Degree of composition of highly nonlinear functions and applications to higher order differential cryptanalysis

Abstract

To improve the securityof iterated block ciphers, the resistance against linear cryptanalysis has been formulated in terms of provable securitywhic h suggests the use of highlynonlinear functions as round functions. Here, we show that some properties of such functions enable to find a new upper bound for the degree of the product of its Boolean components. Such an improvement holds when all values occurring in the Walsh spectrum of the round function are divisible bya high power of 2. This result leads to a higher order differential attack on any 5-round Feistel ciphers using an almost bent substitution function. We also show that the use of such a function is preciselythe origin of the weakness of a reduced version of MISTY1 reported in [23, 1].