New quantum attacks on some Feistel variants

Abstract

Simon’s algorithm is a period-finding algorithm that can provide an exponential speedup compared to the classical algorithm. It has already been widely used in the quantum cryptanalysis of some cryptographic primitives. This paper investigates the applications of Simon’s algorithm in the security analysis of several Feistel variants: MARS-F, Skipjack-B-F, 4F-function, and 2F-function schemes. Firstly, we give a 2d-round quantum distinguisher for d-branch MARS-F. Secondly, a \((d^2 - 1)\)-round quantum distinguisher is built for d-branch Skipjack-B-F. Thirdly, we construct a 10-round and a 6-round quantum distinguisher for 4F-function and 2F-function, respectively. Based on these quantum distinguishers, we can build some quantum key-recovery attacks on these Feistel variants. We denote n as the bit length of a branch. In the first place, for 3d-round MARS-F with d branches, a key-recovery attack is constructed with the time complexity of \(O\left( n2^{dn/2}\right) \). In the second place, for \((d^2 + d - 1)\)-round Skipjack-B-F with d branches, we present a key-recovery attack with the time complexity of \(O\left( n2^{dn/2}\right) \). At last, the key can be recovered with the time complexities of \(O\left( n2^{5n}\right) \) and \(O\left( n2^{3n/2}\right) \) for 14-round 4F-function and 8-round 2F-function, respectively.