On generalizations of the Lai–Massey scheme

Abstract In this paper, we re-investigate the Lai–Massey scheme, originally proposed in the cipher IDEA. Due to the similarity with the Feistel networks, and due to the existence of invariant subspace attacks as originally pointed out by Vaudenay at FSE 1999, the Lai–Massey scheme has received only little attention by the community. As first contribution, we propose two new generalizations of such scheme that are not (extended) affine equivalent to any generalized Feistel network proposed in the literature so far. Then, inspired by the recent construction, we propose the structure as a generalization of the Lai–Massey scheme, in which the linear combination in the Lai–Massey scheme can be replaced by a non-linear one. Besides proposing concrete examples of the construction, we analyze its cryptographic properties in the context of MPC-/HE-/ZK-friendly symmetric primitives.