Impossible Differential Cryptanalysis for Block Cipher Structures

Kim, Jongsung; Hong, Seokhie; Sung, Jaechul; Lee, Sang-Jin; Lim, Jongsik; Sung, Soo-Hak

doi:10.1007/978-3-540-24582-7_6

Cited by 94 publications

(81 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…By using the U-method [17], the designers of n-cell GF-NLFSR found a (2n − 1)-round impossible differential: (0, 0, 0, . .…”

Section: Impossible Differential Of Gf-nlfsrmentioning

confidence: 99%

Cryptanalysis of a Generalized Unbalanced Feistel Network Structure

Sun

et al. 2010

Information Security and Privacy

View full text Add to dashboard Cite

Abstract. This paper reevaluates the security of GF-NLFSR, a new kind of generalized unbalanced Feistel network structure that was proposed at ACISP 2009. We show that GF-NLFSR itself reveals a very slow diffusion rate, which could lead to several distinguishing attacks. For GF-NLFSR containing n sub-blocks, we find an n 2 -round integral distinguisher by algebraic methods and further use this integral to construct an (n 2 + n − 2)-round impossible differential distinguisher. Compared with the original (3n − 1)-round integral and (2n − 1)-round impossible differential, ours are significantly better.Another contribution of this paper is to introduce a kind of nonsurjective attack by analyzing a variant structure of GF-NLFSR, whose provable security against differential and linear cryptanalysis can also be provided. The advantage of the proposed non-surjective attack is that traditional non-surjective attack is only applicable to Feistel ciphers with non-surjective (non-uniform) round functions, while ours could be applied to block ciphers with bijective ones. Moreover, its data complexity is O(l) with l the block length.

show abstract

“…By using the U-method [17], the designers of n-cell GF-NLFSR found a (2n − 1)-round impossible differential: (0, 0, 0, . .…”

Section: Impossible Differential Of Gf-nlfsrmentioning

confidence: 99%

Cryptanalysis of a Generalized Unbalanced Feistel Network Structure

Sun

et al. 2010

Information Security and Privacy

View full text Add to dashboard Cite

show abstract

“…In this section, we introduce and establish notions for IBA by modifying and extending those used in [3].…”

Section: A Key Recovery Attackmentioning

confidence: 99%

“…Definition 1 [3] The n × n Encryption Characteristic Matrix E = (E ij ) n×n and n × n Decryption Characteristic Matrix D = (D ij ) n×n are defined as follows.…”

Section: Basic Definitions and Operationsmentioning

confidence: 99%

“…As denoted in [3], U = {0, 1, 1 * , 2 * }. Adopting a similar approach to [3], we may use the elements of U to find impossible boomerang characteristics.…”

Section: Finding Impossible Boomerang Distinguishersmentioning

confidence: 99%

“…Inspired by the U-method in [3], we introduce the UB-method and provide an algorithm to compute the maximum length of impossible boomerang distinguishers and implement it on some selected block ciphers. As we shall see later on, the maximum length for impossible boomerang distinguishers are equal to that for impossible differential distinguishers for certain ciphers, increasing the likelihood that IBA will be a feasible attack on them.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Impossible Boomerang Attack for Block Cipher Structures

Choy

Yap

2009

Advances in Information and Computer Security

View full text Add to dashboard Cite

Abstract. Impossible boomerang attack [5] (IBA) is a new variant of differential cryptanalysis against block ciphers. Evident from its name, it combines the ideas of both impossible differential cryptanalysis and boomerang attack. Though such an attack might not be the best attack available, its complexity is still less than that of the exhaustive search. In impossible boomerang attack, impossible boomerang distinguishers are used to retrieve some of the subkeys. Thus the security of a block cipher against IBA can be evaluated by impossible boomerang distinguishers. In this paper, we study the impossible boomerang distinguishers for block cipher structures whose round functions are bijective. Inspired by the U-method in [3], we provide an algorithm to compute the maximum length of impossible boomerang distinguishers for general block cipher structures, and apply the algorithm to known block cipher structures such as Nyberg's generalized Feistel network, a generalized CAST256-like structure, a generalized MARS-like structure, a generalized RC6-like structure, etc.

show abstract