General model of the single-key meet-in-the-middle distinguisher on the word-oriented block cipher

Abstract

The single-key meet-in-the-middle attack is an efficient attack against AES. The main component of this attack is a distinguisher. In this paper, we extend this kind of distinguisher to the wordoriented block cipher, such as the SPN block cipher and the Feistel-SP block cipher. We propose a general distinguisher model and find that building a better distinguisher is equivalent to a positive integer optimization problem. Then we give a proper algorithm to solve this problem. Furthermore, we analyse the limitation of the distinguisher using the efficient tabulation and give a method to search the special differential trail we need in this distinguisher. Finally, we apply the distinguisher to Crypton, mCrypton and LBlock, and give distinguishers on 4-round Crypton, 4-round mCrypton and 9-round LBlock. We also give 7-round attacks on Crypton-128 and mCrypton-96.