In this section we show that the round functions of DESL generate the same group as the round functions of DES. The main part of the argument is to establish 3-transitivity of the group generated by DESL’s round functions. To present the (somewhat technical) proof it will be convenient to introduce some notation.

#### 3.2. Establishing 3-Transitivity of G

Before proving the main result, we will prove some previous lemmas.

**Lemma** **1.** The round functions of DESL generate a subgroup of ${A}_{{2}^{64}}$ that acts transitively on ${\{0,1\}}^{64}$.

**Proof.** Verifying the transitivity of

G is straightforward, and the work of Even and Goldreich [

15] ensures that

G is contained in the alternating group. ☐

As an intermediate step, we will show the transitivity of ${G}_{0}:=\{g\in G|\phantom{\rule{4pt}{0ex}}g\left(0\right)=0\}$ on ${\{0,1\}}^{64}\backslash \left\{(0,\cdots ,0)\right\}$ and transitivity of ${G}_{0,d}:=\{g\in G|g\left(0\right)=0\phantom{\rule{4.pt}{0ex}}\mathrm{and}\phantom{\rule{4.pt}{0ex}}g\left(d\right)=d\}$ on ${\{0,1\}}^{64}\backslash \{(0,\cdots ,0),d\}$, where $d:={\left({\delta}_{31,i}\right)}_{i=1}^{64}$ has a single non-zero entry at the 31st position.

Before doing so, let us have a closer look at ${G}_{0}$ and ${G}_{0,d}$:

In view of the Feistel structure of DESL, it is perhaps not very surprising that we deal with pairs of round functions when exploring the transitivity of

${G}_{0}$ and

${G}_{0,d}$. We define four sets of key pairs, where the last two depend on the auxiliary value

${d}^{\prime}:=(0,0,0,1,0,0)\in {\{0,1\}}^{6}$:

The elements in

G we are mainly interested in are of the form

${F}_{K,{K}^{\prime}}^{L}:={F}_{{K}^{\prime}}^{-1}{F}_{K}$ or

${F}_{K,{K}^{\prime}}^{R}:={F}_{{K}^{\prime}}{F}_{K}^{-1}$ with the key pair

$(K,{K}^{\prime})$ being chosen from

$\mathbb{M}$. For input pairs

$(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$ we have

In other words, when evaluating

${F}_{(K,{K}^{\prime})}^{L}(a,b)$, the right half of the input does not vary and its left half is XORed with the value

${(S({\left[K\right]}_{i}\oplus {\left[EP\left(b\right)\right]}_{i})\oplus S({\left[{K}^{\prime}\right]}_{i}\oplus {\left[EP\left(b\right)\right]}_{i}))}_{i=1}^{8}$ to the left half of the input.

For ${F}_{(K,{K}^{\prime})}^{R}$ the situation is similar, with the left half of the input being stabilized.

The following proposition helps in understanding the effect of repeatedly applying a map of the form ${F}_{K,{K}^{\prime}}^{R}$, respectively ${F}_{K,{K}^{\prime}}^{L}$.

**Proposition** **1.** The functions ${F}_{K,{K}^{\prime}}^{L}$ and ${F}_{K,{K}^{\prime}}^{R}$ defined above satisfy the following:

- (a)
$\forall (K,{K}^{\prime})\in \mathbb{M}:{F}_{K,{K}^{\prime}}^{L}\in {G}_{0,d}$ and ${F}_{K,{K}^{\prime}}^{R}\in {G}_{0}$.

- (b)
$\forall (K,{K}^{\prime})\in {\mathbb{M}}_{{d}^{\prime}}:{F}_{K,{K}^{\prime}}^{L}\in {G}_{0,d}$ and ${F}_{K,{K}^{\prime}}^{R}\in {G}_{0,d}$.

