IT lexicon › Security › Lai–Massey scheme

Lai–Massey scheme

Security På svenska → Updated: 2026-10-14

The third way to build a block cipher, alongside Feistel and SP networks: the round function is fed the difference between the two halves.

The block is split in two, and the round function takes their difference as input. Its output is then added to both halves, which leaves the difference unchanged — so the round can be undone even though the round function itself is not invertible. It is the same trick Feistel relies on, dressed in different algebra. Xuejia Lai and James Massey used the structure in IDEA in 1991.

In its bare form the scheme has a flaw: that preserved difference is an invariant that tells the cipher apart from a random permutation. Serge Vaudenay showed in 1999 that inserting an orthomorphism, a simple mixing of one half, into every round fixes it. Pascal Junod and Vaudenay then built the FOX cipher, later marketed as IDEA NXT, on the repaired version.

← Back to the lexicon