General application of FFT in cryptanalysis and improved attack on CAST-256

Abstract

Fast Fourier Transformation (FFT) technique was used to reduce the time complexity of linear cryptanalysis by Collard et al. at ICISC 2007. This powerful technique has been used to improve the time complexity of zero-correlation linear cryptanalysis as well as integral attack by Bogdanov et al. and Todo respectively. Yet whether FFT is applicable when multiple modular additions with subkeys are involved during the partial encryption and decryption phase remains unknown, which has limited its application to some degree. In this paper, we give a general scheme to use FFT technique in linear cryptanalysis, zerocorrelation or integral attack where multiple modular additions (together with multiple XORs) with subkeys are involved in the key recovery process. Based on this scheme, we can attack one more round of CAST-256 than the zero-correlation attack on 28-round CAST-256 at ASIACRYPT 2012 by Bogdanov et al., which also becomes the best attack against CAST-256 without any weak key assumption.