- (c)
Let $n\in \mathbb{N}$. Then, for all $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in \mathbb{M}$ and for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$, the following hold:

${F}_{{K}_{1},{K}_{1}^{\prime}}^{R}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{R}(a,b)=$ and, analogously,

${F}_{{K}_{1},{K}_{1}^{\prime}}^{L}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{L}(a,b)=$

**Proof.** The proof is immediate from the definition of ${F}_{K,{K}^{\prime}}^{L}$ and ${F}_{K,{K}^{\prime}}^{R}$. ☐

To understand better which values can be obtained in the left and right 32-bit halves of the output through repeated application of a map of the form ${F}_{K,{K}^{\prime}}^{R}$ (respectively ${F}_{K,{K}^{\prime}}^{L}$), given some 64-bit input, it is helpful to take a look at some ${\mathbb{F}}_{2}$-vector subspaces of ${\mathbb{F}}_{2}^{4}$:

**Lemma** **2.** For $\phantom{\rule{4pt}{0ex}}y\in {\{0,1\}}^{6}\backslash \left\{(0,0,0,0,0,0)\right\}$ letbe the ${\mathbb{F}}_{2}$-vector space spanned by $\{S\left(k\oplus y\right)\oplus S\left({k}^{\prime}\oplus y\right)|(k,{k}^{\prime})\in M\}$. Similarly, denote by ${U}_{{d}^{\prime}}\left(y\right)$ the ${\mathbb{F}}_{2}$-vector space Then, the following statements hold:

- (a)
$\forall \phantom{\rule{4pt}{0ex}}y\in {\{0,1\}}^{6}\backslash \{(0,0,0,0,0,0),(0,0,0,0,0,1)\}:U\left(y\right)={\{0,1\}}^{4}$.

- (b)
$U(0,0,0,0,0,1)=\{0,2,4,6,8,10,12,14\}$.

- (c)
$\forall \phantom{\rule{4pt}{0ex}}y\in \{2,6,17,18,21,22,41,45,49,53,58,62\}:{U}_{{d}^{\prime}}\left(y\right)={\{0,1\}}^{4}$.

- (d)
$\forall \phantom{\rule{4pt}{0ex}}y\in {\{0,1\}}^{6}\backslash \left\{(0,0,0,1,0,0)\right\}:{U}_{{d}^{\prime}}\left(y\right)\ne \left\{0\right\}$.

**Proof.** The proof is by direct computation, e.g., using a programming language like Python [

16]. ☐

**Remark** **1.** Bringing the notation in Lemma 2 to use, from Proposition 1 we obtain the following statements which for the case $U\left({\left[EP\left(a\right)\right]}_{i}\right)={\{0,1\}}^{4}$ (respectively $U\left({\left[EP\left(b\right)\right]}_{k}\right)={\{0,1\}}^{4}$) may be regarded as “hinting at transitivity”:

For $i=1,\cdots ,8$ let ${u}_{i}\in U\left({\left[EP\left(a\right)\right]}_{i}\right)$ be a bitstring. Then, there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in \mathbb{M}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{R}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{R}(a,b)=(a,{\left[b\right]}_{1}\oplus {u}_{1},\cdots ,{\left[b\right]}_{8}\oplus {u}_{8})$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.

For $i=1,\cdots ,8$ let ${u}_{i}\in U\left({\left[EP\left(b\right)\right]}_{i}\right)$ be a bitstring. Then, there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in \mathbb{M}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{L}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{L}(a,b)=({\left[a\right]}_{1}\oplus {u}_{1},\cdots ,{\left[a\right]}_{8}\oplus {u}_{8},b)$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.

For $i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$ let ${u}_{i}\in U\left({\left[EP\left(a\right)\right]}_{i}\right)$ be a bitstring and let ${u}_{4}\in {U}_{{d}^{\prime}}\left({\left[EP\left(a\right)\right]}_{4}\right)$. Then, there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in {\mathbb{M}}_{{d}^{\prime}}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{R}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{R}(a,b)=(a,{b}_{1}\oplus {u}_{1},\cdots ,{b}_{8}\oplus {u}_{8})$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.

