On the Feistel Counterpart of the Boomerang Connectivity Table

Abstract

At Eurocrypt 2018, Cid et al. introduced the Boomerang Connectivity Table (BCT), a tool to compute the probability of the middle round of a boomerang distinguisher from the description of the cipher’s Sbox(es). Their new table and the following works led to a refined understanding of boomerangs, and resulted in a series of improved attacks. Still, these works only addressed the case of Substitution Permutation Networks, and completely left out the case of ciphers following a Feistel construction. In this article, we address this lack by introducing the FBCT, the Feistel counterpart of the BCT. We show that the coefficient at row Δi, ∇o corresponds to the number of times the second order derivative at points Δi, ∇o) cancels out. We explore the properties of the FBCT and compare it to what is known on the BCT. Taking matters further, we show how to compute the probability of a boomerang switch over multiple rounds with a generic formula.

Rectangle Attack Against Type‐I Generalized Feistel Structures

“…And the most recent work focused on evaluating the boomerang switch through multiple rounds more accurately [ 24 ] . While this tool was extended to Feistel ciphers with SP type round functions in ToSC 2020 [ 25 ] and ARX‐based round functions in Ref. [26].…”

Survey on recent trends towards generalized differential and boomerang uniformities

“…For ciphers with Feistel constructions, Boukerrou et al [17] studied various properties of the FBCT and showed that the entries of the FBCT of the inverse function are 0, 4, and 2 n . As a consequence, the Feistel boomerang uniformity of the inverse function is 4.…”

“…Although these notions are related to cryptanalysis performed on block ciphers involving S-boxes defined over finite fields with an even characteristic, they have been extended for more general functions defined over finite fields with an arbitrary (prime) characteristic. Some variants of the DDT and the BCT for ciphers following a Feistel construction were presented very recently by Boukerrou et al [17]. For a vectorial Boolean function F, the variant of the BCT is called the Feistel Boomerang Connectivity Table (FBCT).…”

“…This property was used to present new generic distinguishers against both SPN and Feistel constructions. Pushing further their investigations on block ciphers with a Feistel construction, Boukerrou et al [17] proposed an extension of the boomerang difference table (BDT), introduced by Wang and Peyrin [107] to evaluate the boomerang switch through multiple rounds. For ciphers with Feistel constructions, Boukerrou et The basic properties of the FBDT are studied in [17], namely its relations to the DDT and the FBCT.…”

“…Pushing further their investigations on block ciphers with a Feistel construction, Boukerrou et al [17] proposed an extension of the boomerang difference table (BDT), introduced by Wang and Peyrin [107] to evaluate the boomerang switch through multiple rounds. For ciphers with Feistel constructions, Boukerrou et The basic properties of the FBDT are studied in [17], namely its relations to the DDT and the FBCT. In connection with the FBDT, Eddahmani and Mesnager [48] introduced the (natural) notion of Feistel boomerang difference uniformity F of a function F as All these distinguishers are mainly dependent on the derivatives of the functions or the S-boxes.…”