This document introduces the high-degree indicator matrix (HDIM) as a tool to analyze Feistel networks. The HDIM reveals the presence of high-degree monomials in a function's algebraic normal form. For Feistel networks with bijective round functions, the HDIM has a predictable pattern depending on the number of rounds. Specifically, more rounds result in more non-zero elements. This allows the HDIM to distinguish Feistel networks even with many rounds, though other techniques work better for smaller numbers of rounds. The HDIM is computed efficiently and transforms predictably under linear transformations.
4. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Linear Approximation Table (LAT)
Definition (LAT, Fourier Transform, Walsh Spectrum)
The Linear Approximation Table of f : {0, 1}n → {0, 1}m is a
2n × 2m matrix L where
L[a, b] = #{x ∈ Fn
2, a · x = b · f (x)} − 2n−1
= −
1
2
x∈Fn
2
(−1)a·x⊕b·f (x)
.
4 / 27
5. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Jackson Pollock Representation of LAT
[Biryukov, Perrin CRYPTO2015]: graphical representation of LAT
to reverse-engineer S-Boxes.
S-Box F of Skipjack
5 / 27
6. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Jackson Pollock Representation of LAT
[Biryukov, Perrin CRYPTO2015]: graphical representation of LAT
to reverse-engineer S-Boxes.
S-Box F of Skipjack
4-round Feistel Network
with bijective functions
5 / 27
7. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
LAT modulo 4
Idea
Look at LAT modulo 4!
Why? LAT modulo 2k is related to algebraic degree.
6 / 27
8. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
LAT modulo 4
Idea
Look at LAT modulo 4!
Why? LAT modulo 2k is related to algebraic degree.
4-round Feistel Network
with bijective functions
6 / 27
9. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
LAT modulo 4
Idea
Look at LAT modulo 4!
Why? LAT modulo 2k is related to algebraic degree.
4-round Feistel Network
with bijective functions
5-round Feistel Network
with bijective functions
6 / 27
10. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
LAT modulo 4
Idea
Look at LAT modulo 4!
Why? LAT modulo 2k is related to algebraic degree.
6-round Feistel Network
with bijective functions
6 / 27
11. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
LAT modulo 4
Idea
Look at LAT modulo 4!
Why? LAT modulo 2k is related to algebraic degree.
6-round Feistel Network
with bijective functions
Random permutation
6 / 27
12. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Bilinear Form
LAT modulo 4 has highly linear patterns even for random
permutations.
7 / 27
13. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Bilinear Form
LAT modulo 4 has highly linear patterns even for random
permutations.
Explanation? It is a bilinear form!
7 / 27
14. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Bilinear Form
LAT modulo 4 has highly linear patterns even for random
permutations.
Explanation? It is a bilinear form!
The following is true:
L[a, b]
2
≡
x∈Fn
2
b · F(x) a · x (mod 2). (1)
7 / 27
15. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Bilinear Form
LAT modulo 4 has highly linear patterns even for random
permutations.
Explanation? It is a bilinear form!
The following is true:
L[a, b]
2
≡
x∈Fn
2
b · F(x) a · x (mod 2). (1)
⇒ express L[a, b]/2 as a vector-matrix-vector product:
L[a, b]
2
≡ bT
× ˆH(F) × a (mod 2), (2)
where ˆH(F) is an n × n matrix over F2, such that
ˆH(F)[i, j] =
x∈Fn
2
ei · F(x) ej · x . (3)
7 / 27
16. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Another meaning of LAT modulo 4
Algebraic Normal Form (ANF)
Recall that any Boolean function f mapping n bits to 1 can be
represented in a unique way as:
f (x) =
u∈Fn
2
auxu
=
u∈Fn
2
au
i∈[0,n−1]
xui
i .
8 / 27
17. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Another meaning of LAT modulo 4
Algebraic Normal Form (ANF)
Recall that any Boolean function f mapping n bits to 1 can be
represented in a unique way as:
f (x) =
u∈Fn
2
auxu
=
u∈Fn
2
au
i∈[0,n−1]
xui
i .