For $i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$ let ${u}_{i}\in U\left({\left[EP\left(b\right)\right]}_{i}\right)$ be a bitstring and let ${u}_{4}\in {U}_{{d}^{\prime}}\left({\left[EP\left(b\right)\right]}_{4}\right)$. Then there exist $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in {\mathbb{M}}_{{d}^{\prime}}$ such that ${F}_{{K}_{1},{K}_{1}^{\prime}}^{L}\circ \cdots \circ {F}_{{K}_{n},{K}_{n}^{\prime}}^{L}(a,b)=({a}_{1}\oplus {u}_{1},\cdots ,{a}_{8}\oplus {u}_{8},b)$ for all $(a,b)\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$.

Therefore, if we know that the equality $U\left({\left[EP\left(a\right)\right]}_{k}\right)={\{0,1\}}^{4}$ holds for some $1\le k\le 8$, then for each bitstring $c\in {\{0,1\}}^{4}$ we can find a sequence of key pairs $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in \mathbb{M}$ with For instance, we can choose pairs $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})$ with $({\left[{K}_{j}\right]}_{k},{\left[{K}_{j}^{\prime}\right]}_{k})\in M$ corresponding to the linear combination of $c\oplus {\left[b\right]}_{k}$, and the rest of the positions being 0. This ensures that all $({K}_{j},{K}_{j}^{\prime})$ are contained in $\mathbb{M}$, and if ${U}_{{d}^{\prime}}\left({\left[EP\left(a\right)\right]}_{k}\right)={\{0,1\}}^{4}$ or $k\ne 4$, we can also ensure $({K}_{1},{K}_{1}^{\prime}),\cdots ,({K}_{n},{K}_{n}^{\prime})\in {\mathbb{M}}_{{d}^{\prime}}$.

Similarly, in case $U\left({\left[EP\left(b\right)\right]}_{k}\right)$ contains all bitstrings of length 4, we can obtain a sequence of key pairs with The subsequent lemmata enable us to argue that ${G}_{0,d}$ acts transitively on ${\{0,1\}}^{64}\backslash \{0,d\}$. In other words, we prove that for all $x,y\in {\{0,1\}}^{64}\backslash \{0,d\}$ the equivalence $x\sim y$ holds, where $x\sim y\iff \exists g\in {G}_{0,d}:g\left(x\right)=y$. The proofs exploit in particular the transitivity of ∼.

**Lemma** **3.** Let $e:=(1,0,1,\cdots ,1)\in {\{0,1\}}^{32}$ be the 32-bit vector which has a single 0-entry at the second position and 1-entries everywhere else, and let $(z,{z}^{\prime})\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$ be arbitrary. Then $(e,z)\sim (e,{z}^{\prime})$.

**Proof.** Let

$(z,{z}^{\prime})\in {\{0,1\}}^{32}\times {\{0,1\}}^{32}$ be arbitrary, but fixed. From

Table 2 we see that

Hence, by properties (a) and (c) of Lemma 2 we obtain $U\left({\left(EP\left(e\right)\right)}_{i}\right)={\{0,1\}}^{4}$ for all $i=1,\cdots ,8$ as well as ${U}_{{d}^{\prime}}\left({\left(EP\left(e\right)\right)}_{4}\right)={\{0,1\}}^{4}$.

Therefore, because of Remark 1 for $c=({z}_{1}^{\prime},{z}_{2}^{\prime},{z}_{3}^{\prime},{z}_{4}^{\prime})$ we get:

$(e,z)\sim (e,({z}_{1}^{\prime},{z}_{2}^{\prime},{z}_{3}^{\prime},{z}_{4}^{\prime},{z}_{5},\cdots ,{z}_{32}))$, since $(e,({z}_{1}^{\prime},{z}_{2}^{\prime},{z}_{3}^{\prime},{z}_{4}^{\prime},{z}_{5},\cdots ,{z}_{32}))={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}(e,z)$, for the corresponding $({K}^{i},{K}^{{i}^{\prime}})$, $i\in \{1,\cdots ,n\}$.

