Generic Attacks on Unbalanced Feistel Schemes with Expanding Functions

Generic Attacks on Unbalanced Feistel Schemes with Expanding Functions

Jacques Patarin1_{, Val´erie Nachef}2_{, and Cˆome Berbain}3

1 _{Universit´e de Versailles}

45 avenue des Etats-Unis, 78035 Versailles Cedex, France 2 _{Department of Mathematics}

University of Cergy-Pontoise CNRS UMR 8088

2 avenue Adolphe Chauvin, 95011 Cergy-Pontoise Cedex, France 3

France Telecom Research and Development

38-40 rue du G´en´eral Leclerc, 92794 Issy-les-Moulineaux, France

[email protected] [email protected] [email protected]

Abstract. Unbalanced Feistel schemes with expanding functions are used to construct pseudo-random permutations fromknbits toknbits by using random functions from nbits to (k−1)nbits. At each round, all the bits except n

bits are changed by using a function that depends only on thesenbits. C.S.Jutla [6] investigated such schemes, which he denotes byFkd, wheredis the number of rounds. In this paper, we describe novel Known Plaintext Attacks (KPA)

and Non Adaptive Chosen Plaintext Attacks (CPA-1) against these schemes. With these attacks we will often be able to improve the result of C.S.Jutla. We also give precise formulas for the complexity of our attacks ind,kandn.

Key words: Unbalanced Feistel permutations, pseudo-random permutations, generic attacks on encryption schemes, Block ciphers.

1

Introduction

A Feistel scheme from{0,1}l_to{0,1}l_{withdrounds is a permutation built from rounds functionsf}

1, . . . , fd. When these

round functions are randomly chosen, we obtain what is called a “Random Feistel Scheme”. The attacks on these “random Feistel schemes” are called “generic attacks” since these attacks are valid for most of the round functionsf1, . . . fd.

•Whenl= 2nand when thefifunctions are from{0,1}n to{0,1}n we obtain the most classical Feistel schemes, also

called “balanced” Feistel schemes. Since the famous paper of M.Luby and C.Rackoff [11], many results have been obtained on the security of such classical Feistel schemes (see [12] for an overview of these results). When the number of rounds is lower than 5, we know attacks with less than 2l_{(= 2}2n_{) operations: for 5 rounds, an attack inO(2}n_{) operations is given in}

[15] and for 3 or 4 rounds an attack in√2n _{is given in [1],[13]. When the functions are permutations, similar attacks for}

5 rounds are given in [7] and [9]. Therefore, for security, at least 6 rounds are recommended, i.e. each bit will be changed at least 3 times.

•Whenl=knand when the round functions are from (k−1)nbits tonbits, we obtain what is called an “Unbalanced Feistel Scheme with contracting functions”. In [12] some security proofs are given for such schemes when for the first and the last rounds pairwise independent functions are used instead of random contracting functions. At Asiacrypt 2006 ([16]) generic attacks on such schemes have been studied.

Attacks on Unbalanced Feistel Schemes with expanding functions have been previously studied by C.S.Jutla ([6]). We will often be able to improve his attacks by attacking more rounds, or by using a smaller complexity. Moreover we will generalize these attacks by analyzing KPA (Known Plaintext Attacks), not only CPA-1 (non adaptive plaintext attacks) and by giving explicit formulas for the complexities. We will not introduce adaptive attacks, or chosen plaintext and chosen ciphertext attacks, since we have not found anything significantly better than CPA-1.

We will have essentially three families of attacks called “2 point attacks” (TWO), “rectangle attacks” (SQUARE, R1, R2, R3, R4) and “Multi-Rectangle attacks”. It can be noticed thatk= 2 is very different fromk= 3 (andk≥3), since we do not have the analog of the “rectangle” attacks.

The paper is organized as follows. First, we give some notation. Then, the paper is organized in three parts. In Part I, we describe our different TWO and Rectangle attacks whenk= 3. In Part II, we present the TWO and Rectangle attacks for anyk,k≥3. Our attacks for anyk≥3 are in fact a generalization of our attacks fork= 3. Finally, in Part III, we present other attacks.

2

Notation

We first describe Unbalanced Feistel Scheme with Expanding FunctionsFd

k and introduce some useful notations.F d k is a

Feistel scheme ofdrounds. At each roundj, we denote byfj the round function fromnbits to (k−1)nbits.fj is defined

asfj = (f

(1)

j , f

(2)

j , . . . , f

(k−1)

j ), where each functionf

(l)

j is defined from{0,1}

n _{to {0,1}}n_{. On some input [I}1_{, I}2_{, . . . , I}k_]

Fd

k produces an output denoted by [S1, S2, . . . , Sk] by going throughdrounds. At round j, the firstnbits of the round

entry are used as an input to the round functionfj, which produces (k−1)nbits. Those bits are xored to the (k−1)n

last bits of the round entry and the result is rotated bynbits. The first round is represented on Figure 1 below:

I1

X1=I2⊕f₁(1)(I1)

f₁(1) I2

I3⊕f₁(2)(I1) Ik⊕f₁(k−1)(I1)

f₁(2)

I3 _Ik

I1

f₁(k)

Fig. 1.First Round ofFd k

We introduce notation Xj: we denote by Xj the n-bit value produced by round j, which will be the input of next round functionfj+1. We have

X1=I2⊕f₁(1)(I1)

X2=I3⊕f₁(2)(I1)⊕f₂(1)(X1)

. . .

More generally, we can express theXj _recursively:

∀ξ < k, Xξ =Iξ+1⊕f₁(ξ)(I1)⊕ξ_i=2f_i(ξ−i+1)(Xi−1)

∀ξ≥1, Xk+ξ =Xξ⊕k i=2f

(k−i+1)

ξ+i (X ξ+i−1₎

Afterdrounds (d≥k+ 1), the output [S1_{, S}2_{, . . . , S}k_{] can be expressed by using the introduced valuesX}j_:

Sk =Xd−1

Sk−1=Xd−2⊕f_d(k−1)(Xd−1)

Sk−2=Xd−3⊕f_d(₋k−₁1)(Xd−2)⊕f_d(k−2)(Xd−1) . . .

More generally, we can express theSj _recursively:

∀ξ, 1≤ξ≤k−1 Sξ =Xd−1−k+ξ⊕d−1

i=d−k+ξf

(ξ+d−i−1)

i+1 (X

i₎ Inversion of F_kd

For allA1, . . . , Ak∈In, let

σ[A1, A2, . . . , Ak] = [Ak, Ak−1, . . . , A2, A1] We haveσ◦σ =Identity and (F1

k(f

(1) 1 , . . . , f

(k−1)

1 ))−1 =σ◦Fk1(f

(k−1) 1 , . . . , f

(1)

1 ))◦σ. Therefore by composition, we see that the inverse of anFd

k is anotherFkd if we take the k inputs, the koutputs and thed(k−1) functions in the inverse

order:

F_kd(f₁(1), . . . , f₁(k−1), . . . , f_d(1), . . . , f_d(k−1))−1=σ◦F_kd(f_d(k−1), . . . , f_d(1), . . . , f₁(k−1), . . . , f₁(1))◦σ

3

Overview of the Attacks

We investigated several attacks allowing to distinguishF_kd from a random permutation. Depending on the values ofkand dsome attacks are more efficient than others. All our attacks are using sets of plaintext/ciphertext pairs : the sets can be simply couples (for attack TWO) or a rectangle structure with either four plaintext/ciphertext pairs (attack SQUARE) or more (attacks R1, R2, R3, and R4). Depending on the number of rounds, it is possible to find some relations between the input variables and output variables of the pairs of a set. Those relations can appear at random or due to equalities of some internal variables due to the structure of the Feistel scheme.

