When an exclusive-or is used to combine the output of the round function with the other branch, we use the so-called \textit{yoyo game} which we improved using a heuristic based on particular cycle structures. The complexity of a complete recovery is equivalent to $O(2^{2n})$ encryptions where $n$ is the branch size. This attack can be used against 6- and 7-round Feistel Networks in time respectively $O(2^{n2^{n-1}+2n})$ and $O(2^{n2^{n}+2n})$. However when modular addition is used, this attack does not work. In this case, we use an optimized guess-and-determine strategy to attack 5 rounds with complexity $O(2^{n2^{3n/4}})$.
Our results are, to the best of our knowledge, the first recovery attacks against generic 5-, 6- and 7-round Feistel Networks.
Category / Keywords: secret-key cryptography / Feistel Network, Yoyo, Generic Attack, Guess-and-determine Original Publication (with major differences): Selected Areas in Cryptography 2015 Date: received 20 Jul 2015 Contact author: leo perrin at uni lu Available format(s): PDF | BibTeX Citation Version: 20150721:065156 (All versions of this report) Short URL: ia.cr/2015/723 Discussion forum: Show discussion | Start new discussion