Analogously, since $U\left({\left(EPe\right)}_{2}\right)={\{0,1\}}^{4}$, we can obtain:

$(e,({z}_{1}^{\prime},{z}_{2}^{\prime},{z}_{3}^{\prime},{z}_{4}^{\prime},{z}_{5},\cdots ,{z}_{32}))\sim (e,({z}_{1}^{\prime},\cdots ,{z}_{8}^{\prime},{z}_{9},\cdots ,{z}_{32})).$

If we continue carrying out the same procedure, since all the subspaces considered are ${\{0,1\}}^{4}$, we can finally see that $(e,z)\sim (e,{z}^{\prime})$. ☐

**Lemma** **4.** $\forall \phantom{\rule{4pt}{0ex}}a\in {\{0,1\}}^{64}\backslash \{0,d\}\phantom{\rule{4pt}{0ex}},\exists \phantom{\rule{4pt}{0ex}}{a}^{\prime}\in {\{0,1\}}^{64}\backslash \{0,d\}:{a}^{\prime}\sim a\phantom{\rule{4pt}{0ex}}and\phantom{\rule{4pt}{0ex}}\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{i}^{\prime}=1$.

**Proof.** If $\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{i}=1$, then we obtain the lemma with ${a}^{\prime}:=a$.

Otherwise, we distinguish two cases:

If $\exists \phantom{\rule{4pt}{0ex}}i\in \{33,\cdots ,64\}:{a}_{i}=1$:

Then $\exists \phantom{\rule{4pt}{0ex}}l\phantom{\rule{4pt}{0ex}}\in \{1,\cdots ,8\}$ such that ${\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}\ne 0$:

- –
If ${\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}\ne 1$, then $U{\left(\left[EP{\left(a\right)}_{i=33}^{64}\right)\right]}_{l}{)=\{0,1\}}^{4}$. Therefore, because of Remark 1, we can show ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left(a\right)$ such that ${\left({\left[{a}^{\prime}\right]}_{L}\right)}_{j}=1$ for $j\in \{4l-3,\cdots ,4l\}$. Thus, $\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{i}^{\prime}\phantom{\rule{3.33333pt}{0ex}}=\phantom{\rule{3.33333pt}{0ex}}1$.

- –
If ${\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}=1$, then $U\left({\left[EP{\left(a\right)}_{i=33}^{64}\right]}_{l}\right)=\{0,2,4,6,8,10,12,14\}$. With an argument similar to the previous one, we can get an element ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left(a\right)$, such that ${\left({a}_{L}^{\prime}\right)}_{i}=1$ for $i\in \{4l-3,\cdots ,4l-1\}$. Therefore, $\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{i}^{\prime}\phantom{\rule{3.33333pt}{0ex}}=\phantom{\rule{3.33333pt}{0ex}}1$.

If $\forall \phantom{\rule{4pt}{0ex}}i\in \{33,\cdots ,64\}:{a}_{i}=0$.

Since $a\ne 0$, then $\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}:{a}_{i}=1$. Therefore, $\exists \phantom{\rule{4pt}{0ex}}l\in \{1,\cdots ,8\}$ such that ${\left[EP{\left(a\right)}_{i=1}^{32}\right]}_{l}\ne 0$ and, like before (but using “right-functions”) we prove that we can get an element ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)$, where $({K}^{i},{K}^{{i}^{\prime}})\in {\mathbb{M}}_{{d}^{\prime}}$, such that $\exists \phantom{\rule{4pt}{0ex}}i\in \{33,\cdots ,64\}:{a}_{i}^{\prime}=1$. Notice that in this case the pairs $({K}^{i},{K}^{{i}^{\prime}})$ must be not only in $\mathbb{M}$, but in ${\mathbb{M}}_{{d}^{\prime}}$, so that $a\sim {a}^{\prime}$ (Proposition 1(b)).

- –
If $l\ne 4$

- ∗
If ${\left(EP{\left(a\right)}_{i=1}^{32}\right)}_{l}\ne 1$, then $U{\left(\left[EP{\left(a\right)}_{i=1}^{32}\right)\right]}_{l}{)=\{0,1\}}^{4}$.

Therefore, because of Remark 1, we can have ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)$, where $({K}^{i},{K}^{{i}^{\prime}})\in {\mathbb{M}}_{{d}^{\prime}}$, with ${a}_{i}^{\prime}=1$ for some $i\in \{33,\cdots ,64\}$.