Lemma (Another meaning of LAT modulo 4)
ˆH(F)[i, j] = 1 if and only if the ANF of ith bit of F contains the
monomial k=j xk (which has degree n − 1).
8 / 27
19. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
High-Degree Indicator Matrix
Definition (High-Degree Indicator Matrix)
We will call ˆH(F) High-Degree Indicator Matrix (HDIM).
Computing the HDIM
Each row or column of ˆH(F) is a ⊕-sum of F over a particular
cube of dimension n − 1.
9 / 27
20. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
High-Degree Indicator Matrix
Definition (High-Degree Indicator Matrix)
We will call ˆH(F) High-Degree Indicator Matrix (HDIM).
Computing the HDIM
Each row or column of ˆH(F) is a ⊕-sum of F over a particular
cube of dimension n − 1.
For one row/column we need 2n−1 data and 2n−1 time.
9 / 27
21. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
High-Degree Indicator Matrix
Definition (High-Degree Indicator Matrix)
We will call ˆH(F) High-Degree Indicator Matrix (HDIM).
Computing the HDIM
Each row or column of ˆH(F) is a ⊕-sum of F over a particular
cube of dimension n − 1.
For one row/column we need 2n−1 data and 2n−1 time.
For whole ˆH(F) we need full codebook and n2n−1 time.
9 / 27
22. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
High-Degree Indicator Matrix
Definition (High-Degree Indicator Matrix)
We will call ˆH(F) High-Degree Indicator Matrix (HDIM).
Computing the HDIM
Each row or column of ˆH(F) is a ⊕-sum of F over a particular
cube of dimension n − 1.
For one row/column we need 2n−1 data and 2n−1 time.
For whole ˆH(F) we need full codebook and n2n−1 time.
Neglible memory complexity - n bits to store the sum.
9 / 27
23. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Properties of HDIM
Theorem (Linear transformations and HDIM)
Let µ, η be linear n-bit mappings, F be an n-bit permutation and
let G = η ◦ F ◦ µ. Then it holds that
ˆH(G) = η × ˆH(F) × (µt
)−1
.
10 / 27
24. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Properties of HDIM
Theorem (Linear transformations and HDIM)
Let µ, η be linear n-bit mappings, F be an n-bit permutation and
let G = η ◦ F ◦ µ. Then it holds that
ˆH(G) = η × ˆH(F) × (µt
)−1
.
Linear transformations applied to a permutation modify its
HDIM in a linear way.
We will use this Theorem to recover whitening linear layers.
10 / 27
26. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
LAT modulo 4 patterns
Recall the LAT modulo 4 patterns that we have spotted:
4-round Feistel Network
with bijective functions
5-round Feistel Network
with bijective functions
12 / 27
27. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
LAT modulo 4 patterns
Recall the LAT modulo 4 patterns that we have spotted:
Can be nicely rephrased in terms of HDIM.
4-round Feistel Network
with bijective functions
5-round Feistel Network
with bijective functions
12 / 27
29. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by Number of Rounds
Theorem
Let Fr
d be a Feistel Network with r rounds and degree d of
round functions.
14 / 27
30. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by Number of Rounds
Theorem
Let Fr
d be a Feistel Network with r rounds and degree d of
round functions.
Let θ(d, r) = d r/2 −1 + d r/2 −1 be a parameter.
14 / 27
31. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by Number of Rounds
Theorem
Let Fr
d be a Feistel Network with r rounds and degree d of
round functions.
Let θ(d, r) = d r/2 −1 + d r/2 −1 be a parameter.
Assume that the round functions are permutations. Then
ˆH(Fr
d ) =
0 0
0 ?
, when θ(d, r) < 2n.
ˆH(Fr
d ) =
0 ?
? ?
, when θ(d, r − 1) < 2n.
14 / 27
32. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by Number of Rounds
Theorem
Let Fr
d be a Feistel Network with r rounds and degree d of
round functions.
Let θ(d, r) = d r/2 −1 + d r/2 −1 be a parameter.
Assume that the round functions are permutations. Then
ˆH(Fr
d ) =
0 0
0 ?
