Block Ciphers - Modern Cryptanalysis: Techniques for Advanced Code Breaking - page 84

Listing 4-5 Python code for EASY1 decryption.
##########################################
# Opposite of the round function
##########################################
def unround(c, k):
x = demux(c)
u = mix(x, k)
v = demux(apbox(mux(u)))
w = []
for s in v:
w.append(asbox(s))
return mux(w)
##########################################
# Decryption function
##########################################
def decrypt(c, k):
x = c
for i in range(rounds):
x = deround(x, key)
return x
SPNs can be used alone (as a complete cipher, such as AES), or, for example, as part of a Feistel structure
(see the next section).
4.5 Feistel Structures
One disadvantage to many types of ciphers, including substitution-permutation networks, is that two separate
operations are required: encryption and decryption. Most algorithms require separate software routines or hard-
ware to implement the two operations. When writing a cryptographic suite for an ASIC (a fixed, silicon chip),
there is often a premium on space available: Implementing two separate functions, one for encryption and one
for decryption, will naturally take up about twice as much space.
Luckily,there isatechnique that allows bothencryption anddecryption tobeperformed withnearly identical
pieces of code, which has obvious cost-saving benefits.
This now-common structure for modern ciphers was invented by Horst Feistel and is naturally called the
Feistel structure. The basic technique is simple: Instead of developing two different algorithms (one for en-
cryption, one for decryption), we develop one simple round function that churns half a block of data at a time.
The round function is often denoted f and usually takes two inputs: a half-sized block and a roundkey. We then
cleverly arrange the inputs and outputs to create encryption and decryption mechanisms for the whole block in
the following manners.
For a particular structure, slight variations of the same Feistel structure are common between encryption and
decryption rounds — different at least in key choice (this is called the key schedule), and sometimes in other
parameters, or even the the workings of the structure itself.
Feistel ciphers typically work by taking half of the input at any round and XORing it with the output of the
Feistel structure. This is then, in the next round, XORed with the other half, and the two halves are swapped,