Differential fault analysis on the contracting UFN structure, with application to SMS4 and MacGuffin

The contracting unbalanced Feistel networks (UFN) is a particular structure in the block ciphers, where the “left half” and the “right half” are not of equal size, and the size of the domain of one half is larger than that of the range. This paper studies the security of the contracting UFN structure against differential fault analysis (DFA). We propose two basic byte-oriented fault models and two corresponding attacking methods. Then we implement the attack on two instances of the contracting UFN structure, the block ciphers SMS4 and MacGuffin. The experiments require 20 and 4 faulty ciphertexts to recover the 128-bit secret key of SMS4 in the two fault models, respectively. Under similar hypothesis, MacGuffin is breakable with 355 and 165 faulty ciphertexts, respectively. So our work not only builds up a general model of DFA on the contracting UFN structure and ciphers, but also provides a new reference for fault analysis on other block ciphers.