Low complexity implementation of a small blocksize cipher (< 64 bit)

Question

Searching for "small blocksize cipher" finds a number of discussions on the topic, mostly refering to FPE.

This one in particular suggests using AES as the round function of a Feistel network.

The problem is on some embedded devices, the use of AES is too complex, so a tradeoff between cipher strength and complexity is required.

In searching for a Feistel based cipher with low complexity, the TEA cipher seems a good choice, but uses 64 bit blocksize.

For a sub 64 bit block of data, say 44 bit, tweaking TEA by masking the output of each Feistel round with a 22 bit mask (0x3FFFFF) seems to work correctly.

The question is, does masking in this way break the TEA algorithm? (other than weakening due to a smaller blocksize)

Answer 1

This will probably be OK. It does have some non-trivial side effects/caveats:

• The effective key length is reduced to 86 bits. Only the low 22 bits of each of the 4 key words will matter, so only 88 bits of the key material are relevant. Then, there are known equivalent-key properties of TEA that further reduce the effective key length to 86 bits.

• A 44-bit block width is uncomfortably narrow. Most modes of operation will have security weaknesses if you encipher more than about $2^{22}$ blocks of data. Even if you encrypt a fraction of that much data, there's still a chance of problems: if you encipher $b$ blocks of data, there's about a $b^2/2^{45}$ chance of some sort of problem.

• Due to the equivalent keys, TEA is not suitable for building hash functions.

Have you considered using something other than a block cipher? Maybe a stream cipher? What are your needs?