Revisiting Impossible Differential Distinguishers of Two Generalized Feistel Structures

Impossible differential attack is one of the most effective cryptanalytic methods for block ciphers. Its key step is to construct impossible differential distinguishers as long as possible. In this paper, we mainly focus on constructing longer impossible differential distinguishers for two kinds of generalized Feistel structures which are <math xmlns="http://www.w3.org/1998/Math/MathML" id="M1"> <mi>m</mi> </math> -dataline CAST256-like and MARS-like structures. When their round function takes Substitution Permutation <math xmlns="http://www.w3.org/1998/Math/MathML" id="M2"> <mfenced open="(" close=")" separators="|"> <mrow> <mtext>SP</mtext> </mrow> </mfenced> </math> and Substitution Permutation Substitution <math xmlns="http://www.w3.org/1998/Math/MathML" id="M3"> <mfenced open="(" close=")" separators="|"> <mrow> <mtext>SPS</mtext> </mrow> </mfenced> </math> types, they are called <math xmlns="http://www.w3.org/1998/Math/MathML" id="M4"> <mrow> <mtext>CAST</mtext> <msub> <mrow> <mn>256</mn> </mrow> <mrow> <mtext>SP</mtext> </mrow> </msub> </mrow> <mo>/</mo> <mrow> <mtext>CAST</mtext> <msub> <mrow> <mn>256</mn> </mrow> <mrow> <mtext>SPS</mtext> </mrow> </msub> </mrow> </math> and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M5"> <mrow> <msub> <mrow> <mtext>MARS</mtext> </mrow> <mrow> <mtext>SP</mtext> </mrow> </msub> </mrow> <mo>/</mo> <mrow> <msub> <mrow> <mtext>MARS</mtext> </mrow> <mrow> <mtext>SPS</mtext> </mrow> </msub> </mrow> </math> , respectively. For <math xmlns="http://www.w3.org/1998/Math/MathML" id="M6"> <mrow> <mtext>CAST</mtext> <msub> <mrow> <mn>256</mn> </mrow> <mrow> <mtext>SP</mtext> </mrow> </msub> </mrow> <mo>/</mo> <mrow> <mtext>CAST</mtext> <msub> <mrow> <mn>256</mn> </mrow> <mrow> <mtext>SPS</mtext> </mrow> </msub> </mrow> </math> , the best known result for the length of the impossible differential distinguisher was <math xmlns="http://www.w3.org/1998/Math/MathML" id="M7"> <mrow> <mfenced open="(" close=")" separators="|"> <mrow> <msup> <mrow> <mi>m</mi> </mrow> <mrow> <mn>2</mn> </mrow> </msup> <mo>+</mo> <mi>m</mi> </mrow> </mfenced> </mrow> <mo>/</mo> <mrow> <mfenced open="(" close=")" separators="|"> <mrow> <msup> <mrow> <mi>m</mi> </mrow> <mrow> <mn>2</mn> </mrow> </msup> <mo>+</mo> <mi>m</mi> <mo>−</mo> <mn>1</mn> </mrow> </mfenced> </mrow> </math> rounds, respectively. With the help of the linear layer <math xmlns="http://www.w3.org/1998/Math/MathML" id="M8"> <mi>P</mi> </math> , we can construct <math xmlns="http://www.w3.org/1998/Math/MathML" id="M9"> <mrow> <mfenced open="(" close=")" separators="|"> <mrow> <msup> <mrow> <mi>m</mi> </mrow> <mrow> <mn>2</mn> </mrow> </msup> <mo>+</mo> <mi>m</mi> <mo>+</mo> <msub> <mi mathvariant="normal">Λ</mi> <mrow> <mn>0</mn> </mrow> </msub> </mrow> </mfenced> </mrow> <mo>/</mo> <mrow> <mfenced open="(" close=")" separators="|"> <mrow> <msup> <mrow> <mi>m</mi> </mrow> <mrow> <mn>2</mn> </mrow> </msup> <mo>+</mo> <mi>m</mi> <mo>+</mo> <msub> <mi mathvariant="normal">Λ</mi> <mrow> <mn>1</mn> </mrow> </msub> </mrow> </mfenced> </mrow> </math> -round impossible differential distinguishers, where <math xmlns="http://www.w3.org/1998/Math/MathML" id="M10"> <msub> <mi mathvariant="normal">Λ</mi> <mrow> <mn>0</mn> </mrow> </msub> </math> and <math xmlns="http://www.w3.org/1998/Math/MathML" id="M11"> <msub> <mi mathvariant="normal">Λ</mi> <mrow> <mn>1</mn> </mrow> </msub> </math> are non-negative numbers if <math xmlns="http://www.w3.org/1998/Math/MathML" id="M12"> <mi>P</mi> </math> satisfies some restricted conditions. For <math xmlns="http://www.w3.org/1998/Math/MathML" id="M13"> <msub> <mrow> <mtext>MARS</mtext> </mrow> <mrow> <mtext>SPS</mtext> </mrow> </msub> </math> , the best known result for the length of the impossible differential distinguisher was <math xmlns="http://www.w3.org/1998/Math/MathML" id="M14"> <mfenced open="(" close=")" separators="|"> <mrow> <mn>3</mn> <mi>m</mi> <mo>−</mo> <mn>1</mn> </mrow> </mfenced> </math> rounds. We can construct <math xmlns="http://www.w3.org/1998/Math/MathML" id="M15"> <mn>3</mn> <mi>m</mi> </math> -round impossible differential distinguishers which are 1 round longer than before. To our knowledge, the results in this paper are the best for the two kinds of generalized Feistel structures.