Cryptanalysis of Feistel Networks with Secret Round Functions

Biryukov, Alex; Leurent, Gaëtan; Perrin, Léo

doi:10.1007/978-3-319-31301-6_6

Cited by 29 publications

(56 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Feistel Networks have also been the target of generic attacks in two different settings. If the Feistel functions are completely secret, attacks up to 5-rounds are presented in [5]. If the Feistel functions consist in public functions preceded by the addition of a secret key, powerful attacks with very low data complexity are presented in [6].…”

Section: Introductionmentioning

confidence: 99%

“…Due to their integral nature, our distinguishers are extremely memory efficient: we only need to store a block containing the sum studied. In contrast, the impossible differential for 5-round Feistel Network [10] and the yoyo-game [5] are the best known distinguishers for 5-rounds FN with bijective Feistel functions and require respectively O(2 ) and O(2 2 ) blocks of memory.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Algebraic Insights into the Secret Feistel Network

Perrin

Udovenko

2016

Fast Software Encryption

Self Cite

View full text Add to dashboard Cite

Abstract. We introduce the high-degree indicator matrix (HDIM), an object closely related with both the linear approximation table and the algebraic normal form (ANF) of a permutation. We show that the HDIM of a Feistel Network contains very specific patterns depending on the degree of the Feistel functions, the number of rounds and whether the Feistel functions are 1-to-1 or not. We exploit these patterns to distinguish Feistel Networks, even if the Feistel Network is whitened using unknown affine layers. We also present a new type of structural attack exploiting monomials that cannot be present at round − 1 to recover the ANF of the last Feistel function of a -round Feistel Network. Finally, we discuss the relations between our findings, integral attacks, cube attacks, Todo's division property and the congruence modulo 4 of the Linear Approximation Table.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Algebraic Insights into the Secret Feistel Network

Perrin

Udovenko

2016

Fast Software Encryption

Self Cite

View full text Add to dashboard Cite

show abstract

“…It is well-known that the expected number of cycles of length k over a random Π is E Π (c k ) = 1 k . 6 In what follows we show two useful results.…”

Section: Slide Attack On Ff3mentioning

confidence: 89%

“…5 Find the largest connected component in G . 6 Assign one F 0 (y) value arbitrarily and deduce F 0 on the connected component. 7 For all known plaintexts using y in the connected component, evaluate and deduce a tuple for the 3-round Feistel scheme based on (F 1 , F 2 , F 3 ).…”

Section: Round-function-recovery On 4-round Feistel Schemementioning

confidence: 99%

See 1 more Smart Citation

Breaking the FF3 Format-Preserving Encryption Standard over Small Domains

Durak

Vaudenay

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The National Institute of Standards and Technology (NIST) recently published a Format-Preserving Encryption standard accepting two Feistel structure based schemes called FF1 and FF3. Particularly, FF3 is a tweakable block cipher based on an 8-round Feistel network. In CCS 2016, Bellare et. al. gave an attack to break FF3 (and FF1) with time and data complexity O(N 5 log(N)), which is much larger than the code book (but using many tweaks), where N 2 is domain size to the Feistel network. In this work, we give a new practical total break attack to the FF3 scheme (also known as BPS scheme). Our FF3 attack requires O(N 11 6 ) chosen plaintexts with time complexity O(N 5 ). Our attack was successfully tested with N 2 9 . It is a slide attack (using two tweaks) that exploits the bad domain separation of the FF3 design. Due to this weakness, we reduced the FF3 attack to an attack on 4-round Feistel network. Biryukov et. al. already gave a 4-round Feistel structure attack in SAC 2015. However, it works with chosen plaintexts and ciphertexts whereas we need a known-plaintext attack. Therefore, we developed a new generic known-plaintext attack to 4-round Feistel network that reconstructs the entire tables for all round functions. It works with N 3 2 N 2 1 6 known plaintexts and time complexity O(N 3 ). Our 4-round attack is simple to extend to five and more rounds with complexity N (r−5)N+o(N) . It shows that FF1 with N = 7 and FF3 with 7 N 10 do not offer a 128-bit security. Finally, we provide an easy and intuitive fix to prevent the FF3 scheme from our O(N 5 ) attack.

show abstract

Real‐time decomposition of three kinds of structural S‐boxes

Cui

Liu

Song

2016

Security Comm Networks

View full text Add to dashboard Cite

S‐box is one of the most important components of modern cipher. For efficient implementation and to avoid a purely algebraic construction, utilizing special cipher structure and small‐size random permutation to design S‐boxes seems to be an attractive approach. In this paper, we focus on the structure‐recovery problem on three kinds of S‐boxes, that is, specify the inner transformations from the look‐up table, which allows a much more efficient hardware implementation. For a given n‐bit bijection, with introducing equivalent structures, we decompose it into three‐layer Feistel/MISTY/Lai–Massey within time complexity O(2n/2) and 2 − n/2 part of the full codebook. Copyright © 2017 John Wiley & Sons, Ltd.

show abstract

Cryptanalysis of Feistel Networks with Secret Round Functions

Cited by 29 publications

References 19 publications

Algebraic Insights into the Secret Feistel Network

Algebraic Insights into the Secret Feistel Network

Breaking the FF3 Format-Preserving Encryption Standard over Small Domains

Real‐time decomposition of three kinds of structural S‐boxes

Contact Info

Product

Resources

About