Known-Key Attacks on Generalized Feistel Schemes with SP Round Function

Known-Key Distinguishing and Partial-Collision Attacks on GFN-2 with SP F-Function

“…ey presented a 13-round known-key distinguishing attack on GFN-2 and 9-round 1-word and 2-word partialcollision attacks on Matyas-Meyer-Oseas and Miyaguchi-Preneel hash modes of GFN-2. In this paper, we improve the results for GFN-2 in [4] and also present known-key distinguishing and partial-collision attacks for the cases of t � 6 and t � 8. Our results are summarized as follows:…”

“…In 2011, Sasaki and Yasuda used the rebound technique [2] to construct known-key distinguishers for the Feistel network whose Ffunction consists of cryptographically strong S-boxes and an MDS matrix and showed that those distinguishers are converted into partial-collision attacks on hash modes [3]. Later, their results have been applied to variants of the Feistel network [4][5][6].…”

“…It has been researched for secure and efficient block cipher design. In [4], Kang et al presented known-key attacks on three types of generalized Feistel network (GFN) proposed by Nyberg [10]. Particularly, Type-II GFN (GFN-2) is well-balanced like Feistel network and suitable for lightweight designs because the iteration of the relatively small F-function makes a largeblock-length block cipher.…”

“…e block length of GFN-2 with the parameters t, a, and b is abt bits. We restrict (a, b) to (4,4), (4,8), (8,4), and (8, 8) and t to 4, 6, and 8, which are mainly used and considered in block cipher designs.…”

“…In [4], Kang et al analyzed only t � 4 cases of GFNs and assumed that the last-round function has no shuffle operation. ey presented a 13-round known-key distinguishing attack on GFN-2 and 9-round 1-word and 2-word partialcollision attacks on Matyas-Meyer-Oseas and Miyaguchi-Preneel hash modes of GFN-2.…”