论文部分内容阅读
差分密码分析和线性密码分析是攻击分组密码的强有力的工具.在实际的安全性评估中,常用的方法是,通过研究密码结构,给出多轮差分特征和线性逼近中活动F函数个数的下界,进而给出最大差分特征概率和最大线性逼近概率的上界.如果最大差分特征概率和最大线性逼近概率的上界足够小,就认为该密码结构具有抵抗差分和线性密码分析的能力.基于此,本文对一类四分组扩展广义Feistel结构抵抗差分和线性密码分析的能力进行了详细的研究.在F函数为双射的条件下,证明了k(k≥1)轮差分特征中活动F函数个数的下界为k-1,并利用差分特征和线性逼近之间的对偶关系,证明了k轮线性逼近中活动F函数个数的下界也为k-1.从而,若设F函数的最大差分概率和最大线性逼近概率分别为p和q,则k轮差分特征概率和线性逼近概率的上界分别为p~(k-1)和q~(k-1).根据本文的研究结果,只需确定F函数的最大差分概率和最大线性逼近概率,就能估计出该密码结构抵抗差分和线性密码分析的能力.最后,将该密码结构与其它两类广义Feistel结构的效率进行了比较.
Differential cryptanalysis and linear cryptanalysis are powerful tools to attack block ciphers.A common method in practical security evaluation is to find out the number of active F-functions in multiple rounds of differential features and linear approximations by studying the cryptographic structure Then the upper bound of the maximum difference probability and the maximum linear approximation probability is given.If the upper bound of the maximum difference probability and the maximum linear approximation probability is small enough, the cryptosystem is considered to be able to resist differential and linear cryptanalysis. Based on this, we study in detail the ability of a class of four-group extended generalized Feistel structure to resist differential and linear cryptanalysis.When the F-function is bijective, it is proved that k (k≥1) The lower bound of the number of F-functions is k-1, and the duality between the differential features and the linear approximation is used to prove that the lower bound of the number of active F-functions in the k-round linear approximation is also k-1. The maximum difference probability and the maximum linear approximation probability are respectively p and q, then the upper bounds of the k-th differential feature probability and the linear approximation probability are respectively p ~ (k-1) and q ~ (k-1). According to the research Result, only F function to determine the maximum differential probability and maximum linear approximation probability, will be able to estimate the ability of the code structure to resist differential and linear cryptanalysis. Finally, the efficiency of the code structure and the other two classes of generalized Feistel structure were compared.