6

I have been thinking recently about inherently sequential functions. In trying to wrap my head around them, I tried to come to the simplest possible function that looks inherently sequential to me. For didactical purposes, I'd like some feedback.

Consider two sequences of 64-bit integers: $a_1, \ldots, a_N$ and $b_1, \ldots, b_N$. Now, consider the sequence of 64-bit integers $x_0, \ldots, x_N$ defined by \begin{align} x_0 &= 0 \\ x_{n + 1} &= (x_n \oplus a_{n + 1}) + b_{n + 1} \end{align} where I use $\oplus$ to denote bitwise-XOR and $+$ to denote the sum modulo 64 bits. Intuitively, $x_N$ is obtained by a long sequence of alternating XORs and sums. I am wondering: is the computation of $x_N$ inherently sequential?

I cannot seem to easily see how one could achieve $x_N$ faster than just going through each operation. But, I realise that I might be missing something.

Here I am interested about both theory and practice: I'm curious to know if this function can be proved to be inherently sequential, but also if this function could be safely assumed to be inherently sequential, just like, e.g., cryptographic hash functions are safely assumed to approximate well a random oracle.

More specifically

I'll try to be more specific. What I am wondering is whether or not all bits in $x_N$ can be computed by a polynomially-sized boolean circuit whose critical depth is smaller than that of the trivial circuit, sequentially applying XORs and sums.

Matteo Monti
  • 1,477
  • 2
  • 14
  • 19

1 Answers1

4

This is actually touching to the notion of "rotational cryptanalysis", except you're missing the rotation part.

We usually use (modular) "Addition" or "Add" instead of "Sum", Add-Rotate-Xor are the core functions used by the so-called "ARX"-based algorithms which nowadays constitute an important part of the "fastest" stream ciphers (See Salsa/Chacha20, or the more controversial Speck, etc.) and hash functions (Blake, etc) out there.

The main idea behind ARX ciphers is that (modular) addition is not associative with the rotate, nor the XOR operation, and thus are difficult to simplify. (Exactly what you're interested in here.)

However skipping the rotation part as you did in a ARX design is an issue because it has been shown that systems made only of additions and XOR are broken since they can be reworked from rightmost to leftmost bit. To see the gory details I'll refer you to this Paul & Prenel paper that explain why this is broken: https://eprint.iacr.org/2004/294.pdf As you'll see in the linked paper, A(R)X construct are a pain to study because they do not have nice algebraic structure like AES, RSA or ECC, which sadly means that they are usually less anayzed. This is why some cryptographers believe it would be best to avoid ARX designs when designing new cipher and schemes, and we've seen cipher such as NORX or Gimli which are explicitly not-ARX designs.

Interestingly, using only Additions and Rotations, it is possible to emulate Xor, so the Xor can be removed in a "secure way" in ARX designs, unlike the rotation. (At the cost of a somewhat lower security bound though.)

Lery
  • 7,819
  • 1
  • 27
  • 46