The TWO attack consists in usingmplaintext/ciphertexts pairs and in counting the numberNFd

k of couples of these

pairs that satisfy the relations between the input and output variables. We then compareN_Fd

k withNperm whereNperm

is the number of couples of pairs for a random permutation instead of F_kd. The attack is successful, i.e. we are able to distinguishF_kd from a random permutation if the difference|E(NFd

k)−E(Nperm)| is much larger than the standard

deviation σperm and than the standard deviation σFd

k, whereE denotes the expectancy function. In order to compute

these values, we need to take into account the fact that the structures obtained from themplaintext/ciphertext tuples are not independent. However their mutual dependence is very small. To computeσperm andσFd

k, we will use this well-known

formula as in [16] that we will call the “Covariance Formula”:

V(Xxi) =

X

i

V(xi) +

X

i6=j

E(xi, xj)−E(xi)E(xj)

where thexi are random variables.

On the case ofFd

k, those conditions will turn into conditions on the internal state variablesXjdue to the structure of the

Feistel scheme. These conditions will imply equations on the outputs. On the case of a random permutation, equations on the outputs will only appear at random. By counting the sets ofϕpairs satisfying the conditions on inputs and outputs, we can distinguish betweenFd

k and a random permutation, since in the case ofFkdthe equations on the outputs appear not

only at random, but a part of them is due to the conditions we set. However, those attacks are not always able to distinguish betweenF_kd and a random permutation, since it requires some internal collision to appear in the structure of the Feistel scheme. For some instances ofF_kd the desired collision will not exist and the attacks will fail. There exists a probability which is a strictly positive constant independent ofnsuch that rectangle structures appear forF_kd. Consequently, in order to verify that we are able to distinguish between the family ofFd

k permutations and the family of random permutations,

we can apply our attacks on several randomly chosen instances ofFd

k or of random permutation, count the number of

instances were the attack is working and compare this number forFd

k and for a random permutation. Attacks R1, R2, R3,

and R4 all share this principle but the conditions imposed on the plaintexts and ciphertexts are different.

The SQUARE attack is a special case of attack R1, when ϕ = 4. In the next sections, we will give more precise definitions of these attacks and examples for attack TWO and attack R1. Finally we will consider attacks with more than 2kn _{computations, i.e. attacks against generators of pseudo-random permutations.}

For a fixed value ofk, attack TWO is very efficient for small values ofd. Whendincreases, first SQUARE, which is a variant of R1, then R1 will become the best known attack. Then, whendincreases again, R2, R3 or R4 will become the best known attack. Finally, for very larged, TWO will become again the best known attack.

Part I:

TWO and Rectangle Attacks on

F

_k

d

with

k

= 3

4

Attacks “TWO” with

k

= 3 and

d

≤

5

In this section, we will describe a family of attacks called “TWO”. These attacks will use correlations on pairs of plain-text/ciphertexts. Therefore, they can be called “2 points” attacks. Whenk= 2 (i.e. on classical balanced Feistel Schemes) these attacks give the best known generic attacks (cf [15]). However these attacks where have not been studied in [6]. As we will see, TWO attacks are more efficient than the attacks of [6] when the number of rounds is very small, or very large but, surprisingly, not when the number of rounds is intermediate.

Remark. We present here TWO only fork= 3 andd≤5. TWO for k= 3 andd≥6 will be presented in Appendix A and TWO for anyk≥3 will be presented in Section 11.

4.1 Attack TWO against F1 3

We just test ifS3=I1. We need one message and about one computation in KPA and CPA-1.

4.2 Attack TWO against F2 3

We will concentrate the attack on the equation:X1_=I2_⊕f(1)

1 (I1), i.e. hereS3=I2⊕f (1) 1 (I1).

– For the CPA-1 attack, we choose two messages such thatI1 _{is constant. Then we test ifS}3_⊕I2 _{is constant. Thus in} CPA-1, we need only 2 messages (and about 2 computations).

– For the KPA attack, we can transform this CPA-1 attack. If we have two indicesi < j such that I1_{(i) =I}1_{(j), then} we test ifS3_(i)⊕S3_{(j) =I}2_(i)⊕I2_{(j). Here, from the birthday paradox, this KPA attack is inO(}√₂n_{) messages and}

4.3 Attack TWO against F3 3

We will concentrate the attack on the equation:S3=I3⊕f₁(2)(I1)⊕f₂(1)(I2⊕f₁(1)(I1)) (since here we haveS3=X2).

– For the CPA-1 attack, we choose two messages such thatI1_andI2_{are constant. Then we test ifS}3_⊕I3 _{is constant.} Thus in CPA-1, we need only 2 messages (and about 2 computations).

– For the KPA attack, we can transform this CPA-1 attack. If we have two indicesi < j such thatI1_{(i) =I}1_{(j) and} I2_{(i) =I}2_{(j), then we test ifS}3_(i)⊕S3_{(j) =I}3_(i)⊕I3_{(j). Here, from the birthday paradox, this KPA requiresO(2}n₎

messages andO(2n_{) computations.}

4.4 Attack TWO against F₃4

CPA-1 Attack

We will concentrate the attack on the equation:S2=X2⊕f₄(2)(S3) (since hereX3=S3) with

X2=I3⊕f₁(2)(I1)⊕f₂(1)(I2⊕f₁(1)(I1)).

For the CPA-1 attack, we will choosemmessages (m'√2n_{) such thatI}1_andI2_{are constant. Therefore for alli, jwe will} have:X2_(i)⊕X2_{(j) =I}3_(i)⊕I3_{(j). Now whenm≥O(}√₂n_{), from the birthday paradox, we know that we will have with a}

good probability at least one (i, j),i < jsuch thatS3_{(i) =S}3_{(j). If this occurs, we will test ifS}2_(i)⊕S2_{(j) =I}3_(i)⊕I3_(j). This appears with probability about ₂1n for a random permutation and with probability 1 on F34 when S3(i) = S3(j), I1_{(i) =I}1_{(j) andI}2_{(i) =I}2_{(j). Thus we have obtained a CPA-1 attack withO(}√₂n_{) messages andO(}√₂n_{) complexity.}

KPA Attack

We can transform this CPA-1 attack in a KPA attack in the usual way: we wait for collisions onI1_,I2_{, andS}3_{, and we} test ifS2_(i)⊕S2_{(j) =I}3_(i)⊕I3_{(j). From the birthday paradox, we will get with a good probability at least one collision} onI1_,I2_{, S}3_whenm2_≥O(23n_{). Therefore the number of messages and the complexity are here inO(2}3n

2 ).

Remark: There is also another KPA attack onF4

3: we just have to count the number ofi < jsuch thatS3(i)⊕S3(j) = I1_(i)⊕I1_{(j). It is possible to prove that there is a small deviation of this value and that this attack also has a complexity} inO(232n) messages and computations. (We do not give the details since it gives the same complexity).

4.5 Attack TWO against F₃5

CPA-1 Attack

We will concentrate the attack on the equation:S1_=X2_⊕f(2)

4 (X3)⊕f (1)

5 (X4), with

X2=I3⊕f₁(2)(I1)⊕f₂(1)(I2⊕f₁(1)(I1)), X4=S3, X3=S2⊕f₅(2)(S3)

For the CPA-1 attack, we will choose mmessages (m '2n_{) such that I}1 _{and I}2 _{are constant. Therefore for all i, j, we} will have:X2_(i)⊕X2_{(j) =I}3_(i)⊕I3_{(j). Now whenm≥O(2}n_{), from the birthday paradox, we know that we will have}

with a good probability at last one (i, j), i < j, such that S2(i) = S2(j) and S3(i) = S3(j). This means here (since S2 = X3⊕f₅(2)(X4) and S3 = X4) that X4(i) = X4(j) and X3(i) = X3(j). If we get such an (i, j), we will test if: S1(i)⊕S1(j) = I3(i)⊕I3(j). This appears with probability about ₂1n for a random permutation and with probability

1 onF5

3, when I1(i) =I1(j), I2(i) =I2(j), S2(i) =S2(j),S3(i) =S3(j). Thus we have obtained a CPA-1 attack with O(2n_{) messages andO(2}n_{) complexity.}

Remark: If we get no such (i, j) for some valueI1 _{and I}2 _{(we then have at most 2}n _{possibilities forI}3_{), we can try} again with some other fixed valuesI1_,I2_{. With a high probability, we will get a solution after only a few tries.}

KPA Attack

Remark: There is also another possible KPA attack onF5

3: we just have to count the number of (i, j),i < isuch that I1_{(i) =I}1_{(j) and X}4_(i)⊕I2_{(i) =X}4_(j)⊕I2_{(j). It is possible to prove that there is a small deviation of this value and} that this attack also has complexity inO(22n_{) messages and computations. (We do not give the details here since it gives}

the same complexity).

