Cryptanalysis of Mcguun

This paper shows that the actual proposal for an unbalanced Feistel network by Schneier and Blaze is as vulnerable to diierential cryptanalysis as the DES. 1 McGuun Schneier and Blaze introduce in SB95] a new kind of block ciphers: the Generalized Unbalanced Feistel Network. Together with the general architecture they give a complete speciication of an example. The basic idea is to split the input of each round into unequal parts. In the example, the 64-bit input is split into a 48-bit input of the F-function, and a 16-bit part that is exored with the output of the F-function. The F-function consists of the 8 S-boxes of the DES, but the two middle output bits of each S-box are neglected in order to obtain a 16-bit output. 2 Diierential Characteristics In Ma94] Matsui demonstrated that one can nd the best diierential characteristics and linear relations for the DES with a clever search algorithm. This encouraged us to try the same for McGuun. For the DES it is very important to depart from very good starting values in order to obtain the characteristics in relatively short time (a few hours). For McGuun, we had no good guesses for the starting values and became the best characteristics for two to 32 rounds in about the same time. This indicates that McGuun is very vulnerable for diierential cryptanalysis. Table 1 gives the probabilities of the best diierential characteristics of McGuun. It turns out that the probability of the best 2n-round characteristic of McGuun is signiicantly larger than the probability of the best n-round characteristic of the DES. From this viewpoint 32 rounds of McGuun is weaker than 16 rounds of the DES. Figure 1 shows the four-round