New impossible differential attack on SAFER+ and SAFER++

Authors:
Jingyuan Zhao;Meiqin Wang;Jiazhe Chen;Yuliang Zheng
Affiliations:
Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China,School of Mathematics, Shandong University, Jinan, China;Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China,School of Mathematics, Shandong University, Jinan, China;Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China,School of Mathematics, Shandong University, Jinan, China;Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan, China,School of Mathematics, Shandong University, Jinan, China,Department of S ...
Venue:
ICISC'12 Proceedings of the 15th international conference on Information Security and Cryptology
Year:
2012

Citing 3
Cited 0

Linear Cryptanalysis of Reduced-Round Versions of the SAFER Block Cipher Family

FSE '00 Proceedings of the 7th International Workshop on Fast Software Encryption
A new impossible differential attack on SAFER ciphers

Computers and Electrical Engineering
Cryptanalysis of Skipjack reduced to 31 rounds using impossible differentials

EUROCRYPT'99 Proceedings of the 17th international conference on Theory and application of cryptographic techniques

Quantified Score

Hi-index	0.00

Visualization

Abstract

SAFER+ was a candidate block cipher for AES with 128-bit block size and a variable key sizes of 128, 192 or 256 bits. Bluetooth uses customized versions of SAFER+ for security. The numbers of rounds for SAFER+ with key sizes of 128, 192 and 256 are 8, 12 and 16, respectively. SAFER++, a variant of SAFER+, was among the cryptographic primitives selected for the second phase of the NESSIE project. The block size is 128 bits and the key size can take either 128 or 256 bits. The number of rounds for SAFER++ is 7 for keys of 128 bits, and 10 for keys of 256 bits. Both ciphers use PHT as their linear transformation. In this paper, we take advantage of properties of PHT and S-boxes to identify 3.75-round impossible differentials for SAFER++ and 2.75-round impossible differentials for SAFER+, which result in impossible differential attacks on 4-round SAFER+/128(256), 5-round SAFER++/128 and 5.5-round SAFER++/256. Our attacks significantly improve previously known impossible differential attacks on 3.75-round SAFER+/128(256) and SAFER++/128(256). Our attacks on SAFER+/128(256) and SAFER++/128(256) represent the best currently known attack in terms of the number of rounds.