FFT Key Recovery for Integral Attack

Abstract

An integral attack is one of the most powerful attacks against block ciphers. We propose a new technique for the integral attack called the Fast Fourier Transform (FFT) key recovery. When the integral distinguisher uses N chosen plaintexts and the guessed key is k bits, a straightforward key recovery requires the time complexity of O(N 2^k). However, the FFT key recovery method requires only the time complexity of O(N + k 2^k). As a previous result using FFT, at ICISC 2007, Collard et al.proposed that FFT can reduce the time complexity of a linear attack. We show that FFT can also reduce the complexity of the integral attack. Moreover, the estimation of the complexity is very simple. We first show the complexity of the FFT key recovery against three structures, the Even-Mansour scheme, a key-alternating cipher, and the Feistel cipher. As examples of these structures, we show integral attacks against Prøst, CLEFIA, and AES. As a result, 8-round Prøst $\tilde{P}_{128,K}$ can be attacked with about an approximate time complexity of 2⁸⁰. Moreover, a 6-round AES and 12-round CLEFIA can be attacked with approximate time complexities of 2^52.6 and 2^87.5, respectively.