分组密码FBC的截断差分分析

Truncated Differential Cryptanalysis of FBC

为了促进密码算法的设计和实现,中国密码学会(CACR)于2018年举办全国密码算法设计竞赛,其中FBC算法是晋级到第二轮的十个算法之一.FBC有三个版本,即FBC128-128、FBC128-256和FBC256-256,分别能够支持128比特和256比特长度的明文和密钥.FBC算法采用4路两重Feistel结构设计,便于硬件实现.本文利用中间相遇的截断差分构造方法,针对FBC加密算法,为FBC-128算法构造了11轮概率为2^(-108)的截断差分路线,基于该区分器,对FBC-128算法第一次给出15轮密钥恢复攻击,其中攻击的数据复杂度为2^(99)选择密文,时间复杂度是2^(100)次15轮加密,比已有的分析结果提高了3轮.对于256比特分组长度的FBC-256算法构造了15轮概率为2^(-236)的截断差分路线,基于该区分器,对FBC-256算法给出了20轮密钥恢复攻击,攻击的数据复杂度为2^(227)选择密文量,时间复杂度是2^(222.6)次20轮加密.

In order to promote the design and implementation of cryptographic algorithms,the Chinese Association for Cryptologic Research(CACR)held a national cryptographic algorithm design competition in 2018,where the FBC algorithm was one of ten candidate algorithms that advanced to the second round.There are three versions of FBC,namely FBC128-128,FBC128-256,and FBC256-256,which support 128-bit and 256-bit plaintexts and keys respectively.The FBC algorithm adopts a 4-way dual Feistel structure,making it well-suited for implement in hardware.This paper uses the meet-in-the-middle method to construct the truncated differential,and obtains an 11-round truncated differential with a probability of 2^(-108) for FBC-128 with 128-bit block,and mounts a 15-round key recovery attack with 2^(99) chosen ciphertexts and 2^(100) encryptions,which has three more rounds than previous cryptanalysis results.For the FBC-256 with 256-bit block,a 15-round truncated differential with a probability of 2^(-236) is constructed,which is used for 20-round key recovery attack with 2^(227) chosen ciphertexts and 2^(222.6) encryptions.