The Lai–Massey scheme is a cryptographic structure used in the design of block ciphers, an alternative to the Feistel network for converting a non-invertible keyed round function to an invertible keyed cipher. It is used in IDEA and IDEA NXT. The scheme was originally introduced by Xuejia Lai with the assistance of James L. Massey, hence the scheme's name, Lai-Massey.
Design
The Lai-Massey Scheme is similar to a Feistel network in design, but in addition to using a non-invertible round function whose input and output is half the data block size, each round uses a full-width invertible half-round function. Either, or preferably both of the functions may take a key input as well. Initially, the inputs are passed through the half-round function. In each round, the difference between the inputs is passed to the round function along with a sub-key, and the result from the round function is then added to each input. The inputs are then passed through the half-round function. This is then repeated a fixed number of times, and the final output is the encrypted data. Due to its design, it has an advantage over a Substitution-permutation network since the round-function does not need to be inverted - just the half-round - enabling it to be more easily inverted, and enabling the round-function to be arbitrarily complex. The encryption and decryption processes are fairly similar, decryption instead requiring a reversal of the key schedule, an inverted half-round function, and that the round function's output be subtracted instead of added.
Construction details Let F {\displaystyle \mathrm {F} } be the round function, and H {\displaystyle \mathrm {H} } a half-round function, and let K 0 , K 1 , … , K n {\displaystyle K_{0},K_{1},\ldots ,K_{n}} be the sub-keys for the rounds 0 , 1 , … , n {\displaystyle 0,1,\ldots ,n} respectively. Then the basic operation is as follows: Split the plaintext block into two equal pieces, ( L 0 {\displaystyle L_{0}} , R 0 {\displaystyle R_{0}} ). For each round i = 0 , 1 , … , n {\displaystyle i=0,1,\dots ,n} , compute
( L i + 1 ′ , R i + 1 ′ ) = H ( L i ′ + T i , R i ′ + T i ) , {\displaystyle (L_{i+1}',R_{i+1}')=\mathrm {H} (L_{i}'+T_{i},R_{i}'+T_{i}),}
where T i = F ( L i ′ − R i ′ , K i ) {\displaystyle T_{i}=\mathrm {F} (L_{i}'-R_{i}',K_{i})} , and ( L 0 ′ , R 0 ′ ) = H ( L 0 , R 0 ) {\displaystyle (L_{0}',R_{0}')=\mathrm {H} (L_{0},R_{0})} . Then the ciphertext is ( L n + 1 , R n + 1 ) = ( L n + 1 ′ , R n + 1 ′ ) {\displaystyle (L_{n+1},R_{n+1})=(L_{n+1}',R_{n+1}')} . Decryption of a ciphertext ( L n + 1 , R n + 1 ) {\displaystyle (L_{n+1},R_{n+1})} is accomplished by computing for i = n , n − 1 , … , 0 {\displaystyle i=n,n-1,\ldots ,0}
( L i ′ , R i ′ ) = H − 1 ( L i + 1 ′ − T i , R i + 1 ′ − T i ) , {\displaystyle (L_{i}',R_{i}')=\mathrm {H} ^{-1}(L_{i+1}'-T_{i},R_{i+1}'-T_{i}),}
… excerpt ends here. Continue reading the full article.
