On Boomerang Attacks on Quadratic Feistel Ciphers

Abstract

The recent introduction of the Boomerang Connectivity Table (BCT) at Eurocrypt 2018 revived interest in boomerang cryptanalysis and in the need to correctly build boomerang distinguishers. Several important advances have been made on this matter, with in particular the study of the extension of the BCT theory to multiple rounds and to different types of ciphers.In this paper, we pursue these investigations by studying the specific case of quadratic Feistel ciphers, motivated by the need to look at two particularly lightweight ciphers, KATAN and Simon. Our analysis shows that their light round function leads to an extreme case, as a one-round boomerang can only have a probability of 0 or 1. We identify six papers presenting boomerang analyses of KATAN or Simon and all use the naive approach to compute the distinguisher’s probability. We are able to prove that several results are theoretically incorrect and we run experiments to check the probability of the others. Many do not have the claimed probability: it fails distinguishing in some cases, but we also identify instances where the experimental probability turns out to be better than the claimed one.To address this shortfall, we propose an SMT model taking into account the boomerang constraints. We present several experimentally-verified related-key distinguishers obtained with our new technique: on KATAN32 a 151-round boomerang and on Simon-32/64 a 17-round boomerang, a 19-round rotational-xor boomerang and a 15-round rotational-xor-differential boomerang.Furthermore, we extend our 19-round distinguisher into a 25-round rotational-xor rectangle attack on Simon-32/64. To the best of our knowledge this attack reaches one more round than previously published results.

On Impossible Boomerang Attacks

“…The idea of looking for boomerang incompatibilities over 1 round can be extended to bit-oriented ciphers, with the difficulty that the attacker must know how to guarantee an incompatibility. We develop this idea for quadratic Feistel ciphers as it was observed in [BL23b] that this type of ciphers fall into the extreme case where a one-round boomerang can only have a probability of 0 or 1, depending on the differences at play (but not on the state value).…”

“…The difficulty of finding such a contradiction depends on the details of the cipher. Inspired by what was presented in [BL23b], we study the case of the quadratic Feistel cipher Simon. Equation (3) applied to Simon gives:…”

“…Our first approach is to build upon the SMT model for Simon boomerang distinguishers from [BL23b]. We added support for impossible boomerang distinguishers by considering only probability-1 transitions and adding the constraint that one of the boomerang round transitions had to be impossible.…”

“…In this article we study possible extensions of the theory of [Lu08] by using impossibilities coming from boomerang switch contradictions: for Sbox-based ciphers we show how to leverage the BCT theory and rely on a coefficient of value 0, while we show how similar ideas can be developed for bit-oriented ciphers and in particular how one can benefit from the simple round function of the ciphers of the Simon family [BSS + 15]. We present distinguishers on the 10 variants of Simon and extend the more promising one into a 23-round attack on Simon-32/64 (see Table 1), reaching two less rounds than the current state of the art [BL23b] (that was obtained with a standard boomerang technique). We apply our technique based on the BCT contradiction to the recent tweakable block cipher SKINNYee [NSS22] and propose a 29-round attack, beating by 3 and 2 rounds the integral and impossible differential attacks proposed in the (up to our knowledge) only existing third-party analysis article [HSE23].…”