5

“SQUARE” Attack on

F

3

We will present here our best attack on F6

3. This attack belongs to a family of attacks that we have called “SQUARE” (‘SQUARE” attacks will be a special case of “R1” attacks when we use only a square of 4 points in the attack. More general description of the SQUARE and R1 attacks will be given below and in Section 13). We haveF6

3[I1, I2, I3] = [S1, S2, S3] with     

S1_=X3_⊕f(2)

5 (X4)⊕f (1) 6 (X5) S2_=X4_⊕f(2)

6 (X5) S3_=X5

with             

X1= I2 ⊕ f₁(1)(I1)

X2= I3 ⊕ f₁(2)(I1) ⊕f₂(1)(X1) X3= I1 ⊕f₂(2)(X1)⊕f₃(1)(X2) X4=X1⊕f₃(2)(X2)⊕f₄(1)(X3) X5=X2⊕f₄(2)(X3)⊕f₅(1)(X4)

Leti1,i2,i3,i4be four indices of messages (so these values are between 1 and m). We will denote by [I1(α), I2(α), I3(α)] the plaintext of message iα, and by [S1(α), S2(α), S3(α)] the ciphertext of message iα. (i.e. for simplicity we use the

notationI1_{(α) andS}1_{(α) instead of I}1_(i

α) and S1(iα), 1≤α≤4). The idea of the attack is to count the number N of

indices (i1, i2, i3, i4) such that:                           

I1_{(1) =I}1₍₂₎ I1_{(3) =I}1₍₄₎

I2_(1)⊕I2_{(2) =I}2_(3)⊕I2₍₄₎ I3_(1)⊕I3_{(2) =I}3_(3)⊕I3₍₄₎ S3_{(1) =S}3₍₂₎

S3_{(3) =S}3₍₄₎ S2_{(1) =S}2₍₂₎ S2(3) =S2(4)

S1(1)⊕S1(2) =S1(3)⊕S1(4) = (f₂(2)(X1(1))⊕f₂(2)(X1(2)))

We will call the 4 first equations the “input equations”, and we will call the 5 last equations the “output equations”.

KPA.

If the messages are randomly chosen we will haveE(N)' m4

29n. (The standard deviationσ(N) can also be computed,

cf Appendix C, however the standard deviation is not needed here since E(N) will be about the double for F6 3). (In attacks TWO the standard deviation will generally beσ(N)'p

E(N), but not in rectangle attacks anymore. However, in rectangle attacks we will generally have σ(N) E(N), and therefore a deviation by a factor of 2 will be enough if E(N)≥1). For aF6

3 permutation we will have about 2 times more solutions since the 5 output equations can occur at random, or due to these 5 internal equations:

          

Therefore here we have:ϕ= 4,a= 2, nI = 4,nS = 5,nX = 5, whereϕdenotes the number of points linked with the

equalities,adenotes the number of equations inXbetween the indices 1 and 3,nI denotes the number of input equations,

nS the number of output equations andnX the number of needed equations inX.

These equations are summarized in figure 2 below.

2 1

I1 X2, X4, X5

X1, X3 X1_{, X}3

4 3

I1 X2, X4, X5

Fig. 2.SQUARE Attack onF6 3

In this figure 2 two points are joined by an edge if the values are equal (for example I1_{(1) = I}1_{(2)). We draw a} solid edge if the probability appears with probability ₂1n and a dotted line if the equality follows conditionally with

probability 1 from other imposed equalities. For example here, from X1_{(1) = X}1_{(3) we get X}1_{(2) = X}1_{(4) (since} X1_(1)⊕X1_(2)⊕X1_(3)⊕X1_{(4) =I}2_(1)⊕I2_(2)⊕I2_(3)⊕I2_{(4) = 0). Similarly}

   

  

X2_{(1) =X}2_{(2) givesX}2_{(3) =X}2₍₄₎ X3_{(1) =X}3_{(3) givesX}3_{(2) =X}3₍₄₎ X4_{(1) =X}4_{(2) givesX}4_{(3) =X}4₍₄₎ X5_{(1) =X}5_{(2) givesX}5_{(3) =X}5₍₄₎

Now sinceS3=X5,S2=X4⊕f₆(2)(X5) andS1=X3⊕f₅(2)(X4)⊕f₆(1)(X5), we get the 5 output equations written above. Therefore, in KPA, for aF6

3 permutation, the expectancy ofN is larger than for a random permutation by a value about

m4

29n (since we have 5 equations inX and 4 inI), i.e. we expect to have about 2 times more solutions forN:E(N)'

2m4 29n

forF6

3. So we will be able to distinguish with a high probability F36 from a random permutation by counting N when

N 6= 0, with high probability i.e. whenm4_≥29n_{, orm≥2}9n

4 . We have found a KPA withO(2 9n

4) complexity andO(2 9n

4 ) messages. (This is better than theO(252n) complexity found in section 3).

CPA-1.

We can transform this KPA in CPA-1. We will choose only two fixed different valuesaandb,a6=bforI1_: m

2 plaintexts will haveI1 =a and m₂ plaintexts will haveI1 =b. Letα be a fixed integer between 0 andn(the best value forαwill be chosen below). We will generate all the possible messages [I1, I2, I3] such thatI1 has the valueaorb, the firstαbits ofI2 are 0, and the firstαbits ofI3 are 0. Therefore we havem= 2·2n−α·2n−α. How many solutions (i1, i2, i3, i4) will satisfy our 4 input equations? For i1 we have m possibilities. Then, when i1 is fixed, for i2 such that I1(2) = I1(1) we have m

2 possibilities, and fori3 such that I

1_(3)6=I1_{(1) we have} m

2 possibilities. Then, when i1,i2, i3 are fixed, we have one and exactly one possibility fori4, sinceI1(4), I2(4) andI3(4) are now fixed from the input equations. Therefore, for (i1, i2, i3, i4) that satisfy our 4 input equations, we have exactly m₄3 solutions. For a random permutation we will have E(N)' m3

4·25n (since we have 5 output equations). For a permutation F

6

3 we will have E(N)'

m3

2·25n, i.e. about 2 times

more solutions, since these 5 output equations can occur at random, or due to 5 internal equations inX, as we have seen. So this CPA-1 will succeed with a high probability whenN 6= 0 with a high probability i.e. whenm≥O(253n). (Therefore we will chooseα'n

6 form'2 5n

Complexity

Here the complexity is inO(m) because we can computeN inO(m). For this we can proceed in 3 steps.

Step 1: we compute all the solutions (i, j) such thatS3_{(i) =S}3_{(j), S}2_{(i) =S}2_{(j) and I}1_{(i) =I}1_{(j). We need here} O(m) computations and we will find about m2

22n '2

4n

3 solutions. We store these solutions in two sets A andB:A with I1_{=a,B withI}1_=b.

Step 2: we computeA0={S1_(i)⊕S1_{(j),(i, j)∈A}andB}0_={S1_(i)⊕S1_{(j),(i, j)∈B}. We have about 2}4n

3 solutions inA0, and 243n solutions inB0.

Step 3: now we look for a common value inA0 andB0. This can be done with 243n computations (and memory), and we will find about (243n)2/2n solutions, i.e.O(253n) solutions. The number of these solutions givesN.

Remark. This attack onF6

3, unlike our attacks onF37,F38,F39, and unlike the TWO attacks of the previous sections can be seen as using only ideas already present in Jutla’s paper [6] (except the fact that we have also designed a KPA, not only a CPA-1).

