分组密码FBC的截断差分分析  

Truncated Differential Cryptanalysis of FBC

作　　者：邹光南 刘端 贾珂婷 张国艳[2,5,6] ZOU Guang-Nan;LIU Duan;JIA Ke-Ting;ZHANG Guo-Yan(Department of Computer Science and Technology,Tsinghua University,Beijing 100084,China;School of Cyber Science and Technology,Shandong University,Qingdao 266237,China;Institute for Network Sciences and Cyberspace,Tsinghua University,Beijing 100084,China;Zhongguancun Laboratory,Beijing 100194,China;Key Laboratory of Cryptologic Technology and Information Security of Ministry of Education,Qingdao 266237,China;Shandong Institute of Blockchain,Jinan 250101,China)

机构地区：[1]清华大学计算机科学与技术系,北京100084 [2]山东大学网络空间安全学院,青岛266237 [3]清华大学网络科学与网络空间研究院,北京100084 [4]中关村实验室,北京100194 [5]密码技术与信息安全教育部重点实验室,青岛266237 [6]山东区块链研究院,济南250101

出　　处：《密码学报（中英文）》2024年第3期602-620,共19页Journal of Cryptologic Research

基　　金：国家自然科学基金(62072270);山东省重点研发计划(2020ZLYS09)。

摘　　要：为了促进密码算法的设计和实现,中国密码学会(CACR)于2018年举办全国密码算法设计竞赛,其中FBC算法是晋级到第二轮的十个算法之一.FBC有三个版本,即FBC128-128、FBC128-256和FBC256-256,分别能够支持128比特和256比特长度的明文和密钥.FBC算法采用4路两重Feistel结构设计,便于硬件实现.本文利用中间相遇的截断差分构造方法,针对FBC加密算法,为FBC-128算法构造了11轮概率为2^(-108)的截断差分路线,基于该区分器,对FBC-128算法第一次给出15轮密钥恢复攻击,其中攻击的数据复杂度为2^(99)选择密文,时间复杂度是2^(100)次15轮加密,比已有的分析结果提高了3轮.对于256比特分组长度的FBC-256算法构造了15轮概率为2^(-236)的截断差分路线,基于该区分器,对FBC-256算法给出了20轮密钥恢复攻击,攻击的数据复杂度为2^(227)选择密文量,时间复杂度是2^(222.6)次20轮加密.In order to promote the design and implementation of cryptographic algorithms,the Chinese Association for Cryptologic Research(CACR)held a national cryptographic algorithm design competition in 2018,where the FBC algorithm was one of ten candidate algorithms that advanced to the second round.There are three versions of FBC,namely FBC128-128,FBC128-256,and FBC256-256,which support 128-bit and 256-bit plaintexts and keys respectively.The FBC algorithm adopts a 4-way dual Feistel structure,making it well-suited for implement in hardware.This paper uses the meet-in-the-middle method to construct the truncated differential,and obtains an 11-round truncated differential with a probability of 2^(-108) for FBC-128 with 128-bit block,and mounts a 15-round key recovery attack with 2^(99) chosen ciphertexts and 2^(100) encryptions,which has three more rounds than previous cryptanalysis results.For the FBC-256 with 256-bit block,a 15-round truncated differential with a probability of 2^(-236) is constructed,which is used for 20-round key recovery attack with 2^(227) chosen ciphertexts and 2^(222.6) encryptions.

关 键 词：分组密码 FBC 截断差分 密码分析 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]