A Property for Full CLEFIA-128 Detected by a Middletext Distinguisher under the Known-Key Setting

作者：Aoki Kazumaro^*

来源：IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, 2014, E97A(1): 292-297.

DOI：10.1587/transfun.E97.A.292

• CLEFIA
• higher-order integral
• integral attack
• middletext distinguisher
• known-key attack
• zero-sum

CLEFIA is a 128-bit block cipher proposed by Shirai et al. at FSE 2007, and it was selected as several standards. CLEFIA adopts a generalized Feistel structure with the switching diffusion mechanism, which realizes a compact hardware implementation for CLEFIA, and it seems one of the promising candidates to be used for restricted environments, which require that a cryptographic primitive is versatile. It means that we need to evaluate the security of CLEFIA even for unusual scenario such as known-key scenario. As Knudsen and Rijmen did for 7-round AES at Asiacrypt 2007, we construct 17-round known-key distinguisher using two integral characteristics. To combine the 17-round known-key distinguisher with the standard subkey recovery technique for a secret-key scenario, we can construct a known-key distinguisher for full CLEFIA-128 from a random permutation under the framework of middletext distinguisher proposed by Minier et al. at Africacrypt 2009. The known-key distinguisher requires query of 2(112) texts, time complexity of 2(112), and memory complexity of 2(3) blocks, with the advantage of e(-1), where e is the base of the natural logarithm. Note that there is no practical impact on the security of CLEFIA-128 for the current usages, since the result can only work under the known-key setting and data used by the adversary are enormous and needs a special form.

• 出版日期2014-1