Toward Provable Security Against Differential and Linear Cryptanalysis for Camellia and Related Ciphers

We present a new algorithm that evaluates provable security against differential and linear cryptanalysis for Feistel ciphers with invertible substitution-diffusion (SD)-based round functions. This algorithm computes an upper bound on the maximum expected differential or linear probability (MEDP or MELP) based on the number of rounds. We then apply our algorithm to Camellia (minus FL/FL). Previously, the best upper bounds for Camellia were 2 (both MEDP and MELP) for 3+ rounds. Our algorithm improves these bounds to 1.065 × 2 (MEDP) and 1.161× 2 (MELP) for 6+ rounds. This is a first step toward establishing the provable security of Camellia and related ciphers against differential and linear cryptanalysis.