, when θ(d, r) < 2n.
ˆH(Fr
d ) =
0 ?
? ?
, when θ(d, r − 1) < 2n.
For non-bijective round functions, the results hold for one
round less.
14 / 27
33. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by Number of Rounds
Theorem
Let Fr
d be a Feistel Network with r rounds and degree d of
round functions.
Let θ(d, r) = d r/2 −1 + d r/2 −1 be a parameter.
Assume that the round functions are permutations. Then
ˆH(Fr
d ) =
0 0
0 ?
, when θ(d, r) < 2n.
ˆH(Fr
d ) =
0 ?
? ?
, when θ(d, r − 1) < 2n.
For non-bijective round functions, the results hold for one
round less.
Distinguisher for Feistel Networks: one HDIM row or column is
enough.
14 / 27
34. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by Number of Rounds
Theorem
Let Fr
d be a Feistel Network with r rounds and degree d of
round functions.
Let θ(d, r) = d r/2 −1 + d r/2 −1 be a parameter.
Assume that the round functions are permutations. Then
ˆH(Fr
d ) =
0 0
0 ?
, when θ(d, r) < 2n.
ˆH(Fr
d ) =
0 ?
? ?
, when θ(d, r − 1) < 2n.
For non-bijective round functions, the results hold for one
round less.
Distinguisher for Feistel Networks: one HDIM row or column is
enough. Weak compared to known distinguishers for up to 5
rounds, but can attack more rounds when the degree is low.
14 / 27
35. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Proof Idea
Recall the equation for HDIM:
ˆH(F)[i, j] =
x∈F2n
2
ei · F(x) ej · x
15 / 27
36. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Proof Idea
Recall the equation for HDIM:
ˆH(F)[i, j] =
x∈F2n
2
ei · F(x) ej · x
Change sum variables:
=
α||γ∈F2n
2
ei · g(α, γ) ej · h(α, γ) .
f r/2 −1
α γ
f r/2
β
f r/2 +1
hg
15 / 27
37. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Proof Idea
Recall the equation for HDIM:
ˆH(F)[i, j] =
x∈F2n
2
ei · F(x) ej · x
Change sum variables:
=
α||γ∈F2n
2
ei · g(α, γ) ej · h(α, γ) .
Calculate the degrees of h and g
straightforwardly and sum them.
f r/2 −1
α γ
f r/2
β
f r/2 +1
hg
15 / 27
38. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Proof Idea
Recall the equation for HDIM:
ˆH(F)[i, j] =
x∈F2n
2
ei · F(x) ej · x
Change sum variables:
=
α||γ∈F2n
2
ei · g(α, γ) ej · h(α, γ) .
Calculate the degrees of h and g
straightforwardly and sum them.
For bijective round functions, we can
get one round more by summing over
α and β.
f r/2 −1
α γ
f r/2
β
f r/2 +1
hg
15 / 27
39. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Feistel Network with Whitening Linear Layers
The AFrA structure:
Feistel Network with
r rounds and n-bit branches.
fi : secret and independent
random functions.
whitened with secret affine
layers Ain, Aout.
n bits n bits
Ain
f0
f1
fr−2
fr−1
Aout
16 / 27
40. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Feistel Network with Whitening Linear Layers
The AFrA structure:
Feistel Network with
r rounds and n-bit branches.
fi : secret and independent
random functions.
whitened with secret affine
layers Ain, Aout.
Cryptanalysis goals:
distinguish from random
permutation;
recover the secret
components.
n bits n bits
Ain
f0
f1
fr−2
fr−1
Aout
16 / 27
41. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking AFr
A
Let F be a Feistel Network with r rounds, such that
ˆH(F) =
0 0
0 ?
(e.g. 4 rounds with bijective functions).
Let G = η ◦ F ◦ µ. That is, G is AFrA.
17 / 27
42. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking AFr
A
Let F be a Feistel Network with r rounds, such that
ˆH(F) =
0 0
0 ?
(e.g. 4 rounds with bijective functions).
Let G = η ◦ F ◦ µ. That is, G is AFrA.
