Throwing Boomerangs into Feistel Structures

Abstract

Automatic tools to search for boomerang distinguishers have seen significant advances over the past few years. However, most previous work has focused on ciphers based on a Substitution Permutation Network (SPN), while analyzing the Feistel structure is of great significance. Boukerrou et al. recently provided a theoretical framework to formulate the boomerang switch over multiple Feistel rounds, but they did not provide an automatic tool to find distinguishers. In this paper, by enhancing the recently proposed method by Hadipour et al., we provide an automatic tool to search for boomerang distinguishers and apply it to block ciphers following the Generalized Feistel Structure (GFS). Applying our tool to a wide range of GFS ciphers, we show that it significantly improves the best previous results on boomerang analysis. In particular, we improve the best previous boomerang distinguishers for 20 and 21 rounds of WARP by a factor of 238.28 and 236.56, respectively. Thanks to he effectiveness of our method, we can extend the boomerang distinguishers of WARP by two rounds and distinguish 23 rounds of this cipher from a random permutation. Applying our method to the internationally-standardized cipher CLEFIA, we achieve a 9-round boomerang distinguisher which improves the best previous boomerang distinguisher by one round. Based on this distinguisher, we build a key-recovery attack on 11 rounds of CLEFIA, which improves the best previous sandwich attack on this cipher by one round. We also apply our method to LBlock, LBlock-s, and TWINE and improve the best previous boomerang distinguisher of these ciphers.

On Boomerang Attacks on Quadratic Feistel Ciphers

“…This technique was first proposed to attack Skinny and Craft and was later on slightly modified and applied to Feistel ciphers in [HNE22]. The MILP model devised in these articles takes as input the size of E 0 , E m and E 1 and has as objective function to minimize a weighted sum of the number of active S-boxes in E 0 and E 1 and of the common active S-boxes in E m .…”

Automated security proof of SQUARE, LED and CLEFIA using the MILP technique

“…MILP has also been applied before to light encryption device (LED) and CLEFIA, but in another context. [Hadipour et al 2022] applied MILP to get faster distinguishes for LED (8 rounds) and CLEFIA (10 and 11 rounds) using the division property and [Derbez and Lambin 2022] used MILP to attack 11 rounds of CLEFIA in the key-recovery setting.…”