Revisiting Impossible Differential Distinguishers of Two Generalized Feistel Structures

Abstract

Impossible differential attack is one of the most effective cryptanalytic methods for block ciphers. Its key step is to construct impossible differential distinguishers as long as possible. In this paper, we mainly focus on constructing longer impossible differential distinguishers for two kinds of generalized Feistel structures which are m -dataline CAST256-like and MARS-like structures. When their round function takes Substitution Permutation SP and Substitution Permutation Substitution SPS types, they are called CAST 256 SP / CAST 256 SPS and MARS SP / MARS SPS , respectively. For CAST 256 SP / CAST 256 SPS , the best known result for the length of the impossible differential distinguisher was m 2 + m / m 2 + m − 1 rounds, respectively. With the help of the linear layer P , we can construct m 2 + m + Λ 0 / m 2 + m + Λ 1 -round impossible differential distinguishers, where Λ 0 and Λ 1 are non-negative numbers if P satisfies some restricted conditions. For MARS SPS , the best known result for the length of the impossible differential distinguisher was 3 m − 1 rounds. We can construct 3 m -round impossible differential distinguishers which are 1 round longer than before. To our knowledge, the results in this paper are the best for the two kinds of generalized Feistel structures.

Security evaluation on type‐1 and type‐1‐like 4‐branch generalized Feistel structures and application to reduced‐round Lesamnta‐LW‐BC

“…When the linear layer P satisfies γ ( P ) = 2, only 20‐round impossible differentials of the type‐1 4‐branch GFS with SP round functions could be constructed in Ref. [17]. Compared with this result, our result can find the distinguisher 1 more round.…”

“…In the above lemma, we exploit the definitions of the Support and Primitive index to relax the condition of γ ( P ) from γ ( P ) ≥ 3 in Ref. [17] to γ ( P ) ≥ 2 in our paper. With this lemma, a 21‐round impossible differential distinguisher is formulated as the following theorem.…”

“…When the linear layer P satisfies γ(P) = 2, only 20round impossible differentials of the type-1 4-branch GFS with SP round functions could be constructed in Ref. [17].…”

“…This result was further improved in 2020 [16]. With the details of P, they also constructed 20-round impossible differentials but relaxed the restricted condition of P which only needs B(P) > 2, where B (P) denotes the differential branch number of P. Very recently, the restricted condition of P on the 20-round distinguisher was removed and 21-round impossible differentials were given for γ(P) ≥ 3 in 2021 [17], where γ(P) denotes the primitive index of P. These results are summarised in Table 1.…”

Designing a Graphical Domain-Specific Modeling Language for Efficient Block Cipher Configuration: BCLang

“…The round keys (K[i]), which the key scheduling procedure derives from the seed key, are applied to the internal rounds. The structure facilitates decoding by using reverseordered round keys [5].…”