Differential analysis of the Extended Generalized Feistel Networks

• Point out mistakes in the security evaluation of EGFN against differential attack.
• Construct a class of differential conflicting with designers' evaluation for EGFN.
• Give a method to search a special type of differential with high probability.
• Our results show that EGFN always exist high probability iterative differential.

This paper studies the differential analysis of Extended Generalized Feistel Networks (EGFNs). First we construct a class of differential characteristics which conflict with designers' evaluation of minimal number of active S-boxes for EGFN. Then by analyzing the difference cancellation property of EGFN, we propose a method to search a special type of differential characteristics with high probability. We obtain the best case of this kind of differential characteristic for EGFN with block number 4≤k≤324≤k≤32. Our results show that for EGFN with k≥8k≥8 there always exist high probability iterative differential characteristics and their number of active S-boxes for 20-round all are equal to 26. Therefore, the actual ability of EGFN resisting differential analysis may be a lot weaker than evaluated by designers and larger block size cannot improve the situation.