6

“SQUARE” Attack on

F

3

We will now describe our best attack onF7

3. As we will see, we will obtain here a complexity inO(22n) in CPA-1 and in O(252n) in KPA. This is better than theO(23n) of the TWO attacks. In [6], Jutla shows that he can obtain onFd

k attacks

with complexity less thanO(2kn_{) when d≤3k−3. Ford= 3, this gives attacks up to only 6 rounds, unlike here where}

we will reach 7 rounds with a complexity less than 23n_{. We have F}7

3[I1, I2, I3] = [S1, S2, S3] with 

 

 

S1_=X4_⊕f(2)

6 (X5)⊕f (1) 7 (X6) S2_=X5_⊕f(2)

7 (X6) S3_=X6

with                   

X1_=I2 _{⊕ f}(1) 1 (I1) X2_=I3 _{⊕ f}(2)

1 (I1) ⊕f (1) 2 (X1) X3_=I1 _⊕f(2)

2 (X1)⊕f (1) 3 (X2) X4_=X1_⊕f(2)

3 (X2)⊕f (1) 4 (X3) X5_=X2_⊕f(2)

4 (X3)⊕f (1) 5 (X4) X6_=X3_⊕f(2)

5 (X4)⊕f (1) 6 (X5)

Leti1,i2,i3,i4,i5,i6be six indices of messages (so these values are between 1 andm). We will denote by [I1_{(α), I}2_{(α), I}3_(α)] the plaintext of messageiα, and by [S1(α), S2(α), S3(α)] the ciphertext of messageiα. (i.e. for simplicity we use the

nota-tionI1(α) andS1(α) instead ofI1(iα) andS1(iα), 1≤α≤6). The idea of the attack is to count the numberN of indices

(i1, i2, i3, i4, i5, i6) such that:

                  

I1_{(1) =I}1_{(2) and I}1_{(3) =I}1₍₄₎ I2_(1)⊕I2_{(2) = I}2_(3)⊕I2₍₄₎ I3_(1)⊕I3_{(2) = I}3_(3)⊕I3₍₄₎

and

S3_{(1) =S}3_{(2) andS}3_{(3) =S}3₍₄₎ S2(1) =S2(2) andS2(3) =S2(4)

S1(1)⊕S1(2) = S1(3)⊕S1(4) =I2(1)⊕I2(2)

We will call the 4 first equations the “input equations” and we will call the 6 last equations the “output equations”.

KPA. If the messages are randomly chosen, for a random permutation we will have E(N) ' m4

210n. (The standard

deviationσcan also be computed, cf Appendix C where an example of such a computation is given. However the standard deviation is not needed here sinceE(N) will be about the double for F7

       

      

X1(1) =X1(3) X2(1) =X2(2) X3(1) =X3(2) X4_{(1) =X}4₍₃₎ X5_{(1) =X}5₍₂₎ X6_{(1) =X}6₍₂₎

Therefore here we have:ϕ= 4,a= 2, nI = 4,nS = 6,nX = 6, whereϕdenotes the number of points linked with the

equalities,adenotes the number of equations inXbetween the indices 1 and 3,nI denotes the number of input equations,

nS the number of output equations andnX the number of needed equations inX.

These equations are summarized in figure 3 below.

2 1

I1 X2, X3, X5, X6

X1_{, X}4

X1_{, X}4

4 3

I1 X2, X3, X5, X6

Fig. 3.SQUARE Attack onF37

In this figure 3 (as in figure 2), two points are joined by an edge if the values are equal (for exampleI1(1) =I1(2)). We draw a solid edge if the probability appears with probability ₂1n and a dotted line if the equality follows conditionally

with probability 1 from other imposed equalities. For example here, fromX1(1) = X1(3) we get X1(2) = X1(4) (since X1_(1)⊕X1_(2)⊕X1_(3)⊕X1_{(4) =I}2_(1)⊕I2_(2)⊕I2_(3)⊕I2_{(4) = 0). Similarly}

     

    

X2_{(1) =X}2_{(2) givesX}2_{(3) =X}2₍₄₎ X3_{(1) =X}3_{(2) givesX}3_{(3) =X}3₍₄₎ X4_{(1) =X}4_{(3) givesX}4_{(2) =X}4₍₄₎ X5(1) =X5(2) givesX5(3) =X5(4) X6(1) =X6(2) givesX6(3) =X6(4)

Now sinceS3_=X6_,S2_=X5_⊕f(2)

7 (X6) andS1=X4⊕f (2)

6 (X5)⊕f (1)

7 (X6) withX4=I2⊕f (1) 1 (I1)⊕f

(2)

3 (X2)⊕f (1) 4 (X3), we get the 6 output equations written above. Therefore, in KPA, for aF7

3 permutation, the expectancy ofN is larger than for a random permutation by a value of about ₂m104n (since we have 6 equations inX and 4 in I), i.e. we expect to have

about 2 times more solutions forN: E(N)' 2m4

210n for F37. So we will be able to distinguish with a high probability F37 from a random permutation by countingN whenN 6= 0 with a high probability, i.e. whenm4_≥O(210n_{), orm≥O(2}5n

2). We have found here a KPA withO(252n) complexity andO(2

5n

2 ) messages. This is better than the O(23n) complexity of the attack TWO, and it shows that we can attack 7 rounds, not only 6 with a complexity less than 23n_.

CPA-1

We can transform this KPA in CPA-1. We will choose only 2 fixed different valuesa, b forI1_: m

2 plaintexts will have I1_=aand m

2 plaintexts will haveI

1_{=b. We will generate all (or almost all) possible messages [I}1_{, I}2_{, I}3_{] with such I}1_. Therefore,m= 2·22n_{. How many solutions (i1, i2, i3, i4) will satisfy our 4 input equations? Fori1, we havempossibilities.}

Then, wheni1 is fixed, for i2 such thatI1_{(2) =I}1_{(1), we have} m

2 possibilities. Then for i3, such thatI

equations wheni1,i2,i3are fixed. Therefore for (i1, i2, i3, i4) that satisfy the 4 input equations, we have m 3

4 solutions. For a random permutation we will haveE(N)' m3

4·26n (since we have 6 output equations). For a permutationF37, we will have E(N)' 2m3

4·26n, i.e. about 2 times more solutions, since the 6 output equations can occur at random, or due to 6 internal

equations inX as we have seen. So this CPA-1 will succeed whenN 6= 0 with a high probability, i.e. when m3_≥O(26n_),

orm≥O(22n_{). Here we havem'2·2}2n_{, the probability of success is not negligible. Moreover if it fails for some values}

(a, b) for I1, we can start again with another (a, b). Therefore this CPA-1 is in O(22n) complexity and O(22n) messages. (This is better than theO(23n) attack TWO found in Appendix A).

7

Attack “R2” on

F

3

We will present here our best attack onF8

3. These attacks belong to a family of attacks that we have called “R2”. (A more general description and analysis of the R2 attacks will be given in Section 14). Therefore we present here only the main ideas (our notations and conventions for R2 are similar to those for R1). The ideas of the attack R2 onF₃8is to count the numberN of indices (i1, i2, i3, i4, i5, i6, i7, i8) such that:

                          

I1_{(1) =I}1_{(3) = I}1_{(5) = I}1₍₇₎ I1_{(2) =I}1_{(4) = I}1_{(6) = I}1₍₈₎

I2_(1)⊕I2_{(2) = I}2_{(3) ⊕ I}2_{(4) = I}2_{(5) ⊕ I}2_{(6) = I}2_(7)⊕I2₍₈₎ I3_(1)⊕I3_{(2) = I}3_{(3) ⊕ I}3_{(4) = I}3_{(5) ⊕ I}3_{(6) = I}3_(7)⊕I3₍₈₎

and

S3_{(1) =S}3_{(2) and S}3_{(3) = S}3_{(4) and S}3_{(5) = S}3_{(6) andS}3_{(7) =S}3₍₈₎ S2_{(1) =S}2_{(2) and S}2_{(3) = S}2_{(4) and S}2_{(5) = S}2_{(6) andS}2_{(7) =S}2₍₈₎ S1_(1)⊕S1_{(2) = S}1_{(3) ⊕ S}1_{(4) = S}1_{(5) ⊕ S}1_{(6) = S}1_(7)⊕S1₍₈₎

