Cryptology ePrint Archive: Report 2005/251

Feistel Schemes and Bi-Linear Cryptanalysis

Nicolas Courtois

Abstract: In this paper we introduce the method of bi-linear cryptanalysis(BLC), designed specifically to attack Feistel ciphers. It allows to construct periodic biased characteristics that combine for an arbitrary number of rounds. In particular, we present a practical attack on DES based on a 1-round invariant, the fastest known based on such invariant, and about as fast as the best Matsui's attack. For ciphers similar to DES, based on small S-boxes, we claim that BLC is very closely related to LC, and we do not expect to find a bi-linear attack much faster than by LC. Nevertheless we have found bi-linear characteristics that are strictly better than the best Matsui's result for 3, 7, 11 and more rounds of DES. We also study s5DES substantially stronger than DES against LC, yet for BLC we exhibit several unexpectedly strong biases, stronger even than existing for DES itself.

For more general Feistel schemes there is no reason whatsoever for BLC to remain only a small improvement over LC. We present a construction of a family of practical ciphers based on a big Rijndael-type S-box that are strongly resistant against linear cryptanalysis (LC) but can be easily broken by BLC, even with 16 or more rounds.

Category / Keywords: secret-key cryptography / Feistel schemes, S-boxes, Rijndael S-box, linear cryptanalysis, generalised linear cryptanalysis, multivariate quadratic equations

Publication Info: Long, very much extended version of Crypto 2004 paper with the same title

Date: received 1 Aug 2005

Contact author: courtois at minrank org

Available format(s): Postscript (PS) | Compressed Postscript (PS.GZ) | PDF | BibTeX Citation

Version: 20050802:075913 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]