Generic Attacks on Unbalanced Feistel Schemes with Contracting Functions

In this paper, we describe generic attacks on unbalanced Feistel schemes with contracting functions. These schemes are used to construct pseudo-random permutations from kn bits to kn bits by using d pseudo-random functions from (k − 1)n bits to n bits. We describe known plaintext attacks (KPA) and non-adaptive chosen plaintext attacks (CPA-1) against these schemes with less than 2 plaintext/ciphertext pairs and complexity strictly less than O(2) for a number of rounds d ≤ 2k− 1. Consequently at least 2k rounds are necessary to avoid generic attacks. For k = 3, we found attacks up to 6 rounds, so 7 rounds are required. When d ≥ 2k, we also describe some attacks on schemes with generators, (i.e. schemes where the d pseudo-random functions are generated) and where more than one permutation is required.