**Generic Round-Function-Recovery Attacks for Feistel Networks over Small Domains**

*F. Betül Durak and Serge Vaudenay*

**Abstract: **Feistel Networks (FN) are now being used massively to encrypt credit card numbers through format-preserving encryption. In our work, we focus on FN with two branches, entirely unknown round functions, modular additions (or other group operations), and when the domain size of a branch (called $N$) is small. We investigate round-function-recovery attacks.

The best known attack so far is an improvement of Meet-In-The-Middle (MITM) attack by Isobe and Shibutani from ASIACRYPT~2013 with optimal data complexity $q=r \frac{N}{2}$ and time complexity $N^{ \frac{r-4}{2}N + o(N)}$, where $r$ is the round number in FN. We construct an algorithm with a surprisingly better complexity when $r$ is too low, based on partial exhaustive search. When the data complexity varies from the optimal to the one of a codebook attack $q=N^2$, our time complexity can reach $N^{O \left( N^{1-\frac{1}{r-2}} \right) }$. It crosses the complexity of the improved MITM for $q\sim N\frac{\mathrm{e}^3}{r}2^{r-3}$.

We also estimate the lowest secure number of rounds depending on $N$ and the security goal. We show that the format-preserving-encryption schemes FF1 and FF3 standardized by NIST and ANSI cannot offer 128-bit security (as they are supposed to) for $N\leq11$ and $N\leq17$, respectively (the NIST standard only requires $N \geq 10$), and we improve the results by Durak and Vaudenay from CRYPTO~2017.

**Category / Keywords: **Feisten Network, generic attacks

**Original Publication**** (with minor differences): **ACNS 2018

**Date: **received 29 Jan 2018, last revised 18 Apr 2018

**Contact author: **durakfbetul at gmail com

**Available format(s): **PDF | BibTeX Citation

**Version: **20180418:123335 (All versions of this report)

**Short URL: **ia.cr/2018/108

[ Cryptology ePrint archive ]