= I(3)_(1)⊕I(3)_{(2) ⊕ f}(2)

1 (I1(1))⊕f (2) 1 (I1(2))

We will call the 12 first equations the “input equations” and we will call the last 11 equations the “output equations. In the same way as we did for R1 onF6

3 andF37, we can easily prove that the expectancy forN is about double inF38compared with a random permutation, since inF8

3 the 11 output equations can occur at random or due to these 11 equations inX:                   

X1_{(1) =X}1₍₂₎

X2_{(1) =X}2_{(3) =X}2_{(5) =X}2₍₇₎ X3(1) =X3(2)

X4(1) =X4(2)

X5(1) =X5(3) =X5(5) =X5(7) X6(1) =X6(2)

X7_{(1) =X}7₍₂₎

(Remember that hereS3_=X7_,S2_=X6_⊕f(2)

8 (S3) andS1=X5⊕f (2)

7 (X6)⊕f (1) 8 (S3)).

Therefore here we have:ϕ= 8,a= 2, nI = 12,nS = 11,nX= 11, with the usual notations for ϕ, a,nI, nS,nX.

These equations are summarized in figure 4 below.

KPA

If the messages are randomly chosen we will haveE(N)' m8

223n for a random permutation, andE(N)'

2m8 223n forF38 permutations. Therefore with a good probability N 6= 0 (and the attack will succeed) when m ≥O(2238n). (This is less than 23n).

CPA-1

We can transform this KPA in a CPA-1 in the usual way. Here we will choose all the possible (or almost all) I1_{, I}2_, I3 _{such that the} n

2 first bits ofI

1_{are 0. Therefore we have herem= 2}n

2 ·2n·2n= 2 5n

2 possible inputs. HereE(N)' m 8 220 (each collision inI1_{has probability about √}1

2n) for a random permutation andE(N)'

2m8

220n for aF

8

2

1 I

1

X1, X3, X4, X6, X7

X2, X5 I1

X2, X5

4

3 I

1

X1, X3, X4, X6, X7

X2, X5 I1

X2, X5

6

5 I

1

X1, X3, X4, X6, X7

X2, X5 I1

X2, X5

8 7

X1, X3, X4, X6, X7

Fig. 4.R2 Attack onF8 3

we havem=O(252n) so the probability of success is not negligible. (Moreover if we find no solution we can try again by fixingαbits ofI1 _{at 0 different from the firstαbits).}

Remark. On points 1 and 2 we have 5 equations (inX1_{, X}3_{, X}4_,X6_,X7_{). Therefore a necessary condition for the} attack to succeed ism2_≥25n_{. This condition is satisfied here. Similarly, on points 1, 2, 3 we needm}3_≥28n _{in KPA (and}

m3_≥27.5n _{in CPA-1). These conditions are also satisfied here.}

8

Experimental Results

We have implemented the CPA-1 attacks SQUARE and R1 againstF6

3,F37, andF38. The attack againstF36 uses 4 points and 253n plaintexts, the attack againstF₃7 uses 4 points and 22n plaintexts, and the attack againstF₃8 uses 8 points and 22.5n _{plaintexts. Our experiments confirm our ability to distinguish betweenF}6

3 orF37or F38and a random permutation. Our experiments were done as follows:

– choose randomly an instance ofF6

3 orF37or F38

– choose randomly a permutation: for this we use classical balanced Feistel scheme with a large number of rounds (more than 20)

– launch the attack in CPA-1

– count the number of structures satisfying the input and output relations for theF6

3 orF37 orF38permutation and for the permutation

– if this number is higher or equal to a fixed threshold (generally 1 or 2), declare the function to be a F6

3 or F37or F38 permutation and otherwise a random permutation

All these procedures are iterated a large number of time (at least 1000 times) to evaluate the effectiveness of our distin-guisher. We give the percentage of success, i.e. the number ofF36 orF37orF38 that have been correctly distinguished and the percentage of false alarm, i.e. the number of random permutation that have incorrectly been declared asF6

3 orF37 or F8

3.

Table 1.Experimental results for CPA-1 attacks

scheme n threshold Percentage of success of the attack Percentage of false alarm

F6

3 8 2 54% 4%

F37 6 1 33% 1%

F38 6 1 38% 1%

Our experiments show that the distinguisher onF6

9

Why SQUARE, R1 and R2 are worse than TWO on

F

3

,

d

≥

10

TWO is at present our best known attack onF₃d,d≥10. This may look surprising, since SQUARE, R1 and R2 are better ford= 6,7,8 and 9. We will quickly present the main reason why we were not able to find anything better than TWO onF3d, d≥10. Essentially, the problem comes from the fact that with attacks like SQUARE, R1 or R2, we cannot have nX≤nS, when d≥10. Therefore,N is still slightly larger forF3d than for a random permutation, but not by a factor of 2 (or more) anymore. We have computed the advantage obtained (by computing the standard deviationσas explained in Appendix C) but we do not give the details since this gives an attack with a complexity larger than TWO. We have also tried different geometries for the equalities, (withnX ≤nS), but it has given a larger complexity than TWO.

Remark. Alternatively, we can see the problem like this: sincea≥ bd−1

k cwe need at least 3 equations inX between

indices 1 and 2. Therefore, when ϕ is changed in ϕ+ 2, nS becomes nS + 3, but nX becomes at least nX+ 3. When

d≥10, we have to start on a rectangle with nX> nS. Therefore we will have nX > nS for any ϕ. In fact, whend≥10,

whenϕincreases, the probability of existence of the set of equations now decreases fast (instead of being about the same). Therefore smallϕbecome better, andϕ= 2 becomes better thanϕ≥4: TWO becomes again better than SQUARE, R1 and R2.

10

Conclusion for

k

= 3 for TWO and Rectangle Attacks

In Appendices A,B,C we explain how to extend the attack TWO and the rectangle attacks for larger values ofd, and when we want to attack a generator ofFd

3, not only a singleF3d.

Table 2.Results onF3don TWO, SQUARE and Rectangle Attacks. For example forF 7

3, this table means that the best attack that we have found in KPA is the attack R1 and this attack needsm'252nand has a complexity of'2

5

2n computations. Ford≥9

more than one permutation is needed or≥23ncomputations are needed in these attacks.

KPA CPA-1

F31 1 1

F2

3 2

n

2, TWO 2

F33 2n, TWO 2

F34 2

3

2n_{, TWO 2}n2_{, TWO}

F35 2

2n

, TWO 2n, TWO

F36 2

9

4n_{, SQUARE 2}53n_{, SQUARE} F37 2

5

2n_{, SQUARE 2}2n_{, SQUARE} F38 2

23

8n_{, R2,ϕ= 8 2}52n_{, R2,ϕ= 8} F39 2

3n

, R2,ϕ≥10 23n, R2,ϕ≥10

F10

3 27n, TWO 27n, TWO

F311 28n, TWO 28n, TWO

Fd

3,d≥10 2(d

−6+bd

3c)n, TWO 2(d−6+b

d

3c)n, TWO

Part II:

TWO and Rectangle Attacks on

F

_k

d

with

k

≥

3

11

Attacks “TWO” for any

k

≥

3

In this section, we explain the attack TWO. This attack does not use a rectangle but multiple collisions on 2 points (except forF1

k) and is interesting for a small number of rounds or when we are attacking generators.

11.1 Attack TWO against F_k1

We need one message in KPA and CPA-1. We just test ifSk_=I1_.

11.2 Attack TWO against F2

k

For the CPA-1 attack, we have m = 2. We choose two messages such that I1 _{is constant. Then we test if S}k _⊕I2 _is constant. With a random permutation, the probability is ₂1n and withF

2

k the probability is 1.

