
For FullText PDF, please login, if you are a member of IEICE,
or go to Pay Per View on menu list, if you are a nonmember of IEICE.

On the Security of Feistel Ciphers with SPN Round Function against Differential, Linear, and Truncated Differential Cryptanalysis
Masayuki KANDA Tsutomu MATSUMOTO
Publication
IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences
Vol.E85A
No.1
pp.2537 Publication Date: 2002/01/01 Online ISSN:
DOI: Print ISSN: 09168508 Type of Manuscript: Special Section PAPER (Special Section on Cryptography and Information Security) Category: Keyword: security evaluation, differential cryptanalysis, linear cryptanalysis, truncated differential cryptanalysis,
Full Text: PDF(335.7KB)>>
Summary:
This paper studies security of Feistel ciphers with SPN round function against differential cryptanalysis, linear cryptanalysis, and truncated differential cryptanalysis from the "designer's standpoint." In estimating the security, we use the upper bounds of differential characteristic probability, linear characteristic probability and truncated differential probability, respectively. They are useful to design practically secure ciphers against these cryptanalyses. Firstly, we consider the minimum numbers of differential and linear active sboxes. They provide the upper bounds of differential and linear characteristic probability, which show the security of ciphers constructed by sboxes against differential and linear cryptanalysis. We clarify the (lower bounds of) minimum numbers of differential and linear active sboxes in some consecutive rounds of the Feistel ciphers by using differential and linear branch numbers, P_{d}, P_{l}, respectively. Secondly, we discuss the following items on truncated differential probability from the designer's standpoint, and show how the following items affect the upper bound of truncated differential probability; (a) truncated differential probability of effective activesbox, (b) XOR cancellation probability, and (c) effect of auxiliary functions. Finally, we revise Matsui's algorithm using the above discussion in order to evaluate the upper bound of truncated differential probability, since we consider the upper bound of truncated differential probability as well as that of differential and linear probability.