- ∗
If ${\left[EP{\left(a\right)}_{i=1}^{32}\right]}_{l}=1$, then $U{\left(\left[EP{\left(a\right)}_{i=1}^{32}\right)\right]}_{l})=\{0,2,4,6,8,10,12,14\}$. With the same argument as before, we can get an element ${a}^{\prime}={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)$, such that ${a}_{i}^{\prime}=1$ for $i=32+j$, where $j\in \{4l-3,\cdots ,4l-1\}$.

- –
If

$l=4$: Since

$a\ne d$, according to

Table 2,

${\left(EPa\right)}_{4}\ne (0,0,0,1,0,0)$. Therefore, we have

${U}_{{d}^{\prime}}\left({\left(EPa\right)}_{4}\right)\ne 0$ (Lemma 2(d)) and we can obtain, as in the previous cases, an element

${a}^{\prime}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left(a\right)\sim a$, with

${a}_{i}^{\prime}=1$ for some

$i\in \{33,\cdots ,64\}$.

Hence, this case is traced back to the case $\exists \phantom{\rule{4pt}{0ex}}i\in \{33,\cdots ,64\}:{a}_{i}=1$ and the proof is complete. ☐

**Lemma** **5.** $\forall \phantom{\rule{4pt}{0ex}}{a}^{\prime}\in {\{0,1\}}^{64}\backslash \{0,d\}:{a}^{\prime}\sim a\phantom{\rule{4pt}{0ex}}and\phantom{\rule{4pt}{0ex}}\exists \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{i}^{\prime}=1,\phantom{\rule{4pt}{0ex}}\exists \phantom{\rule{4pt}{0ex}}{a}^{\u2033}\in {\{0,1\}}^{64}\backslash \{0,d\}:{a}^{\u2033}\sim {a}^{\prime}\phantom{\rule{4pt}{0ex}}and\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}:{a}_{i}^{\u2033}={e}_{i}$.

**Proof.** If $\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}:{a}_{i}^{\u2033}={e}_{i}$, then we immediately obtain the Lemma with ${a}^{\u2033}:={a}^{\prime}$.

Otherwise, we choose an index $j\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}:{a}_{j}^{\prime}=1$ and we will prove that

$\exists \phantom{\rule{4pt}{0ex}}{a}^{0}\in {\{0,1\}}^{64}\backslash \{0,d\}:{a}^{0}\sim {a}^{\prime}\phantom{\rule{4pt}{0ex}},\phantom{\rule{4pt}{0ex}}{\left[{a}^{0}\right]}_{L}={\left[{a}^{\prime}\right]}_{L}\phantom{\rule{4pt}{0ex}}and\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\phantom{\rule{4pt}{0ex}}\in I\left(j\right):{\left({a}^{0}\right)}_{32+i}=1$, where the sets

$I\left(j\right)$ are defined in

Figure 4.

We define ${a}^{0}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left({a}^{\prime}\right)$, with $({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$. Therefore, ${\left[{a}^{0}\right]}_{L}={\left[{a}^{\prime}\right]}_{L}$, and we will see that if $({K}^{i},{K}^{{i}^{\prime}}),i\in \{1,\cdots ,n\}$ have been chosen appropriately, we can have ${\left({a}^{0}\right)}_{32+i}=1,\forall \phantom{\rule{4pt}{0ex}}i\phantom{\rule{4pt}{0ex}}\in I\left(j\right)$.

For $j=1$:

According to

Table 2,

${\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}\ne 0$ and

${\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{3}\notin \{0,1\}$, since the corresponding positions for

${a}_{1}^{\prime}$ are 12 and 14, which are in blocks 2 and 3. Therefore, we have:

If ${\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}\ne 1$, then $U\left({\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}\right)={\{0,1\}}^{4}$. Hence, because of Remark 1, $\exists \phantom{\rule{4pt}{0ex}}({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in {\mathbb{M}}_{{d}^{\prime}}$ such that ${\left[{\left[{a}^{0}\right]}_{R}\right]}_{2}={[{F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right)]}_{2}=(1,1,1,1)$. Therefore, ${\left({a}^{0}\right)}_{32+i}=1$ for all $i\in \{5,\cdots ,8\}$.