We transform this attack into a KPA attack. We count the number of (i, j) such that I1(i) =I1(j) and then we test ifSk(i)⊕I2(i) =Sk(j)⊕I2(j). Ifm≥2n2, we can get such collisions and then the attack succeeds.

11.3 Attack TWO against Fd

k, 3≤d≤k

For the CPA-1 attack, we havem = 2 messages again. We chooseI1_{, I}2_{, . . . , I}d−1 _{constant. thenX}1_{, X}2_{, . . . , X}d−2 _will be constant but theXd−1 _{values will be pairwise distinct and ∀i, j, X}d−1_(i)⊕Xd−1_{(j) =I}d_(i)⊕Id_(j).

Then we test ifSk_⊕Id _{is constant. As before with a random permutation, the probability is} 1

2n and one withF

d k.

We transform this attack into a KPA attack. We look fori < j such that:

and then we test ifSk_(i)⊕Id_{(i) =S}k_(j)⊕Id_{(j) . Whenm}2_≥2(d−1)n_{, we can get such collisions and the attack succeeds.}

Thus we havem≥2d−21n and the same complexity.

11.4 Attack TWO against F_kk+1

We will concentrate the attack on the equation:

Sk−1=Xk−1⊕f_k(k₊₁−1)(Xk) with Xk−1=Ik⊕f₁(k−1)(I1)⊕k−1

i=2 f (k−i)

i (X i−1₎

The attack proceeds as follows:

1. We chooseI1_{, I}2_{, . . . , I}k−1_{constant. Then we have that I}1_{, X}1_{, . . . , X}k−2_{are constant and that}

∀i, j, Xk−1(i)⊕Xk−1(j) =Ik(i)⊕Ik(j)

and this implies thati6=j ⇒Xk−1_(i)6=Xk−1_(j).

2. Then, we look for indexesi, j,i6=j such that Sk_{(i) =S}k_{(j). (Here we notice that S}k _=Xk _{sinced=k+ 1). Then}

we test ifSk−1(i)⊕Sk−1(j) =Ik(i)⊕Ik(j). (We have hereSk−1=Xk−1⊕f_k(₊₁k−1)(Sk)). Whenm'√2n_{, we can find}

such collisions and distinguish a random permutation fromF_kk+1 and the complexity is about√2n_.

As previously, we transform this attack into a KPA attack. We need to have k−1 equalities on the variables Ii_,

1≤i≤k−1 and one equality onSk−1_{. So, this attack is possible ifm≥2}kn

2 with the same complexity.

11.5 Attack TWO against F_kk+2

We will concentrate the attack on the equation:

Sk−2=Xk−1⊕f_k(k₊₁−1)(Xk)⊕f_k(k₊₂−2)(Xk+1) with Xk−1=Ik⊕f₁(k−1)(I1)⊕k−1

i=2 f (k−i)

i (X i−1₎

The attack proceeds as follows:

1. We chooseI1, I2, . . . , Ik−1constant. Then we have that I1, X1, . . . , Xk−2are constant and that

∀i, j, Xk−1(i)⊕Xk−1(j) =Ik(i)⊕Ik(j)

and this implies thati6=j ⇒Xk−1_(i)6=Xk−1_(j).

2. Then we look for indexesi, j such thatSk(i) =Sk(j) andSk−1(i) =Sk−1(j). Here, we have the following relations: Sk _=Xk+1_{; sinced=k+ 2}

Sk−1_=Xk_⊕f(k−1)

k+2 (X

k+1₎

Sk−2=Xk−1⊕f_k(k₊₁−1)(Xk)⊕f_k(k₊₂−2)(Xk+1)

So theXk−1 _{are pairwise distinct but we can get a collision (i, j) for theX}k+1 _{variables and theX}k _{variables. Then}

we test if

Sk−2(i)⊕Sk−2(j) =Ik(i)⊕Ik(j)

So whenm2_≥22n_i.e.m≥2n_{, we can get such collisions and the attack follows. We notice that this attack is possible}

since we have the conditionm≤2n _{(only the variablesI}k _{can take all the possible values).}

This attack leads to a KPA attack withm2_≥2(k+1)n_{. This givesm≥2}k+1₂ n_{and this attack is valid since 2}k+1₂ n_≤2kn

11.6 Attack TWO against F_kk+u, 2≤u≤k−1

We will concentrate the attack on the equation;

Sk−u=Xk−1⊕_id₌−_k1f_i(2₊₁k−i−1)(Xi) (here d=k+u)

We will count the numberNof (i, j) such thatI1_{(i) =I}1_{(j), I}2_{(i) =I}2_{(j), . . . , I}k−1_{(i) =I}k−1_(j),Sk_{(i) =S}k_{(j), S}k−1_{(i) =} Sk−1_{(j), . . . , S}k−u+1_{(i) =S}k−u+1_{(j) andS}k−u_(i)⊕Sk−u_{(j) =I}k_(i)⊕Ik_{(j). ForF}k+u

k , this last equation is a consequence

of the other equations, i.e. of thesek−1 equations inI anduequations inS. Therefore, the attack will succeed in KPA whenm2≥2(k+u−1)n, i.e. whenm≥2k+u−2 1n. In CPA-1, we will fix I1, I2, . . . , Ik to some values, and we will do thisα times. The attack will succeed withα= 2(u−2)n and the complexity in CPA-1 is hereα·2n= 2(u−1)n.

12

SQUARE Attacks

We have already seen examples of SQUARE attacks with k = 3. Here we will present SQUARE for any value of k. (Remark: SQUARE attacks are a special case of R1 attacks whenϕ= 4, i.e. when we have a square of only 4 points in the rectangle of equations). Since we have seen some examples of SQUARE attacks, and since we will present in more detail R1 attacks, we will present here only the main ideas and results. We use the same notations as before. In these attacks, we havenX=d−1 equations inX andnS = 2k−1 equations inS. (FornS= 2k−1, we put thek−1 consecutive variables

Xd−1_{, X}d−2_{, . . . , X}d−k+1 _{on the same line). Therefore, we will have: n}

S ≥nX ⇔ d≤2k. Whend≥ 2k+ 1, SQUARE

attacks fail (but more general attacks like R1 attacks may still be valid). Whend≤2k, the SQUARE attack will succeed in KPA if

 



m2_≥2dd₂en _{(condition between points 1 and 2 or 2 and 3 in figure 5 )}

m3_≥2dn _{(condition between points 1, 2, and 3 )}

m4_≥2(d+k)n _{(condition between points 1, 2, 3, 4 )}

The last condition is dominant, therefore whenk+ 2≤d≤2k, we have a complexity of SQUARE in KPA of: 2d+4kn. In CPA-1, the conditions become:

(

m2≥2dd−21en _{(condition between points 1 and 2 or 2 and 3 )} m3_≥2(d−1)n _{(condition between points 1, 2, and 3 )}

The last condition is dominant, therefore whenk+ 2≤d≤2k, we have a complexity of SQUARE in CPA-1 of: 2d−31n.

1 2

I1

b equations inX

a equations inX

4 3

→k equations inI

13

Attacks “R1” for any

k

≥

3 with

d

≥

k

+ 1

We have already seen examples of R1 withk= 3. Here we will present R1 for any value ofk. When k is fixed, for very small values ofd, TWO will be the best known attack. Then, whendincreases, SQUARE and after that R1 will become the best known attack. Then, whend increases again, R2, R3 or R4 that we will see in Section 14 will become the best known attack. Finally, for very larged, TWO will become again the best known attack (see Section 15).

Remark. The idea of R1 is to minimize the total numbernI+nX of needed equations inIandX. When this criteria

is dominant, R1 will be the best attack.

In R1 we will count the numberN of sets of plaintext/ciphertext pairs satisfying some conditions (I) and (S). We use a “rectangle” set of equalities between the coordinates of the input variables [I1(i), . . . , Ik(i)] and between the coordinates of the internal variablesXi(j). We callϕthe number of points of the rectangle, soϕis always greater than or equal to 4 in order to have a rectangle. (Attacks with equalities on only two points are the attacks “TWO”).

