Algebraic Insights into the Secret Feistel Network

Abstract

Abstract. We introduce the high-degree indicator matrix (HDIM), an object closely related with both the linear approximation table and the algebraic normal form (ANF) of a permutation. We show that the HDIM of a Feistel Network contains very specific patterns depending on the degree of the Feistel functions, the number of rounds and whether the Feistel functions are 1-to-1 or not. We exploit these patterns to distinguish Feistel Networks, even if the Feistel Network is whitened using unknown affine layers. We also present a new type of structural attack exploiting monomials that cannot be present at round − 1 to recover the ANF of the last Feistel function of a -round Feistel Network. Finally, we discuss the relations between our findings, integral attacks, cube attacks, Todo's division property and the congruence modulo 4 of the Linear Approximation Table.

Multiset-Algebraic Cryptanalysis of Reduced Kuznyechik, Khazad, and secret SPNs

“…We deduce from Corollary 1 that a good rule of thumb to estimate the number of SPN rounds necessary to achieve full degree is to use 2 × ⌊log −1 ( )⌋ rounds. Interestingly, this result is very similar to what is stated in Theorem 1 of [PU16]. Indeed, in this paper, the existence of integral distinguishers for about 2 log ( ) rounds of Feistel Network are derived, where is the degree of the Feistel function.…”

“…Proof. We consider the high-degree indicator matrix (hdim) of , as introduced in [PU16]. It is defined as a × binary matrix where the coefficient at line and column is equal to 1 if and only if the monomial ∏︀…”

Algebraic Degree Estimation of Block Ciphers Using Randomized Algorithm; Upper-Bound Integral Distinguisher

“…We show three works related to integral distinguisher, division property [4], bit-based division property [6] and HDIM [10]. These three works have similarity with our method, since they use the ANF and estimate algebraic degree to construct integral distinguisher.…”

“…Aside from division property, Perrin et al proposed high-degree indicator matrix (HDIM) which can be used to search for integral distinguisher [10] in FSE2016. This is experimental method whose time and memory complexity increases in exponential order with the block length.…”

Asymptotic Distributions for S-Box Heterogeneous Differential Probabilities

“…The distribution of differential probabilities of fixed or random S-box is sufficient to find S-box with the best security parameters values (which is quite obvious usage). But with this information one can also evaluate security of ciphers with random or pseudo-random S-boxes or even restore a hidden internal algebraic structure of cryptographic mappings (like in [5,6]). Differentials with respect to XOR operation are widely used in differential cryptanalysis; O'Connor found exact combinatorial formulas for distribution of such differentials for random S-box [7], but these formulas are very ponderous, thus they are poorly applicable in practice.…”