000256132 001__ 256132
000256132 005__ 20190812210026.0
000256132 0247_ $$2doi$$a10.1007/978-3-319-93387-0_23
000256132 037__ $$aCONF
000256132 245__ $$aGeneric Round-Function-Recovery Attacks for Feistel Networks over Small Domains
000256132 260__ $$c2018
000256132 269__ $$a2018
000256132 336__ $$aConference Papers
000256132 520__ $$aFeistel Networks (FN) are now being used massively to encrypt credit card numbers through format-preserving encryption. In our work, we focus on FN with two branches, entirely unknown round functions, modular additions (or other group operations), and when the domain size of a branch (called $N$) is small. We investigate round-function-recovery attacks. The best known attack so far is an improvement of Meet-In-The-Middle (MITM) attack by Isobe and Shibutani from ASIACRYPT~2013 with optimal data complexity $q=r \frac{N}{2}$ and time complexity $N^{ \frac{r-4}{2}N + o(N)}$, where $r$ is the round number in FN. We construct an algorithm with a surprisingly better complexity when $r$ is too low, based on partial exhaustive search. When the data complexity varies from the optimal to the one of a codebook attack $q=N^2$, our time complexity can reach $N^{O \left( N^{1-\frac{1}{r-2}} \right) }$. It crosses the complexity of the improved MITM for $q\sim N\frac{\mathrm{e}^3}{r}2^{r-3}$. We also estimate the lowest secure number of rounds depending on $N$ and the security goal. We show that the format-preserving-encryption schemes FF1 and FF3 standardized by NIST and ANSI cannot offer 128-bit security (as they are supposed to) for $N\leq11$ and $N\leq17$, respectively (the NIST standard only requires $N \geq 10$), and we improve the results by Durak and Vaudenay from CRYPTO~2017.
000256132 700__ $$aDurak, F. Betül
000256132 700__ $$aVaudenay, Serge$$0241950$$g131602
000256132 7112_ $$aApplied Cryptography and Network Security (ACNS)
000256132 8560_ $$ffatih.balli@epfl.ch
000256132 85641 $$yACNS Version$$uhttps://link.springer.com/chapter/10.1007%2F978-3-319-93387-0_23
000256132 909C0 $$xU10433$$pLASEC$$mfatih.balli@epfl.ch$$0252183
000256132 909CO $$qGLOBAL_SET$$pconf$$pIC$$ooai:infoscience.epfl.ch:256132
000256132 960__ $$afatih.balli@epfl.ch
000256132 961__ $$afantin.reichler@epfl.ch
000256132 973__ $$aEPFL$$rREVIEWED
000256132 980__ $$aCONF
000256132 981__ $$aoverwrite