Differential and linear cryptanalysis of a reduced-round SC2000

Abstract

We analyze the security of the SC2000 block cipher against both differential and linear attacks. SC2000 is a six-and-a-half-round block cipher, which has a unique structure that includes both the Feistel and Substitution-Permutation Network (SPN) structures. Taking the structure of SC2000 into account, we investigate one- and two-round iterative differential and linear characteristics. We present two-round iterative differential characteristics with probability 2-58 and two-round iterative linear characteristics with probability 2-56. These characteristics, which we obtained through a search, allowed us to attack four-and-a-half-round SC2000 in the 128-bit user-key case. Our differential attack needs 2103 pairs of chosen plaintexts and 220 memory accesses and ourlinearattac k needs 2115.17 known plaintexts and 242.32 memory accesses, or 2104.32 known plaintexts and 283.32 memory accesses.