fr/Leo.Perrin/pi.html ]

>>> [ mailto:[email-masked] | [email-masked] ]
>>> [ https://www.irtf.org/mailman/listinfo/cfrg |
>>> https://www.irtf.org/mailman/listinfo/cfrg ]

>> [ mailto:[email-masked] | [email-masked] ]
>> [ https://www.irtf.org/mailman/listinfo/cfrg |
>> https://www.irtf.org/mailman/listinfo/cfrg ]