How Much Can Complexity of Linear Cryptanalysis Be Reduced?

Abstract

The linear cryptanalysis proposed by Matsui is one of the most effective attacks on block ciphers, and he demonstrated an experimental cryptanalysis against DES at CRYPTO 1994. In this paper, we show how to optimize the linear cryptanalysis on modern microprocessors. Nowadays, there are two methods of implementing the linear cryptanalysis. Method 1 reduces the time complexity by reducing the number of computations of round functions, and Method 2 applies the fast Fourier transform (FFT). We implement both methods optimized for modern microprocessors and compare them in terms of computation time so as to discover which method is more appropriate for practical cryptanalysis. From the results of comparative experiments, we show that the fastest implementation depends on the number of given known plaintexts (KPs) and that of guessed key bits. These results clarify the criteria for selecting the method to implement the linear cryptanalysis. Taking the experimental results into account, we implement the linear cryptanalysis on FEAL-8X. In 2014, Biham and Carmeli showed an implementation of linear cryptanalysis that was able to recover the secret key with $2^{14}$ KPs. Our implementation breaks FEAL-8X with $2^{12}$ KPs and is the best attack on FEAL-8X in terms of data complexity.

A Six-Round Linear Approximations

We utilize eight six-round linear approximations to attack FEAL-8X (see Fig. 6). Figure 6 shows the linear approximations, where $\mathrm \Gamma X_3 = \Gamma Y_3 = \mathtt{0x00000000}$, $\mathrm \Gamma Y_2 = \Gamma Y_4$, $\mathrm \Gamma Y_1 = \Gamma Y_5$, $\mathrm \Gamma X_2 = \Gamma X_4$, and $\mathrm \Gamma X_1 = \Gamma X_5$ hold. Let $\mathrm{\Gamma X}_i$ $(i = 1, 2, \dots , 6)$ and $\mathrm{\Gamma Y}_i$ $(i = 1, 2, \dots , 6)$ be an input mask and an output mask of $i$th round, respectively. These approximations are found by Aoki, et al. in [1]. Every approximation has the same effective key bits, which are 14 bits (0x007F7F 00) of $mK_1$, XORed value of the 2 bits (0x00808000) of $mK_1$, and 22 bits (0x03FFFF0F) of $mK_8$.