Linear Cryptanalysis of Reduced-Round Versions of the SAFER block cipher family

Abstract

This paper presents a linear cryptanalytic attack against re-duced round variants of the SAFER family of block ciphers. Compared with the 1.5 round linear relations by Harpes et al., the following new linear relations were found: a 3.75-round non-homomorphic linear rela-tion for both SAFER-K and SAFER-SK with bias ϵ = 2−29; a 2.75 round relation for SAFER+ with bias ϵ = 2−49. For a 32-bit block mini-version of SAFER a 4.75-round relation with bias ϵ = 2−16 has been identified. These linear relations apply only to certain weak key classes. The results show that by considering non-homomorphic linear relations, more rounds of the SAFER block cipher family can be attacked. The new attacks pose no threat to any member of the SAFER family.