Pseudorandomness analysis of the (extended) Lai–Massey scheme

In this paper we find that the two-round (extended) Lai–Massey scheme is not pseudorandom and three-round (extended) Lai–Massey scheme is not strong pseudorandom. Combined with previous work, we prove that three rounds are necessary and sufficient for the pseudorandomness and four rounds are necessary and sufficient for the strong pseudorandomness.

Research highlights
► Two-round (extended) Lai–Massey scheme is not pseudorandom.
► Three-round (extended) Lai–Massey scheme is not strong pseudorandom.
► Three rounds are necessary and sufficient for the pseudorandomness.
► Four rounds are necessary and sufficient for the strong pseudorandomness.