Generic attacks on unbalanced Feistel schemes with contracting functions

Abstract

In this paper, we describe generic attacks on unbalanced Feistel schemes with contracting functions. These schemes are used to construct pseudo-random permutations from kn bits to kn bits by using d pseudo-random functions from (k-1)n bits to n bits. We describe known plaintext attacks (KPA) and non-adaptive chosen plaintext attacks (CPA-1) against these schemes with less than 2kn plaintext/ciphertext pairs and complexity strictly less than O(2kn) for a number of rounds d ≤ 2k -1. Consequently at least 2k rounds are necessary to avoid generic attacks. For k=3, we found attacks up to 6 rounds, so 7 rounds are required. When d ≥ 2k, we also describe some attacks on schemes with generators, (i.e. schemes where the d pseudo-random functions are generated) and where more than one permutation is required. © 2006 Springer-Verlag.