13.1 Definition of R1

Let us considerϕ plaintext/ciphertext pairs. The i-th pair is denoted by [I1_{(i), I}2_{(i), . . . I}k_{(i)] for the plaintext and by}

[S1_{(i), S}2_{(i), . . . , S}k_{(i)] for the ciphertext. We will fix some conditions on the inputs of the ϕ pairs. On the case of F}d k,

those conditions will turn into conditions on the internal state variables Xj _{due to the structure of the Feistel scheme.}

This conditions will imply equations on the outputs. On the case of a random permutation, equations on the outputs will only appear at random. By counting the sets ofϕpairs satisfying the conditions on inputs and outputs, we can distinguish betweenFd

k and a random permutation, since in the case ofF d

k the equations on the outputs appear not only at random,

but a part of them is due to the conditions we set.

We first set the following conditions on the input variables:

(I) =

)I

1_{(1) =I}1_{(2) andI}1_{(3) =I}1_{(4) andI}1_{(5) =I}1_{(6). . .andI}1_{(ϕ−1) =I}1_(ϕ)

∀i, 2≤i≤k, Ii_(1)⊕Ii_{(2) =I}i_(3)⊕Ii_{(4) =. . .=I}i_(ϕ−1)⊕Ii_(ϕ)

Conditions on the first blockI1 are here to cancel the impact of functionf1, while conditions on other blocks are used to obtain differential equations on the internal state variables. These equations will then propagate to other rounds with some probability until they turn to equations on the outputs, which then can be detected.

In order for the previous conditions to propagate with high probability, we need some extra conditions on the internal state variables. We haved−2 internal state variablesX1_{, X}2_{, . . . , X}d−2 _andXd−1_=Sk _{is an output variable.}

Letabe an integer, 1≤a≤d−1. We will chooseavalues of{1,2, . . . , d−k}. (Therefore in R1 we have 2 parameters: ϕanda. These values will be optimized depending onkandd). LetE be the set of theseavalues, and letF be the set of all integersi, 1≤i≤d−1 such thati /∈ E. We have|E|=aand|F |=d−a−1. Let (X) be the set of these equalities:

(X) =

∀i∈ E, Xi_{(1) =X}i_{(3) =. . .=X}i_(ϕ−1) ∀i∈ F, Xi_{(1) =X}i₍₂₎

Between two different plaintext/ciphertext pairsiandj,i6=j, we can have at mostk−1 successive equalities on the variablesI1, X1, X2, . . . , Xd−1. Otherwise fromk successive equalities we would getI_i1=I_j1, I_i2=I_j2, . . . , I_ik =I_jk, so the two messages would be the same. Therefore we must have:bd

kc ≤a≤d−1− b d−1

k c. For the same reason we must have {d−k} ∈ E sinced−1,d−2,. . .,d−k+ 1 are inF.

From the conditions (I) and (X) and considering the equalities that we can derive from them with probability one, we will have:

(S) =

∀i, 2≤i≤k, Si_{(1) =S}i_{(2) andS}i_{(3) =S}i_{(4). . .andS}i_{(ϕ−1) =S}i_(ϕ)

Our KPA attack consists in counting the number N of rectangle sets of plaintext/ciphertext pairs satisfying the conditions (I) and (S). The obtained number can be divided into two parts: either the conditions (I) and (S) appear completely at random, or conditions (I) appear and conditions (S) are satisfied because (X) happened.

Figure 5 illustrates one rectangle set of our attack. Plaintext/ciphertext pairs are denoted by 1,2, . . . , ϕ. Two points are joined by an edge if the values are equal (for exampleI1_{(1) =I}1_{(2)). We draw a solid edge if the equality appears with} probability ₂1n and a dotted line if the equality follows conditionally with probability 1 from other imposed equalities.

2 1

I1 _Xi_{, i∈ F X}i_{, i∈ F}

Xi, i∈ E Xi, i∈ E

Xi, i∈ E 4 Xi, i∈ E

3

I1

6 5

I1

. . .

. . .

I1

ϕ ϕ−1

Fig. 6.Attack R1 onFd k

13.2 Properties of R1

We will denote bynI the number of equalities in (I), and bynS the number of equalities in (S). Similarly, we will denote

bynX the number of equalities in (X). ThereforenX is the number of independent equalities in theXi variables needed

in order to get (S) from (I). In this attack R1 we have:  



·nI = kϕ₂ −k+ 1 ·nS = kϕ₂ −1

·nX =a(ϕ₂ −2) +d−1

The valueN is expected to be larger for aF_kd than for a random permutation due to the fact that (S) can come from random reasons or from (X) inF_kd. Therefore, it is natural, in order to get necessary and sufficient condition of success for R1, to evaluate the expectancy and the standard deviation ofN in the case ofFd

k and in the case of random permutations.

This can be done (by using the covariance formula as in [16] or by using approximation as in [6]), and in fact we did it. We have found that each time that R1 was better than TWO, we hadnX ≤nS. However, whennX≤nS we can easily obtain

sufficient condition of success for R1 without computing the standard deviations, since whennX ≤nS we will have for

most permutations about 2 times more (or more) solutions withFd

k than this random permutation. Therefore, a sufficient

condition of success for R1 whennX ≤nS is to have that (X) and (I) can be satisfied with a non negligible probability.

A sufficient condition for this is to have:

In KPA

Condition 1:nX ≤nS.

Condition 2:mϕ_≥2n(nI+nX)_.

Condition 3:m2_≥2(d−a)n_.

Condition 4:m3≥2dnand more generally∀i, 0≤i≤ ϕ₂ −1,m3+i≥2(d+ia)n. Condition 5:m4≥2(d+k)n.

Condition 2 comes from the fact that we have aboutmϕ _{rectangles withϕpoints, and the probability that (I) and}

(X) are satisfied on one rectangle is ₂n(nI1+nX).

Condition 3 comes from the fact that between points 1 and 2 we have |F |equations in Xi, and one equation in I1. Therefore in KPA we must havem2≥2(|F|+1)n= 2(d−a)n.

Condition 4 comes from the fact that between points 1, 2 and 3 we have d−1 equations inXi_{, and one equation in}

I1_{. Therefore we must havem}3_≥2dn_{. Similarly between the points 1, 2, 3, 5, we must have:m}4_≥2(d+a)n_{. And similarly}

between the points 1, 2, 3, 5, 7,. . ., (ϕ−1), we must have:mϕ2+1≥2(d+a(

ϕ

2−2))n.

Condition 5 comes from the fact that between points 1, 2, 3, 4, we have d−1 equations inXi_{, 2 equations in I}1_and (k−1) inI2_,I3_{,. . .,I}k−1_.

It is easy to see that the conditions on any points are consequences of these 5 conditions. Moreover, if m≥2an (we will often, but not always, choosealike this), condition 4 can be changed with onlym3≥2dn.

CPA-1

In CPA-1 the sufficient conditions whenm≤2(k−1)n are: Condition 1:nX ≤nS.

Condition 2:m(ϕ₂+1)_≥2n·nX_.

Condition 3:m2≥2(d−a−1)n.

Condition 4 and Condition 5:m3_≥2(d−1)n_.

From these conditions we can compute the best parametersaandϕfor anydandk, whendandkare fixed.

Remark. If we choosenX < nS (instead ofnX ≤nS), the attacks are slightly less efficient but more spectacular since

with a non negligible probability (I) and (S) are satisfied with Fd

k and not with random permutations. Moreover with

nX< nS it is still possible (with R2) to attack 3k−1 rounds with less than 2kn complexity. Example 1

ForF₃7 in KPA we see from condition 5 thatm≥252n, and for F7

3 in CPA-1 we see from condition 4 that m≥2 2n_.

Since we have seen that witha= 2 andϕ= 6 these bounds are obtained, it shows thata= 2 andϕ= 6 give the optimal R1 attack onF37.

