Unnecessary rounds and inputs in partial cipher inverse

[juaninf]

The following portion of code is computing the cipher_partial_inverse of a block cipher without permutation. Below its is description as a Python dictionary. As you can see rounds 1, 2, and 3 are empty also the inputs key_0_2, key_2_2, key_1_2, key_3_2 are not being used at all.

import numpy as np
speck_cipher_without_key_schedule = speck_cipher.remove_key_schedule()
partial_speck = speck_cipher_without_key_schedule.cipher_partial_inverse(4, 4, True)
partial_speck.print_as_python_dictionary()

cipher = {
'cipher_id': 'speck_partial_4_to_4_p32_k16_k16_k16_k16_k16_o32_r0_inverse_o32_r5',
'cipher_type': 'block_cipher',
'cipher_inputs': ['cipher_output_4_12', 'key_0_2', 'key_2_2', 'key_4_2', 'key_1_2', 'key_3_2'],
'cipher_inputs_bit_size': [32, 16, 16, 16, 16, 16],
'cipher_output_bit_size': 32,
'cipher_number_of_rounds': 5,
'cipher_rounds' : [
  # round 0
  [
  {
    # round = 0 - round component = 0
    'id': 'xor_4_8',
    'type': 'word_operation',
    'input_bit_size': 32,
    'input_id_link': ['key_4_2', 'cipher_output_4_12'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['XOR', 2],
  },
  {
    # round = 0 - round component = 1
    'id': 'xor_4_10',
    'type': 'word_operation',
    'input_bit_size': 32,
    'input_id_link': ['cipher_output_4_12', 'cipher_output_4_12'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31]],
    'output_bit_size': 16,
    'description': ['XOR', 2],
  },
  {
    # round = 0 - round component = 2
    'id': 'rot_4_9',
    'type': 'word_operation',
    'input_bit_size': 16,
    'input_id_link': ['xor_4_10'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['ROTATE', 2],
  },
  {
    # round = 0 - round component = 3
    'id': 'modadd_4_7',
    'type': 'word_operation',
    'input_bit_size': 32,
    'input_id_link': ['xor_4_8', 'rot_4_9'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['MODSUB', 2, None],
  },
  {
    # round = 0 - round component = 4
    'id': 'rot_4_6',
    'type': 'word_operation',
    'input_bit_size': 16,
    'input_id_link': ['modadd_4_7'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['ROTATE', -7],
  },
  ],
  # round 1
  [
  ],
  # round 2
  [
  ],
  # round 3
  [
  ],
  # round 4
  [
  {
    # round = 4 - round component = 0
    'id': 'intermediate_output_3_12',
    'type': 'cipher_output',
    'input_bit_size': 32,
    'input_id_link': ['rot_4_6', 'rot_4_9'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 32,
    'description': ['intermediate_output_3_12'],
  },
  ],
  ],
'cipher_reference_code': None,
}
cipher = {
'cipher_id': 'speck_partial_4_to_4_p32_k16_k16_k16_k16_k16_o32_r0_inverse_o32_r5',
'cipher_type': 'block_cipher',
'cipher_inputs': ['cipher_output_4_12', 'key_4_2'],
'cipher_inputs_bit_size': [32, 16],
'cipher_output_bit_size': 32,
'cipher_number_of_rounds': 5,
'cipher_rounds' : [
  # round 0
  [
  {
    # round = 0 - round component = 0
    'id': 'xor_4_8',
    'type': 'word_operation',
    'input_bit_size': 32,
    'input_id_link': ['key_4_2', 'cipher_output_4_12'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['XOR', 2],
  },
  {
    # round = 0 - round component = 1
    'id': 'xor_4_10',
    'type': 'word_operation',
    'input_bit_size': 32,
    'input_id_link': ['cipher_output_4_12', 'cipher_output_4_12'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31]],
    'output_bit_size': 16,
    'description': ['XOR', 2],
  },
  {
    # round = 0 - round component = 2
    'id': 'rot_4_9',
    'type': 'word_operation',
    'input_bit_size': 16,
    'input_id_link': ['xor_4_10'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['ROTATE', 2],
  },
  {
    # round = 0 - round component = 3
    'id': 'modadd_4_7',
    'type': 'word_operation',
    'input_bit_size': 32,
    'input_id_link': ['xor_4_8', 'rot_4_9'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['MODSUB', 2, None],
  },
  {
    # round = 0 - round component = 4
    'id': 'rot_4_6',
    'type': 'word_operation',
    'input_bit_size': 16,
    'input_id_link': ['modadd_4_7'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 16,
    'description': ['ROTATE', -7],
  },
  ],
  # round 1
  [
  ],
  # round 2
  [
  ],
  # round 3
  [
  ],
  # round 4
  [
  {
    # round = 4 - round component = 0
    'id': 'intermediate_output_3_12',
    'type': 'cipher_output',
    'input_bit_size': 32,
    'input_id_link': ['rot_4_6', 'rot_4_9'],
    'input_bit_positions': [[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15]],
    'output_bit_size': 32,
    'description': ['cipher_output'],
  },
  ],
  ],
'cipher_reference_code': None,
}

[p-huynh]

@juaninf

key_0_2, key_2_2, key_1_2, key_3_2 are not being used at all.

That's expected behavior though. The remove_key_schedule method was added for linear cryptanalysis in the first place, where we needed to keep the round key additions, so even though the key schedule operations are removed, the round keys are provided as inputs.

Now if you'd rather have a fully clean version without key addition at all, I added a flag here
#339

[juaninf]

Thanks @p-huynh, that makes sense regarding the unused round keys — I understand now why remove_key_schedule keeps the round key additions as inputs for linear cryptanalysis.

What I meant to point out is slightly different: in the cipher_partial_inverse output, rounds 1, 2, and 3 are completely empty, i.e.:

round 1
[
],
round 2
[
],
round 3
[
],