Zero-correlation Linear Cryptanalysis of SAFER Block Cipher Family Using the Undisturbed Bits
Wentan Yi, Shaozhen Chen, Yuchen Li · The Computer Journal · 2016
SAFER is a family of block ciphers, which is comprised of SAFER K, SAFER SK, SAFER+ and SAFER++. SAFER SK was proposed to strengthen the key schedule of SAFER K. SAFER+ was designed as an AES candidate and SAFER++ was among the cryptographic primitives selected for the second phase of the NESSIE project. This paper presented the first zero-correlation linear cryptanalytic attack against the SAFER block cipher family. We investigated the linear properties of PHT employed as the linear layer of the SAFER block ciphers, and identified zero-correlation linear approximations for SAFER SK, SAFER+ and SAFER++. Moreover, we displayed several characterizations of the undisturbed bits, and found that there exists an undisturbed bit in the exponential S-box, which can be applied to reduce the computational complexity in the key recovery attacks on 5 rounds of SAFER SK/128 and 4(5) rounds of SAFER+/128(256), 5(6) rounds of SAFER++/128(256). More rounds of the SAFER block ciphers can be attacked with the linear relations of correlation zero.