Then by properties of HDIM we have:
η−1
× ˆH(G) × µt
=
0 0
0 ?
.
17 / 27
43. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking AFr
A
Let F be a Feistel Network with r rounds, such that
ˆH(F) =
0 0
0 ?
(e.g. 4 rounds with bijective functions).
Let G = η ◦ F ◦ µ. That is, G is AFrA.
Then by properties of HDIM we have:
η−1
× ˆH(G) × µt
=
0 0
0 ?
.
Parts of η and µ merge into the Feistel structure, so we have
less unknowns and we can solve the system.
17 / 27
44. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking AFr
A
Let F be a Feistel Network with r rounds, such that
ˆH(F) =
0 0
0 ?
(e.g. 4 rounds with bijective functions).
Let G = η ◦ F ◦ µ. That is, G is AFrA.
Then by properties of HDIM we have:
η−1
× ˆH(G) × µt
=
0 0
0 ?
.
Parts of η and µ merge into the Feistel structure, so we have
less unknowns and we can solve the system.
Distinguisher for AFrA and Partial recovery of linear layers.
Complexity is dominated by computing HDIM - n22n−1.
17 / 27
45. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking one round more
In some special cases we can attack one more round. Then we
will need only that ˆH(F) =
0 ?
? ?
(for example, 5 rounds
with bijective functions).
18 / 27
46. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking one round more
In some special cases we can attack one more round. Then we
will need only that ˆH(F) =
0 ?
? ?
(for example, 5 rounds
with bijective functions).
One of such cases is when the linear layers are inverses of each
other (A−1FrA).
18 / 27
47. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking one round more
In some special cases we can attack one more round. Then we
will need only that ˆH(F) =
0 ?
? ?
(for example, 5 rounds
with bijective functions).
One of such cases is when the linear layers are inverses of each
other (A−1FrA).
Another possible case is one-sided whitening: FrA.
18 / 27
48. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Attacking one round more
In some special cases we can attack one more round. Then we
will need only that ˆH(F) =
0 ?
? ?
(for example, 5 rounds
with bijective functions).
One of such cases is when the linear layers are inverses of each
other (A−1FrA).
Another possible case is one-sided whitening: FrA.
Partial recovery of linear layers for A−1FrA or FrA.
Complexity is dominated by computing HDIM - n22n−1.
18 / 27
50. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalizing to other ANF Monomials
Previously, we exploited predictable absence of particular terms
of degree n − 1 in the ANFs of some output bits (entries
ˆH(F)i,j = 0).
20 / 27
51. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalizing to other ANF Monomials
Previously, we exploited predictable absence of particular terms
of degree n − 1 in the ANFs of some output bits (entries
ˆH(F)i,j = 0).
This is an extreme case, we tried to cover more rounds, but we
recovered only surrounding linear layers.
20 / 27
52. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalizing to other ANF Monomials
Previously, we exploited predictable absence of particular terms
of degree n − 1 in the ANFs of some output bits (entries
ˆH(F)i,j = 0).
This is an extreme case, we tried to cover more rounds, but we
recovered only surrounding linear layers.
Consider the case when ˆH(F) =
0 0
0 ?
. There are 3n2
impossible terms of degree n − 1. But there are more
impossible terms of lower degree.
20 / 27
53. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalizing to other ANF Monomials
Previously, we exploited predictable absence of particular terms
of degree n − 1 in the ANFs of some output bits (entries
ˆH(F)i,j = 0).
This is an extreme case, we tried to cover more rounds, but we
recovered only surrounding linear layers.
Consider the case when ˆH(F) =
0 0
0 ?
. There are 3n2
impossible terms of degree n − 1. But there are more
impossible terms of lower degree.
The predictable absence of such terms may be used to recover
a secret round function.
20 / 27
54. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Recovery attack on 5-round Feistel Network (1/2)
Consider a 5-round Feistel Network F with bijective round
functions. Let f be the last round function.
au = 0
au = 1/0 au = 1/0
F5 F2 F1 F0
f0
f1
f2
21 / 27
55. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Recovery attack on 5-round Feistel Network (1/2)
Consider a 5-round Feistel Network F with bijective round
functions. Let f be the last round function.
