Optimum Attack on 3-Round Feistel-2 Structure

Abstract

Feistel-2 structure is a variant of Feistel structure such that the $i^{th}$ round function is given by $\mathrm {F}_i(k_i \oplus x)$, where $\mathrm {F}_i$ is a public random function and $k_i$ is a key of n/2 bits. Lampe and Seurin showed that 3-round Feistel-2 structure is secure if $D+T \ll 2^{n/4}$ (which is equivalent to $D \ll 2^{n/4}$ and $T \ll 2^{n/4}$), where D is the number of queries to the encryption oracle and T is the number of queries to each $\mathrm {F}_i$ oracle. On the other hand, only the meet-in-the-middle attack is known for 3-round Feistel-2 structure which works only for $(D,T)=(O(1), O(2^{n/2}))$ with $O(2^{n/2})$ amount of memory.

In this paper, we first show that 3-round Feistel-2 structure is broken by a key recovery attack if $DT \ge 2^{n/2}$ (which requires $O(D+T)$ amount of memory). Since it works for $D=T=O(2^{n/4})$, this attack proves that the security bound of Lampe and Seurin is tight at $D=T=O(2^{n/4})$. We next present a memoryless key recovery attack for $(D,T)=(O(1), O(2^{n/2}))$. We finally show a memoryless key recovery attack for $D=O(2^{n/4})$ and $T=O(2^{n/4})$.