If ${\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}=1$, then $U\left({\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{2}\right)=\{0,2,4,6,8,10,12,14\}$. With a similar argument, $\exists \phantom{\rule{4pt}{0ex}}({K}^{i},{K}^{{i}^{\prime}})\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$ such that ${\left[{\left[{a}^{0}\right]}_{R}\right]}_{2}={[{F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right)]}_{2}=(1,1,1,0)$. Therefore, ${\left({a}^{0}\right)}_{32+i}=1$ for all $i\in \{5,\cdots ,7\}$.

Since ${\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{3}\notin \{0,1\}$, then $U\left({\left[EP{\left({a}^{\prime}\right)}_{L}\right]}_{3}\right)={\{0,1\}}^{4}$ and therefore $\exists ({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$ such that ${\left[{\left[{a}^{0}\right]}_{R}\right]}_{3}={[{F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right)]}_{3}=(1,1,1,1)$. Therefore, ${\left({a}^{0}\right)}_{32+i}=1$ for all $i\in \{9,\cdots ,12\}$.

Thus, considering the composition of the functions involved, we obtain ${a}^{0}$ such that ${\left({a}^{0}\right)}_{32+i}=1\phantom{\rule{4pt}{0ex}},\forall \phantom{\rule{4pt}{0ex}}i\in \{5,\cdots ,12\}\backslash \left\{8\right\}$.

A similar argument applies to the other values of $j\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}$.

Now, we will see that

$\exists \phantom{\rule{4pt}{0ex}}{a}^{1}\in {\{0,1\}}^{64}\backslash \{0,d\}:{a}^{1}\sim {a}^{0}\phantom{\rule{4pt}{0ex}},\phantom{\rule{4pt}{0ex}}{\left[{a}^{1}\right]}_{R}={\left[{a}^{0}\right]}_{R}\phantom{\rule{4pt}{0ex}}and\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\phantom{\rule{4pt}{0ex}}\in J\left(j\right):{\left({a}^{1}\right)}_{i}={e}_{i}$, where the sets

$J\left(j\right)$ are defined in

Figure 5.

We define ${a}^{1}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right)$, with $({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in \mathbb{M}$. Therefore, ${\left[{a}^{0}\right]}_{R}={\left[{a}^{\prime}\right]}_{R}$, and we will see that choosing adequate elements $({K}^{i},{K}^{{i}^{\prime}})$, we can have ${\left({a}^{1}\right)}_{i}={e}_{i},\forall \phantom{\rule{4pt}{0ex}}i\phantom{\rule{4pt}{0ex}}\in J\left(j\right)$.

For $j=1$, $I\left(1\right)=\{5,\cdots ,12\}\backslash \left\{8\right\}$:

According to

Table 2, let us see which positions

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{i}\right)$ are in for the different values of

$i\phantom{\rule{4pt}{0ex}}\in I\left(1\right)$. We can see

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{5}\right)$ is in position 18 (block 3) and 20 (block 4),

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{6}\right)$ is in position 41 (block 7) and 43 (block 8),

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{7}\right)$ is in position 3 (block 1),

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{9}\right)$ is in position 35 and 37 (blocks 6 and 7),

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{10}\right)$ is in position 23 and 25 (block 4 and 5),

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{11}\right)$ is in position 45 (block 8), and

$EP\left({\left({\left[{a}^{0}\right]}_{R}\right)}_{12}\right)$ is in position 9 (block 2).

