On Quantum Distinguishers for Type-3 Generalized Feistel Network Based on Separability

Abstract

In this work, we derive a method for constructing quantum distinguishers for GFNs (Generalized Feistel-like schemes with invertible inner functions and XORs), where for simplicity 4 branches are considered. The construction technique is demonstrated on Type-3 GFN, where some other cyclically inequivalent GFNs are considered as examples. Introducing the property of separability, we observe that finding a suitable partition of input blocks implies that some branches can be represented as a sum of functions with almost disjoint variables, which simplifies the application of Simon’s algorithm. However, higher number of rounds in most of the cases have branches which do not satisfy the previous property, and in order to derive a quantum distinguisher for these branches, we employ Simon’s and Grover’s algorithm in combination with a suitable system of equations given in terms of input blocks and inner functions involved in the round function. As a result, we are able to construct a 5-round quantum distinguisher for Type-3 GFNs using only a quantum encryption oracle with query complexity $2^{N/4}\cdot \mathcal {O}(N/4)$, where N size of the input block.

A Appendix

1.1 A.1 Experimental Results Related to System (9)

In Table 1 we consider the number of pairs $(\beta ,\gamma )$ which are implying the periodicity of f exactly in $s=F_3(\alpha ^{(2)}_0)\oplus F_3(\alpha ^{(2)}_1)$, where f is given by (11) as

$$\begin{aligned} f(b,x)=\left\{ \begin{array}{ll} g_{00}(x)=RF^{(4)}_5(\alpha ^{(0)},\alpha ^{(1)},\alpha ^{(2)}_0,x), &{} b=0, \\ g_{10}(x)=(\alpha ^{(0)}\oplus \beta )\oplus RF^{(4)}_5(\beta ,\gamma ,\alpha ^{(2)}_1,x), &{} b=1. \end{array} \right. \end{aligned}$$

(14)

We take that $F^r_i$ are defined by $F^r_i(x)=S(x\oplus k^r_i)$, $x\in \mathbb {F}^n_2$, with S being the S-box used in TWINE [26] ($n=4$) and SMS4 [20] ($n=8$). Since we are considering only 5 rounds, the keys supplied to inner functions $F^r_i$ are taken to be arbitrary, and thus we are considering in total $5\times 3=15$ random keys (effectively it is needed $4\times 3$, since $RF^{(1)}_4=RF^{(4)}_5$). In addition, with respect to these random sets of keys, we are also taking random quadruples $(\alpha ^{(0)},\alpha ^{(1)},\alpha ^{(2)}_0,\alpha ^{(2)}_0)$.

Table 1. The number of pairs $(\beta ,\gamma )$ that imply a periodic function f given by (14).

We notice that for different random key sets, one may obtain the same pairs of $(\beta ,\gamma )$, or eventually the first/second values are equal. Unfortunately, we did not find why in almost all cases one obtains exactly 2 different pairs of $(\beta ,\gamma )$. In rare cases, for the TWINE S-box, for certain instances of keys and quadruples $(\alpha ^{(0)},\alpha ^{(1)},\alpha ^{(2)}_0,\alpha ^{(2)}_0)$ there exist 16 pairs $(\beta ,\gamma )$ which imply periodicity of f. However, recall that this is a weak setting of the inner functions $F^r_i$ considered only on 5 rounds (if one would relate these to the presence of weak keys).