We can prove that there are more than 2n monomials which
can’t occur in the ANFs on right branch of the 4-round FN.
au = 0
au = 1/0 au = 1/0
F5 F2 F1 F0
f0
f1
f2
21 / 27
56. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Recovery attack on 5-round Feistel Network (1/2)
Consider a 5-round Feistel Network F with bijective round
functions. Let f be the last round function.
We can prove that there are more than 2n monomials which
can’t occur in the ANFs on right branch of the 4-round FN.
This gives us information about the last round function f .
au = 0
au = 1/0 au = 1/0
F5 F2 F1 F0
f0
f1
f2
21 / 27
57. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Recovery attack on 5-round Feistel Network (2/2)
We obtain a linear system with 2n unknowns (ANF coefficients
of fi ) and more than 2n equations.
22 / 27
58. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Recovery attack on 5-round Feistel Network (2/2)
We obtain a linear system with 2n unknowns (ANF coefficients
of fi ) and more than 2n equations.
By solving the system we recover the secret round function f
(up to a XOR constant).
22 / 27
59. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Recovery attack on 5-round Feistel Network (2/2)
We obtain a linear system with 2n unknowns (ANF coefficients
of fi ) and more than 2n equations.
By solving the system we recover the secret round function f
(up to a XOR constant).
Complexity is dominated by generating the system and is
O(23n).
22 / 27
60. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by number of rounds
If the degrees of round functions are low, we can attack more
rounds.
23 / 27
61. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by number of rounds
If the degrees of round functions are low, we can attack more
rounds.
Theorem (Impossible Monomials in Feistel Networks)
Let F be a 2n-bit Feistel Network with r rounds and round
functions of degree at most d. If dr−2 < n, then there are at least
2n impossible monomials in the ANFs of right bits of F.
23 / 27
62. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by number of rounds
If the degrees of round functions are low, we can attack more
rounds.
Theorem (Impossible Monomials in Feistel Networks)
Let F be a 2n-bit Feistel Network with r rounds and round
functions of degree at most d. If dr−2 < n, then there are at least
2n impossible monomials in the ANFs of right bits of F.
Recovery attack when dr−3 < n. Note that the bound is not
tight, the previously described attack on 5 rounds does not
satisfy this condition.
23 / 27
63. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Generalization by number of rounds
If the degrees of round functions are low, we can attack more
rounds.
Theorem (Impossible Monomials in Feistel Networks)
Let F be a 2n-bit Feistel Network with r rounds and round
functions of degree at most d. If dr−2 < n, then there are at least
2n impossible monomials in the ANFs of right bits of F.
Recovery attack when dr−3 < n. Note that the bound is not
tight, the previously described attack on 5 rounds does not
satisfy this condition.
Moreover, with low degrees there are less unknowns and we
need less impossible monomials.
23 / 27
65. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Relation with Division Property
Division Property is a tool for integral attacks introduced
recently by Todo.
25 / 27
66. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Relation with Division Property
Division Property is a tool for integral attacks introduced
recently by Todo.
Division Property allows to find cubes of dimension 2n − 1 (or
less) over which a given Feistel Network sums to zero.
25 / 27
67. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Relation with Division Property
Division Property is a tool for integral attacks introduced
recently by Todo.
Division Property allows to find cubes of dimension 2n − 1 (or
less) over which a given Feistel Network sums to zero.
Such cubes correspond to the absent ANF coefficients of
degree 2n − 1 (or less) which correspond to zero items in
HDIM.
25 / 27
68. Introducing HDIM HDIM in Feistel Networks Impossible Monomials Attack Division property Conclusions
Relation with Division Property
Division Property is a tool for integral attacks introduced
recently by Todo.
Division Property allows to find cubes of dimension 2n − 1 (or
less) over which a given Feistel Network sums to zero.
Such cubes correspond to the absent ANF coefficients of
degree 2n − 1 (or less) which correspond to zero items in
HDIM.
The results for concrete Feistel Networks obtained by Todo are
very similar to ours.
25 / 27