In all blocks j, for $j\in \{1,\cdots ,8\}\backslash \left\{3\right\}$, we have ${\left[EP{\left[{a}^{0}\right]}_{R}\right]}_{j}\notin \{0,1\}$ and then $U\left({\left[EP{\left[{a}^{0}\right]}_{R}\right]}_{j}\right)={\{0,1\}}^{4}$. Therefore, as discussed in the previous proofs, $\exists ({K}^{i},{K}^{{i}^{\prime}})\in \mathbb{M}$ such that ${\left[{\left[{a}^{1}\right]}_{L}\right]}_{j}:={[{F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right)]}_{j}={\left[e\right]}_{j}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}j\in \{1,\cdots ,8\}\backslash \left\{3\right\}$. For block 3, we have ${\left[EP{\left[{a}^{0}\right]}_{R}\right]}_{3}=1$, therefore $\exists \phantom{\rule{4pt}{0ex}}({K}^{i},{K}^{{i}^{\prime}})\in \mathbb{M}$ such that ${\left({a}^{1}\right)}_{i}:={({F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ {F}_{{K}^{2},{K}^{{2}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\prime}\right))}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{9,\cdots ,11\}$.

Therefore, the only position we cannot assure is equal to e is $i=12$, therefore $J{\left(1\right)}^{c}=\left\{12\right\}$.

For the rest of the indices j, we use similar arguments to compute sets $J\left(j\right)$.

If $j\in \{1,6,9,14,16,17,21,22,25,29,32\}$, the set $\left(\right\{1,\cdots ,32\}\backslash \{13,\cdots ,16\left\}\right)\backslash J\left(j\right)$ has only one element. Therefore, as ${\left({\left({a}^{1}\right)}_{L}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in $ J(j),${\left[EP\left({a}_{L}^{1}\right)\right]}_{i}\notin \{0,1\}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$, so $U\left({\left[EP\left({a}_{L}^{1}\right)\right]}_{i}\right)={\{0,1\}}^{4}$. Therefore, choosing appropriate $({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$ we get ${a}^{2}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{R}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{R}\left({a}^{1}\right)$, such that ${\left({\left[{a}^{2}\right]}_{R}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}$ (Remark 1).

Therefore, we have ${\left[EP\left({a}_{R}^{2}\right)\right]}_{i}\notin \{0,1\}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,8\}\backslash \left\{4\right\}$, so $U\left({\left[EP\left({a}_{L}^{2}\right)\right]}_{i}\right)={\{0,1\}}^{4}$. Now, choosing adequate $({K}^{i},{K}^{{i}^{\prime}})\phantom{\rule{4pt}{0ex}}\in \phantom{\rule{4pt}{0ex}}{\mathbb{M}}_{{d}^{\prime}}$, we can have ${a}^{3}:={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots \circ {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{2}\right)$, such that ${\left({a}^{3}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}$. Therefore, for ${a}^{\u2033}:={a}^{3}$ we have the desired result.

Hence, we have seen that the lemma holds if ${a}_{j}^{\prime}=1$ for $j\in \{1,6,9,14,16,17,21,22,25,29,32\}$.

For indices $j\in \{1,\cdots ,32\}\backslash \{2,5,10,18,26,31\}$, we have $J\left(j\right)\cap \{1,6,9,14,16,17,21,22,25,29,32\}\ne \varnothing $. Therefore, we are in the case where $\exists \phantom{\rule{4pt}{0ex}}j\in \{1,6,9,14,16,17,21,22,25,29,32\}$ such that ${\left({a}^{1}\right)}_{i}=1$, and carrying out the same procedure as the one to get ${a}^{3}$ from ${a}^{\prime}$, we get ${a}^{\u2033}$ satisfying ${\left({a}^{\u2033}\right)}_{i}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}$.

☐

**Lemma** **6.** $\forall \phantom{\rule{4pt}{0ex}}{a}^{\u2033}\in {\{0,1\}}^{64}\backslash \{0,d\}\phantom{\rule{4pt}{0ex}}:{a}_{i}^{\u2033}={e}_{i}\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\in \{1,\cdots ,32\}\backslash \{13,\cdots ,16\}\phantom{\rule{4pt}{0ex}},\exists \phantom{\rule{4pt}{0ex}}z\in {\{0,1\}}^{32}:{a}^{\u2033}\sim (e,z)$.