Example 2

Whendis small, in R1, condition 2 is the dominant condition. By definition, we denote byAandB the integers such that whenA≤d≤B, condition 2 dominates in R1, and R1 is better than TWO. In order to havenI+nX minimum, i.e. kϕ

2 −k+a(

ϕ

2−2) +dminimum, we will chooseaminimum andϕminimum. Therefore, we will choosea=b

d

kcand from

condition 1 we get that the minimum value forϕisϕ=2_kd−₋4_aa, and then we havenX=nS.

Then the complexity in KPA given by condition 2 gives:m≥2(k−ϕk)n, withϕ= 2d−4a

k−a , witha=b d kc.

In CPA-1 a similar computation gives a complexity in 2(k−1)(1−α)n with α= _kϕ−2_ϕk−₊₂ϕ_k−2 andϕ= 2d_k−₋4_aa.

These are the best parameters and complexities for R1, whendis not too large (i.e. when condition 2 is dominant).

14

“R2”, “R3”, “R4” Attacks for any

k

≥

3 with

d

≥

k

R2, R3, and R4 attacks are very similar to attack R1 but the conditions on the variables are not the same.

14.1 R2 attacks

In the R2 attack, we will chooseavalues of {1,2, . . . , d−k}. Let E be the set of these a values, and letF be the set of all integersi, 1 ≤i≤ d−1 such that i /∈ E. We have |E|=a, |F |=d−a−1, andF contains all the k−1 valuesi, d−k+ 1≤i≤d−1. For R2 we have:

(I) =  



I1(1) =I1(3) =I1(5) =. . .=I1(ϕ−1) I1(2) =I1(4) =I1(6) =. . .=I1(ϕ)

(X) =

∀i∈ E, Xi(1) =Xi(3) =. . .=Xi(ϕ−1)

∀i∈ F, Xi(1) =Xi(2)

(S) =

∀i,2≤i≤k, Si_{(1) =S}i_{(2), S}i_{(3) =S}i_{(4), . . . , S}i_{(ϕ−1) =S}i_(ϕ)

S1_(1)⊕S1_{(2) =S}1_(3)⊕S1_{(4) =. . .=S}1_(ϕ−1)⊕S1_(ϕ)

The equations (X) have been chosen such that (S) is just a consequence of (I) and (X). Our attacks consist in counting the numberN of rectangle sets of plaintext/ciphertext pairs satisfying the conditions (I) and (S). Figure 3 illustrates the equations for R2.

2

1 I

1

Xi, i∈ F

I1

Xi, i∈ E

Xi, i∈ E

4

3 I

1

Xi, i∈ F

I1

Xi, i∈ E

Xi, i∈ E

6 5

Xi, i∈ F

ϕ ϕ−1

Fig. 7.Attack R2 onFkd

Between two different plaintext/ciphertext pairsiandj,i6=j, we can have at mostk−1 successive equalities on the variablesI1,X1, . . .,Xd−1. Therefore, for R2, we havebd−1

k c ≤a≤d−1− b d kc, and

 



nI = kϕ₂ +ϕ₂ −k−1

nS = kϕ₂ −1

nX =a(ϕ₂ −2) +d−1

As we have explained for R1, sufficient conditions of success for R2 in KPA are the following 5 conditions: Condition 1:nX ≤nS.

Condition 2:mϕ_≥2n(nI+nX)_.

Condition 3:m3_≥2dn_.

Condition 4:m2_≥2(d−a−1)n_.

Condition 5:m4_≥2(d+k)n_. Example for R2

In the R2 attack onF₃8, we have:ϕ= 8, a= 2,nI = 12,nS = 11 andnX = 11.

14.2 R3 Attack

In the R3 attack, we set the following conditions on the input variables:

(I) =

I1_{(1) =I}1_{(2), I}1_{(3) =I}1_{(4), I}1_{(5) =I}1_{(6), . . . , I}1_{(ϕ−1) =I}1_(ϕ)

∀i, 2≤i≤k, Ii_(1)⊕Ii_{(2) =I}i_(3)⊕Ii_{(4) =. . .=I}i_(ϕ−1)⊕Ii_(ϕ)

Then the conditions on the internal variables (with|E|=d−a−1 and|F |=aand ifd−k+ 2≤i≤d−1 theni∈ F) are:

(X) =

∀i∈ E, Xi_{(1) =X}i₍₂₎

Finally, the conditions on the output variables are given by:

(S) =    

  

S1_(1)⊕S1_{(2) =S}1_(3)⊕S1_{(4) =. . .=S}1_(ϕ−1)⊕S1_(ϕ) S2_(1)⊕S2_{(2) =S}2_(3)⊕S2_{(4) =. . .=S}2_(ϕ−1)⊕S2_(ϕ)

∀i,3≤i≤k, S1(1) =S1(3) =S1(5) =. . .=S1(ϕ−1)

∀i,3≤i≤k, S1(2) =S1(4) =S1(6) =. . .=S1(ϕ) Then, the R3 attack proceeds exactly the same as R1 and R2 attacks.

14.3 R4 Attack

In the R4 attack, we have the following conditions on the input, internal and output variables:

(I) =  



I1(1) =I1(3) =I1(5) =. . .=I1(ϕ−1) I1(2) =I1(4) =I1(6) =. . .=I1(ϕ)

∀i,2≤i≤k, Ii_(1)⊕Ii_{(2) =I}i_(3)⊕Ii_{(4) =. . .=I}i_(ϕ−1)⊕Ii_(ϕ)

(X) =

∀i∈ E, Xi(1) =Xi(2)

∀i∈ F, Xi(1) =Xi(3) =. . .=Xi(ϕ−1)

(with|E|=d−a−1 and|F |=aand ifd−k+ 3≤i≤d−1 theni∈ F)

(S) =      

    

S1_(1)⊕S1_{(2) =S}1_(3)⊕S1_{(4) =. . .=S}1_(ϕ−1)⊕S1_(ϕ) S2_(1)⊕S2_{(2) =S}2_(3)⊕S2_{(4) =. . .=S}2_(ϕ−1)⊕S2_(ϕ) S3_(1)⊕S3_{(2) =S}3_(3)⊕S3_{(4) =. . .=S}3_(ϕ−1)⊕S3_(ϕ)

∀i,4≤i≤k, S1_{(1) =S}1_{(3) =S}1_{(5) =. . .=S}1_(ϕ−1)

∀i,4≤i≤k, S1_{(2) =S}1_{(4) =S}1_{(6) =. . .=S}1_(ϕ)

Example for R4

We will now present how to attack F_k3k−1 when k ≥5 with a complexity less than 2kn_{. This example is interesting}

since 3k−1 is the maximum number of rounds that we can attack with a complexity lower than 2kn _{(ford = 3k the}

complexity of the best known attacks becomeO(2kn_{) and ford≥3k+ 1 we need more thanO(2}kn_{) computations). It is}

also interesting since in [6] Jutla was able to attack only 3k−3 rounds with a complexity less than 2kn_{. We will present}

only the main ideas. We will use the attack R4 witha=k−1, i.e. between 1 and 3 we have thesek−1 equations:Xd−1_, Xd−2_{, . . .,X}d−k+3_{, plusX}k _andX2k_.

Remark. With R2 (but not with R1) we can also attackF_k3k−1 (withϕ= 2k+ 2 and a=k−1) with a complexity less than 2kn_{, but the complexity of R4 will be slightly better.}

In R4 witha=k−1, we have:

 



nI =kϕ₂ +ϕ₂ −k−1

nS =kϕ−3₂ϕ−2k+ 3

nX= kϕ2 +d−2k−

ϕ

2 + 1

Therefore whend= 3k−1, we havenX = kϕ₂ +k−ϕ₂. nX ≤nS givesϕ≥6 +_k−6₂. For k≥5, this meansϕ≥8 (ϕis

always even). Now if we look at all the 5 conditions for the complexity, these conditions give:m≥2(k−1

8)n in KPA, and m≥2(k−12)n in CPA-1. These complexities are less than 2kn as claimed.

15

Conclusion for

k

≥

3 for TWO and Rectangle attacks