High-order Differential Analysis Of Two Generalized Feistel Networks And SM4

Feistel structure named after the inventor Horst Feistel is a symmetric structure in cryptography.It is widely used in DES and other block ciphers.Because of its similar encryption and decryption processes,Feistel structure greatly reduces the requirements of coding amount and line transmission.Due to the high computing power at present,the security of Feistel structure is challenged.In order to meet the higher security,the key length must be increased.To solve this problem,Zheng et al.proposed three types of generalized Feistel structures.SM4 cipher algorithm is our own business cipher algorithm.It has many advantages,for example,the processes of encryption and decryption are same,the resource is fully used and implementation processes in hardware and software are simple.The research on these structures is of great significance and practical value.The iterations and algebraic degrees of the block ciphers with generalized Feistel structures and SM4 are not high,so the high-order difference attack is effective to them.In this dissertation,we focus on the high-order differential attack,select type-2 and type-3generalized Feistel structures and SM4 as the original structures and take their equivalent structures as the basis,considering the advantages and disadvantages of single and double SP models.The main studying contents and obtained results are as follows.(1)First,by adjusting the two round functions to the right locations,an equivalent structure of type-2 generalized Feistel structure is given,and a new high-order differential distinguisher is constructed by using equivalent structure instead of type-2 generalized Feistel structure.After observing the calculation results of the upper bounds of the algebraic degrees of the two structures,it is found that the upper bound of the original structure after 5 iterations can only be reached after 6 iterations of the equivalent structure,and its upper bound is more compact.Then,for the cases that the SP model is single SP model and double SP model,the performance of the distinguisher is analyzed by using the given equivalent structure.Then,under the single SP model and the double SP model,we estimate the upper bounds of the positive and the reverse algebraic degrees,and analyze the growth of them.According to the structural characteristics of the distinguisher,we give a clear algebraic expression of the number of nontrivial rounds.It follows from calculation results that the single SP model is more advantageous for the obtained distinguishers.(2)By transforming the 3 round functions to the appropriate positions,an equivalent structure of type-3 generalized Feistel structure is given,and then a distinguisher is constructed.By comparison,it is found that the upper bound of the algebraic degree of the 3rd word of the equivalent structure estimation is tighter than the original structure.For the cases that the SP model of three round functions is a single SP model and a double SP model,two kinds of distinguishers are constructed by combining the given equivalent structure with two rounds of higher-order integral path and reverse path respectively.After substituting the specific parameters,it is also found that the single SP model has higher resistance than the double SP model when the two types of distinguishers face high-order differential attack.(3)Use the same method to analyze the SM4 cipher algorithm.Firstly,the equivalent structure of the SM4 structure is given,based on which a distinguisher is constructed.By calculation,it is found that the value of the original structure 5th round is the same as that of the equivalent structure 6th round,and the equivalent structure is more compact.Then,for the cases that there are one layer and two layers SP in the wheel function,two kinds of distinguishers are constructed,and the increase of the upper bounds of algebraic degree and the number of nontrivial wheels of the two kinds of distinguishers under specific parameters are analyzed.It is found that the single SP model is a good choice for the two distinguishers.