A Note on Weak Keys of PES, IDEA, and Some Extended Variants

Abstract

This paper presents an analysis of the PES cipher in a similar setting as done by Daemen et al. at Crypto’93 for IDEA. The following results were obtained for 8.5-round PES: a linear weak-key class of size 2⁴⁸, two differential weak-key classes of size 2⁴¹, and two differential-linear weak-key classes of size 2⁶². For 17-round PES (double PES): a linear weak-key class of size 2⁷, and a differential weak-key class of size 2⁷ were found. These attacks demonstrate that doubling the number of rounds in PES is not enough to avoid weak keys. These findings were possible because the cipher structure from PES to IDEA was changed but the key schedule algorithm remained the same. Daemen suggested a modified key schedule for IDEA in order to avoid weak keys. We found a differential weak-key class of size 2⁸³ for 2.5-round IDEA under his redesigned key schedule, and a differential-linear weak-key class of size 2⁶⁸ for 3.5-round IDEA. The presence of weak keys has some consequences. Recall that without weak-key assumptions there are no known attacks on more than 4.5 rounds of IDEA. Furthermore, the existence of weak keys may imply that the block cipher becomes unsuitable in stream cipher and hash function constructions.