Structure of CLEFIA

CLEFIA is realized by harmonizing traditional design techniques and newly established design techniques.

A blockcipher algorithm can be divided into two parts - a data processing part and a key scheduling part.

CLEFIA employs a generalized Feistel structure which contains 4-branch data lines. This structure is an extended version of the traditional 2-branch Feistel structure. There are two F-functions in a round. These F-functions are located in parallel in a round, and their input/output length is 32 bits long.

Due to this 4-branch structure, the size of each F-function is smaller than the 2-branch Feistel structure which requires double-sized input. This characteristic of the 4-branch structure enables us to implement these F-functions compactly both in hardware and software.

However, there is with this structure a problem in that the smaller the size of the F-function is, the worse the diffusion effect is. As a result, the required number of rounds of the structure tends to increase to maintain sufficient security strength.

CLEFIA employs Diffusion Switching Mechanism （DSM）, which ensures immunity against both differential and linear attacks with a fewer number of rounds, so DSM can make blockciphers faster. However, it is known that applying DSM to the conventional 2-branch Feistel structure is not always appropriate because for the implementation cost is higher because DSM requires plural matrices for switching, as in Figure 3.

CLEFIA employs a 4-branch Feistel structure to realize compactness and high speed. Two different matrices are used, each matrix for each F-function in a round. This means that all round functions are identical, so encryption can be done without additional cost of implementation. Using DSM, the number of rounds can be reduced to 70% of a structure without DSM.