Improved truncated differential attacks on SAFER

Abstract

Knudsen and Berson have applied truncated differential attack on 5 round SAFER K-64 successfully. However, their attack is not efficient when applied on 5 round SAFER SK-64 (with the modified key schedule) and can not be applied on 6 round SAFER.In this paper, we improve the truncated differential attack on SAFER by using better truncated differential and additional filtering method. Ourattack on 5 round SAFER (both SAFER K-64 and SAFER SK-64) can findthe secret key much faster than by exhaustive search. Also, the number of chosen plaintexts required are less than those needed in Knudsen and Bersonis attack. Our attack on 6 round SAFER (both SAFER K-64 and SAFER SK-64) can find the secret key faster than by exhaustive search.