Impossible Boomerang Attack for Block Cipher Structures [chapter]

Jiali Choy, Huihui Yap
2009 Lecture Notes in Computer Science  
Impossible boomerang attack [5] (IBA) is a new variant of differential cryptanalysis against block ciphers. Evident from its name, it combines the ideas of both impossible differential cryptanalysis and boomerang attack. Though such an attack might not be the best attack available, its complexity is still less than that of the exhaustive search. In impossible boomerang attack, impossible boomerang distinguishers are used to retrieve some of the subkeys. Thus the security of a block cipher
more » ... t IBA can be evaluated by impossible boomerang distinguishers. In this paper, we study the impossible boomerang distinguishers for block cipher structures whose round functions are bijective. Inspired by the U-method in [3], we provide an algorithm to compute the maximum length of impossible boomerang distinguishers for general block cipher structures, and apply the algorithm to known block cipher structures such as Nyberg's generalized Feistel network, a generalized CAST256-like structure, a generalized MARS-like structure, a generalized RC6-like structure, etc. Proof. Referring to Table 3 , we know that M is the maximum length considering all 26 cases. Case δ000: Case δ0γγ: M δ0γγ = max 1≤i≤n {ME i (1, 0) + MD i (1 * )}. Since ME i (1, 0) ≤ min{ME i (1), ME i (0)}, Case γ(γδ)00: M γ(γδ)00 = max 1≤i≤n {ME i (1 * , 2 * )+MD i (0)}. Since ME i (1 * , 2 * ) ≤ min{ME i (1 * ), ME i (2 * )}, Case γγ(γδ)0: M γγ(γδ)0 = max 1≤i≤n {ME i (1 * )+MD i (2 * , 0)}. Since MD i (2 * , 0) ≤ min{MD i (2 * ), MD i (0)}, Case (γδ)0γγ: M (γδ)0γγ = max 1≤i≤n {ME i (2 * , 0)+MD i (1 * )}. Since ME i (2 * , 0) ≤ min{ME i (2 * ), ME i (0)}, M (γδ)0γγ ≤ max 1≤i≤n {ME i (0) + MD i (1 * )} = M 4 .
doi:10.1007/978-3-642-04846-3_3 fatcat:rzzxtrxfwbcqba7ojgyqtx5k5a