Impossible Differential Distinguishers of Two Generalized Feistel Structures

Abstract

Generalized Feistel structures are widely used in the design of block ciphers. In this paper, we focused on retrieving impossible differentials for two kinds of generalized Feistel structures: CAST256-like structure with Substitution-Permutation (SP) or Substitution-Permutation-Substitution (SPS) round functions (named CAST256SP and CAST256SPS, respectively) and MARS-like structure with SP/SPS round function (named MARSSP and MARSSPS, respectively). Known results show that for bijective round function, CAST256-like structures and MARS-like structures have (m2−1) and (2m−1) rounds impossible differentials, respectively. By our observation, there existed (m2+m) rounds impossible differentials in CAST256SP and (3m−3) rounds impossible differentials in MARSSPS (this result does not require the P layer to be invertible). When the diffusion layer satisfied some special conditions, CAST256SPS had (m2+m−1) rounds impossible differentials and MARSSPS had (3m−3) rounds impossible differentials.