[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-504997-105":59,"doc-detail-504997-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","automatic-search-of-rectangle-attacks-on-feistel-ciphers-application-to-warp","Automatic Search of Rectangle Attacks on Feistel Ciphers - Application to WARP","","Boomerang analysis of WARP, a generalized Feistel network with compact hardware, is presented using an adapted automated search framework. The study derives a 23-round distinguisher with probability 2−124 and improves execution time through model adaptations for Feistel settings. Extending the model with key-recovery relations yields a 26-round rectangle attack with stated time and data complexities. The work also identifies how positioning key addition after the S-box enables a factor 275 gain in time complexity, while concluding security remains unaffected for the 41-round cipher.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/automatic-search-of-rectangle-attacks-on-feistel-ciphers-application-to-warp/504997/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/automatic-search-of-rectangle-attacks-on-feistel-ciphers-application-to-warp/504997.png","ImageObject",300,407,{"name":92,"@type":93},"Oliver","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-13","2026-10-04",true,{"@type":102,"interactionType":103,"userInteractionCount":14},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What attack technique is used to analyze WARP in this paper?","Question",{"text":112,"@type":113},"The paper uses boomerang analysis and then extends it to search for rectangle attacks on WARP.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How is the distinguisher search adapted for Feistel ciphers?",{"text":117,"@type":113},"The authors adapt an automated model originally designed for SPNs to the Feistel case, accounting for middle-round dependencies and improving runtime.",{"name":119,"@type":110,"acceptedAnswer":120},"Does the paper claim WARP’s security is broken?",{"text":121,"@type":113},"No. The authors state that their findings do not threaten the security of WARP, which iterates 41 rounds.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},504997,1791915194,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":14,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145},8796095461610,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","IACR Transactions on Symmetric Cryptology  \nISSN 2519-173X, Vol. 2022, No. 2, pp. 113–140. DOI:10.46586/tosc.v2022.i2.113-140  \nAutomatic Search of Rectangle Attacks on Feistel Ciphers: Application to WARP  \nVirginie Lallemand 1 , Marine Minier 1 and Loïc Rouquette2 ,3  \n1 Université de Lorraine, CNRS, Inria, LORIA, Nancy, France  \n[firstname.name@loria.fr](firstname.name@loria.fr)  \n2 CITI, INRIA, INSA Lyon, Villeurbanne, France  \n[loic.rouquette@insa-lyon.fr](loic.rouquette@insa-lyon.fr)  \n3 LIRIS, UMR5201 CNRS, Villeurbanne, France  \nAbstract. In this paper we present a boomerang analysis of WARP, a recently proposed Generalized Feistel Network with extremely compact hardware implementations. Westart by looking for boomerang characteristics that directly take into account the boomerang switch effects by showing how to adapt Delaune et al. automated tool to the case of Feistel ciphers, and discuss several improvements to keep the execution time reasonable. This technique returns a 23-round distinguisher of probability 2 −124 , which becomes the best distinguisher presented on WARP so far. We then look for an attack by adding the key recovery phase to our model and we obtain a 26-round rectangle attack with time and data complexities of 2115 .9 and 2120 .6 respectively, again resulting in the best result presented so far. Incidentally, our analysis discloses how an attacker can take advantage of the position of the key addition (put after the S-box application to avoid complementation properties), which in our case offersan improvement of a factor of 275 of the time complexity in comparison to a variant with the key addition positioned before. Note that our findings do not threaten the security of the cipher which iterates 41 rounds.  \nKeywords: Cryptanalysis · Feistel cipher · Boomerang attack · WARP  \n1 Introduction  \nBoomerang distinguishers [Wag99] were introduced at FSE’99 as a variant of differential distinguishers [BS91] taking advantage of the existence of short differentials of high probability. In its simplest version, the attacker sees the cipher E as the composition of two subciphers (E = E1 ◦ E0 ) and makes use of a differential for each part. If at first it was thought that these two differentials can be selected freely, following advances like [Mur11] showed that the interdependence should be carefully treated, as incompatibilities or better-than-expected probabilities might occur.  \nAs a result, searching for the best boomerang distinguisher does not simply reduce to finding two differentials of high probability, and thus emerged a need for automated tools that would take into account the possible events in the middle, later formalized by the BCT [CHP+ 18] (for SPNs) and FBCT [BHL+ 20] (for Feistels) theories. Two techniques have been proposed recently to address this issue. In [HBS21], the authors proposed to give as input to a MILP model the size of the middle part (where dependencies happen) and to take into account one type of dependency (the so-called ladder switch [BK09]) . Amore precise approximation of the probability of the middle rounds was then obtained with the BCT framework or experimentally. A second technique has been proposed in [DDV20], that directly takes into account all the possible middle dependencies and does not require that the attacker specifies the size of the middle part.  \nLicensed under Creative Commons License CC-BY 4.0.   \nReceived: 2021-11-23 Revised: 2022-03-01 Accepted: 2022-05-01 Published: 2022-06-10  \nIf many papers start by looking for the best distinguisher to next turn it into an attack, better results might be obtained by taking into account the incidence of the distinguisheron the key recovery phase. An example of this was given in [ZDJ19] when building a rectangle attack on Deoxys, and further discussions were provided in [QDW+ 21] with results on Skinny. The latter presents an automated tool that takes the model provided in [DDV20] and adds relations to include the dominating f","cbCaiiUM5jNx04cX","https://ap.wps.com/l/cbCaiiUM5jNx04cX","pdf",1163925,28,"English","# 1 Introduction\n# Outline\n## Section 2 preliminaries\n## Section 3 model searching for boomerang distinctions","[{\"question\":\"What attack technique is used to analyze WARP in this paper?\",\"answer\":\"The paper uses boomerang analysis and then extends it to search for rectangle attacks on WARP.\"},{\"question\":\"How is the distinguisher search adapted for Feistel ciphers?\",\"answer\":\"The authors adapt an automated model originally designed for SPNs to the Feistel case, accounting for middle-round dependencies and improving runtime.\"},{\"question\":\"Does the paper claim WARP’s security is broken?\",\"answer\":\"No. The authors state that their findings do not threaten the security of WARP, which iterates 41 rounds.\"}]","Automatic Search of Rectangle Attacks on Feistel Ciphers - Application to WARP | PDF",1791084371,71]