Cryptanalysis of Key-Dependent S-Boxes
Armence
differential and linear cryptanalysis can be used to break ciphers
using fixed S-boxes such as DES or FEAL. Now, I am interested in how
those attacks can be applied to key-dependent S-boxes such as
Blowfish. Is there a paper out there (one I don't have to pay for)
which describes this well?
Scott Contini
You might have a look at this article along with the references:
http://www.schneier.com/twofish-analysis-shiho.pdf
Scott
Tom St Denis
There are different ways of getting "key dependent sboxes" in
reality. The Blowfish way is a bit more complicated, but it boils
down to the same thing. The "sbox" is still just a function of known
data and key bits. In the case of Blowfish it gets more complicated
to look at it that way as you progress through the tables as table
entries can be functions of already modified table entries.
In the case of Twofish, looking at the 8x8s as actual substitution
boxes is merely a matter of optimization and not really how the
algorithm works at all. The 8x8s are actually just [iirc] an SPN with
key bits and a 4x4 known sbox. So you'd apply DC and LC on those not
the sbox as some "unknown."
That being said the fastest attacks on Twofish don't really care what
the contents of the sbox is and care more for the structure of the
algorithm (e.g. impossible differentials, truncated differentials,
etc).
Generally, small keyed functions like 8x8s are not bad but when
analyzing it for LC and DC you should really think of them as one long
chain of constituent parts.
Tom