**Proof.** According to

Table 2,

${\left[\left(EP{\left(a\right)}_{L}\right)\right]}_{4}$ corresponds to positions 26, 5, 18, 31, and 2. Since

$\{2,5,10,18,26,31\}\cap \{13,\cdots ,16\}=\varnothing $, we know

${\left({a}_{L}^{\u2033}\right)}_{i}={e}_{i},\phantom{\rule{4pt}{0ex}}\forall \phantom{\rule{4pt}{0ex}}i\phantom{\rule{4pt}{0ex}}\in \{2,5,10,18,26,31\}$. Therefore,

${\left[\left(EP{\left(a\right)}_{L}\right)\right]}_{4}=(1,1,1,1,1,0)=62$ and because of Lemma 2 (c),

$U\left({\left[EP\left({\left({a}^{\u2033}\right)}_{L}\right)\right]}_{j}\right)={\{0,1\}}^{4}$. Thus, considering appropriate

$({K}^{i},{K}^{{i}^{\prime}})$, we get

$(e,z)={F}_{{K}^{1},{K}^{{1}^{\prime}}}^{L}\circ \cdots {F}_{{K}^{n},{K}^{{n}^{\prime}}}^{L}\left({a}^{\u2033}\right)$, for some

$z\in {\{0,1\}}^{32}$. ☐

**Corollary** **1.** $\forall a\in {\{0,1\}}^{64}\backslash \{0,d\}\phantom{\rule{4pt}{0ex}}\exists \phantom{\rule{4pt}{0ex}}z\in {\{0,1\}}^{32}:a\sim (e,z)$.

**Proof.** Considering the chain $a\sim {a}^{\prime}\sim {a}^{\u2033}\sim (e,z)$, where these elements are as described in the previous lemmata, the result follows. ☐

**Corollary** **2.** ${G}_{0,d}$ is transitive on ${\{0,1\}}^{64}\backslash \{0,d\}$.

**Proof.** Let $a,{a}^{\prime}\in {\{0,1\}}^{64}\backslash \{0,d\}$, by Lemma 6 and Corollary 1, $\exists \phantom{\rule{4pt}{0ex}}z,{z}^{\prime}\in {\{0,1\}}^{32}:a\sim (e,z)\sim (e,{z}^{\prime})\sim {a}^{\prime}.$ ☐

**Corollary** **3.** ${G}_{0}$ is transitive on ${\{0,1\}}^{64}\backslash \left\{0\right\}$.

**Proof.** Because of Corollary 1, it is enough to show that $\exists g\in {G}_{0}$ such that $g\left(d\right)\ne d$.

Note that since $g\in {G}_{0}$, then $g\left(d\right)\ne 0$.

Let $(K,{K}^{\prime})\in \mathbb{M}\backslash {\mathbb{M}}_{{d}^{\prime}}$, then $S\left(K\right)=S\left({K}^{\prime}\right)$ and $S(K\oplus {d}^{\prime})\ne S({K}^{\prime}\oplus {d}^{\prime})$. Therefore, ${F}_{K,{K}^{\prime}}^{R}\left(d\right)=({d}_{L},{d}_{R}\oplus )S(K\oplus {d}^{\prime})\oplus S({K}^{\prime}\oplus {d}^{\prime})\ne d$, and ${F}_{K,{K}^{\prime}}^{R}\in {G}_{0}$. ☐

**Lemma** **7.** If ${G}_{0}$ is transitive on ${\{0,1\}}^{64}\backslash \left\{(0,\cdots ,0)\right\}$ and ${G}_{0,d}$ is transitive on ${\{0,1\}}^{64}\backslash \{(0,\cdots ,0),d\}$, then G is 3-transitive on ${\{0,1\}}^{64}$.

**Proof.** It follows immediately from [

17] (Theorem 9.1). ☐

Once we have shown that G is a 3-transitive subgroup of ${A}_{{2}^{64}}$, it is not particularly difficult to verify that G is actually equal to the alternating group on ${2}^{64}$ points.

**Theorem** **1.** The round functions of DESL generate the alternating group, i.e., $G={A}_{{2}^{64}}$.

**Proof.** We refer to the proof of Theorem 1 in [

7], since the same proof applies here. ☐