Re: [Cfrg] Vulgarized explanations on the Russian S-box

Hi, 

The "TU-decomposition" (i.e. the first decomposition we found) does help with the implementation in hardware. Recently, I showed that the presence of this decomposition is always implied by the use of a TKlog---the structure I recently identified. Still though: 
1. what is the point of using a structure that helps with the implementation if you don't disclose it to implementers? 
2. while this structure does help with the implementation, using e.g. a 3-round Feistel network (a well known and well studied structure) would yield better results, 
3. in discussion with ISO members, the designers claimed that the TU-decomposition was not the one they intended. 

I find the claim in this last point very plausible. In my opinion, the presence of this hardware-friendlier decomposition is indeed an unintended side-effect of the use of a TKlog. However, this also implies that this improved hardware implementation was not the original justification for the use of this S-box. 

Cheers, 

/Léo 

> De: "Dmitry Belyavsky" <beldmit@gmail.com>
> À: "Aaron Zauner" <azet@azet.org>
> Cc: "Leo Perrin" <leo.perrin@inria.fr>, "cfrg" <cfrg@irtf.org>
> Envoyé: Mercredi 3 Avril 2019 12:46:05
> Objet: Re: [Cfrg] Vulgarized explanations on the Russian S-box

> Let's look from another side.
> Does a structure discovered by Leo open any chances to build more effective
> implementations of Streebog/Kuznechik?

> Thank you!

> On Wed, Apr 3, 2019 at 10:52 AM Aaron Zauner < [ mailto:azet@azet.org |
> azet@azet.org ] > wrote:

>> Thanks Leo,
>> Indeed an interesting read & contribution.

>> Aaron

>> On Sun, Mar 24, 2019 at 10:54 AM Leo Perrin < [ mailto:leo.perrin@inria.fr |
>> leo.perrin@inria.fr ] > wrote:

>>> Dear members,

>>> I have written detailed and (I hope) vulgarized explanations of my results on
>>> the Russian S-box which is used in RFC 6986 and RFC 7801. I provide some more
>>> information about the claims of the designers (in particular that they claim to
>>> have lost their generation algorithm...) and then argue that, until the
>>> designers of these algorithms clarify their design process, neither Kuznyechik
>>> nor Streebog should be used.

>>> Here is the link: [ https://who.paris.inria.fr/Leo.Perrin/pi.html |
>>> https://who.paris.inria.fr/Leo.Perrin/pi.html ]

>>> Best regards,

>>> /Léo
>>> _______________________________________________
>>> Cfrg mailing list
>>> [ mailto:Cfrg@irtf.org | Cfrg@irtf.org ]
>>> [ https://www.irtf.org/mailman/listinfo/cfrg |
>>> https://www.irtf.org/mailman/listinfo/cfrg ]

>> _______________________________________________
>> Cfrg mailing list
>> [ mailto:Cfrg@irtf.org | Cfrg@irtf.org ]
>> [ https://www.irtf.org/mailman/listinfo/cfrg |
>> https://www.irtf.org/mailman/listinfo/cfrg ]

> --
> SY, Dmitry Belyavsky